1
00:00:00,960 --> 00:00:05,250
So just a brief review on this section, we've done some really cool things, you'll probably want to

2
00:00:05,250 --> 00:00:10,530
go back and run this section one or two more times just to make sure that you've got a good handle on

3
00:00:10,530 --> 00:00:16,660
how to create your own exploits and then use those to gain access to a victim computer.

4
00:00:16,980 --> 00:00:24,570
So when we tell you not to download suspicious files, do you see why now just a simple, innocent run

5
00:00:24,570 --> 00:00:25,230
of a program?

6
00:00:25,230 --> 00:00:29,280
In fact, user probably doesn't even know that anything happened.

7
00:00:29,280 --> 00:00:30,810
They think it was just a bad game.

8
00:00:30,810 --> 00:00:32,550
So they might even try to delete it.

9
00:00:32,550 --> 00:00:33,850
They won't be able to delete it.

10
00:00:34,290 --> 00:00:37,200
In fact, let's come back over here and go to our downloads folder.

11
00:00:37,860 --> 00:00:40,860
And if I try to delete this file right now.

12
00:00:42,080 --> 00:00:46,040
It can't be because it's being used in some command line utility.

13
00:00:46,590 --> 00:00:52,490
Oh, well, we probably just reboot the computer, but we've already got access and we've not only got

14
00:00:52,490 --> 00:00:59,240
access, we've got administrator level access and we copied all those password hashes.

15
00:01:01,120 --> 00:01:08,860
So now we can find out if if the system hadn't told us directly what the IP user password was, we would

16
00:01:08,860 --> 00:01:17,830
have been able to use this hash dump that we ran interpreter to capture some of those hashes and then

17
00:01:17,830 --> 00:01:24,910
just use a simple Web service or any other password cracking tool to find out what the passwords might

18
00:01:24,910 --> 00:01:26,880
be for just one of those users.

19
00:01:27,580 --> 00:01:29,530
And let's go through the chain that got us here.

20
00:01:29,530 --> 00:01:36,400
First of all, it all started with an MSF venom or a payload that we wanted to create.

21
00:01:36,640 --> 00:01:44,290
And we created a payload called Gayndah Yuxi that gave us a reverse TCP connection that let us run interpretor

22
00:01:44,830 --> 00:01:46,420
on the remote computer.

23
00:01:46,420 --> 00:01:50,680
That's this remote shell that we were able to list directory files.

24
00:01:50,890 --> 00:01:53,370
We'd be able to download files if we wanted to from here.

25
00:01:53,380 --> 00:01:54,340
We'll see how to do that.

26
00:01:54,340 --> 00:02:00,280
When we hack of Windows 10 computer, we can dump the password hashes so that we can start cracking

27
00:02:00,280 --> 00:02:01,870
passwords on the user system.

28
00:02:02,320 --> 00:02:07,720
We can delete files, we can change the timestamps on files.

29
00:02:08,110 --> 00:02:13,690
There's no limit to the number of things that you can do once you're inside that remote computer, especially

30
00:02:13,690 --> 00:02:18,080
as an elevated user, in this case, as a root or system level user.

31
00:02:18,850 --> 00:02:24,580
So we had to first get the user to click through that Web link and download the exploit file.

32
00:02:25,060 --> 00:02:31,690
But once they downloaded that exploit file, we were able to connect in and then create another exploit.

33
00:02:31,690 --> 00:02:37,360
So we had to come back to our metastable framework and we started them interpretor handler.

34
00:02:37,750 --> 00:02:46,420
So we were able to use the multi exploit handler to listen for that callback from the infected Windows

35
00:02:46,420 --> 00:02:49,360
seven computer when it called home.

36
00:02:49,360 --> 00:02:57,310
We got an interactive session by saying Sessions Space Dashi Space One gave us an interactive session

37
00:02:57,310 --> 00:02:59,110
with that first infected computer.

38
00:02:59,110 --> 00:03:05,590
Again, if we'd infected several computers on the network, we could have said Session space dashi two,

39
00:03:05,920 --> 00:03:08,260
three, four, five and so on.

40
00:03:08,560 --> 00:03:14,020
And we could have multiple computers running this reverse TCP interpreter session.

41
00:03:14,560 --> 00:03:20,200
Once we got into the user computer, though, we were just at the same level of privilege as the user

42
00:03:20,200 --> 00:03:22,380
who ran that executable file.

43
00:03:22,720 --> 00:03:31,300
So we had to bypass user account controls, bypass UAC using another exploit, bypass UAC and elevate

44
00:03:31,300 --> 00:03:37,330
our privileges so that we could get the system level privileges using that technique.

45
00:03:37,330 --> 00:03:42,370
Number one, that was get system space Dashty Space one.

46
00:03:42,970 --> 00:03:50,650
And then we had a system level user access we needed to get UID that gave us the entire authority system.

47
00:03:50,980 --> 00:03:56,740
So we were the route user on Windows seven that allowed us to do something really cool, dump all the

48
00:03:56,740 --> 00:04:00,000
password hashes by running hash, dump an interpreter.

49
00:04:00,190 --> 00:04:05,740
There are lots of other really cool commands like Timestamp that lets you change the timestamps on files

50
00:04:05,740 --> 00:04:10,180
so you can cover your tracks and lots of other things that you can learn as you dig in a little bit

51
00:04:10,180 --> 00:04:11,110
more interpretor.

52
00:04:11,320 --> 00:04:17,050
We'll see a little we'll see a little more of an interpreter when we run a Windows 10 hack in just a

53
00:04:17,050 --> 00:04:17,920
little bit as well.

54
00:04:18,280 --> 00:04:24,100
But that gets us our first thorough introduction to metabolite and interpretor, and we'll see how to

55
00:04:24,100 --> 00:04:27,820
use those even further as we do additional hacks later in the course.

56
00:04:28,120 --> 00:04:29,410
We'll see you in the next section.