WEBVTT

00:00:01.540 --> 00:00:02.950
Welcome to our lab environment.

00:00:03.440 --> 00:00:04.960
I have here two machines.

00:00:05.340 --> 00:00:09.660
This one here is a Windows 2016 machine, which will be our victim machine.

00:00:10.440 --> 00:00:13.260
I'm logged here as Kenny, which is a regular user.

00:00:14.240 --> 00:00:17.960
I also have here a Kali Linux version 2021.1,

00:00:18.440 --> 00:00:21.200
which is not mandatory, but it will help us a lot during the attacks.

00:00:22.240 --> 00:00:25.450
Let's get started by preparing the SharpUp tool for our attacks.

00:00:26.340 --> 00:00:29.410
First, we need to download and compile the code so we can use the

00:00:29.410 --> 00:00:33.520
tool. In a real red team engagement, you should do those steps on

00:00:33.520 --> 00:00:36.990
a separate Windows machine and then only copy the executable file

00:00:36.990 --> 00:00:38.060
to the victim computer.

00:00:38.740 --> 00:00:40.650
But in here, just to make things easier,

00:00:40.660 --> 00:00:43.750
I'll use the victim computer to download and compile the code.

00:00:44.840 --> 00:00:49.550
So, let me go to the SharpUp GitHub, then click on this button,

00:00:49.550 --> 00:00:55.660
Code, and then select the option Download ZIP. And this will

00:00:55.660 --> 00:00:58.150
download the whole SharpUp code as a ZIP file.

00:00:59.240 --> 00:01:02.510
Once the download is completed, we just need to open the ZIP and

00:01:02.510 --> 00:01:06.610
extract the files to anywhere you want. In my case, I already

00:01:06.610 --> 00:01:10.680
had extracted it to my desktop, so let's open the folder and

00:01:10.680 --> 00:01:11.750
take a look what's inside.

00:01:13.040 --> 00:01:13.570
Perfect.

00:01:13.580 --> 00:01:18.290
Here we have a typical C# project, and you can use any C# compiler to

00:01:18.290 --> 00:01:22.130
build the executable file. In my case, I already installed on this

00:01:22.130 --> 00:01:26.020
machine Microsoft Visual Studio, so I can simply open this project

00:01:26.020 --> 00:01:33.020
file. Done. As you can see here, I have the whole source code here. If I wanted,

00:01:33.030 --> 00:01:36.260
I could even customize the code for any specific needs I might have.

00:01:36.940 --> 00:01:40.270
So, let's compile this code. For that, I will go to the menu

00:01:40.270 --> 00:01:43.360
Build, and then click on Build Solution.

00:01:46.340 --> 00:01:46.890
Perfect.

00:01:46.900 --> 00:01:50.930
As you can see here in the Output area, the code was compiled and the

00:01:50.930 --> 00:01:53.860
executable was saved under the folder bin\Debug.

00:01:54.640 --> 00:01:56.050
So let's take a look in that folder.

00:01:57.140 --> 00:02:02.400
SharpUp, bin, and then Debug. Perfect.

00:02:02.410 --> 00:02:06.000
We have here the executable file that we just compiled. And to make

00:02:06.000 --> 00:02:08.259
things easier, I will move this file to my desktop.

00:02:10.240 --> 00:02:13.800
All right, now we are ready to test the SharpUp, so

00:02:13.810 --> 00:02:15.260
let me open my terminal here,

00:02:16.540 --> 00:02:21.110
go to my desktop. And then to test SharpUp, we'll simply

00:02:21.110 --> 00:02:22.960
execute it without any parameters.

00:02:25.540 --> 00:02:26.070
Amazing.

00:02:26.070 --> 00:02:26.590
Take a look.

00:02:26.600 --> 00:02:28.160
The executable is working fine.

00:02:28.270 --> 00:02:30.160
It gave us the help page to the tool.

00:02:30.940 --> 00:02:34.150
As you can see here, the tool has 13 different modules that will

00:02:34.150 --> 00:02:35.950
check several privilege escalation techniques.

00:02:36.740 --> 00:02:39.570
In the next video, we'll explore those modules and see how

00:02:39.570 --> 00:02:41.660
to get admin privilege to this computer.