WEBVTT 00:00:02.240 --> 00:00:03.330 All right, in this demo, 00:00:03.330 --> 00:00:06.750 we're going to discover credentials and escalate privileges with Pupy. 00:00:07.290 --> 00:00:07.850 To do that, 00:00:07.860 --> 00:00:10.610 we're going to dig a little deeper into each of our sessions and see if 00:00:10.610 --> 00:00:14.010 we can't use some of the Pupy tools to discover credentials on each 00:00:14.010 --> 00:00:18.300 target and escalate our privileges from a user level to an administrator 00:00:18.300 --> 00:00:19.950 or system on the Windows target. 00:00:20.540 --> 00:00:23.190 Using these tools will allow you to spoof credentials on your 00:00:23.190 --> 00:00:26.640 targets or even act as administrator if you did not have access to 00:00:26.640 --> 00:00:28.050 the system with that privilege level. 00:00:28.050 --> 00:00:31.020 Before we get into running these commands, 00:00:31.030 --> 00:00:34.750 we need to create a few users with no admin privileges on our Windows 7 target. 00:00:34.750 --> 00:00:37.920 On the Windows target, we'll go to Start, 00:00:38.160 --> 00:00:40.250 right‑click Computer, and click Manage. 00:00:41.300 --> 00:00:43.610 In this interface, we can add a few users. 00:00:43.670 --> 00:00:46.950 For this example, I added Bob, Susan, and testuser. 00:00:47.540 --> 00:00:50.710 I set a basic password value just to fill that in for each of them. 00:00:50.830 --> 00:00:51.800 They're all the same, 00:00:51.840 --> 00:00:54.240 and we'll see how we can tell that from our Pupy server 00:00:54.250 --> 00:00:55.750 when we dump the credentials later. 00:00:56.210 --> 00:00:59.350 Let's go back to our Pupy server and see if we can dump these credentials. 00:01:00.410 --> 00:01:03.860 We'll try to use the IEUser account which has just local administrator 00:01:03.860 --> 00:01:06.650 permissions to run a credential dump on the Windows system. 00:01:07.240 --> 00:01:08.230 Before we run that, 00:01:08.240 --> 00:01:10.770 we need to specify that we want to interact with session 00:01:10.770 --> 00:01:15.000 1 by using the command sessions ‑i 1. 00:01:15.000 --> 00:01:17.850 Once we we run that command, when we look at our sessions, 00:01:18.340 --> 00:01:20.590 we can see that session 2 is grayed out, 00:01:20.600 --> 00:01:21.960 indicating that we're not using it. 00:01:21.960 --> 00:01:26.750 Now we can try to run the creddump command to get credentials from this machine. 00:01:27.440 --> 00:01:28.860 Once this command completes, 00:01:28.870 --> 00:01:31.280 we can see that we were able to obtain the usernames 00:01:31.290 --> 00:01:34.850 of all accounts on that system, as well as the hashes for their passwords. 00:01:35.440 --> 00:01:38.050 We can also determine the identity of the built‑in 00:01:38.060 --> 00:01:40.660 administrator account using the relative identifier, 00:01:40.660 --> 00:01:44.050 500, which on this machine is still named administrator. 00:01:44.840 --> 00:01:47.050 Although it uses a tool other than Pupy, 00:01:47.440 --> 00:01:48.290 just for fun, 00:01:48.510 --> 00:01:51.110 we could also take these password hashes and use a tool 00:01:51.110 --> 00:01:52.850 like hashcat to try to crack them. 00:01:53.640 --> 00:01:56.440 Hashcat can take a dictionary file and attempt to match 00:01:56.440 --> 00:01:58.480 hashes to words in the file to crack them. 00:01:58.480 --> 00:02:01.800 Just to demonstrate the value of the information we obtained, 00:02:02.240 --> 00:02:08.050 I'll copy Bob's hash password and place it in a hashcat command and 00:02:08.050 --> 00:02:10.060 then run it and see if we can't crack the password. 00:02:10.060 --> 00:02:15.010 And we've cracked his password, 00:02:15.440 --> 00:02:18.340 although we can see that Bob's password was pretty weak, 00:02:18.340 --> 00:02:20.950 and this technique does rely on a dictionary. 00:02:21.440 --> 00:02:24.280 If a hacker had a substantial dictionary of possible 00:02:24.280 --> 00:02:27.580 passwords and you had any users in your network that happened 00:02:27.580 --> 00:02:30.380 to use common passwords like this one, Password1, 00:02:30.380 --> 00:02:32.480 or variations of the same, 00:02:32.660 --> 00:02:35.340 there's a pretty good chance that somebody who was able to 00:02:35.340 --> 00:02:38.440 obtain access could then find additional usernames and 00:02:38.440 --> 00:02:40.720 passwords and spoof user actions. 00:02:41.440 --> 00:02:44.780 In addition to obtaining credentials, using the built‑in tools, 00:02:44.790 --> 00:02:47.450 we can also escalate our privileges to a system level. 00:02:47.940 --> 00:02:50.650 To accomplish this, there are two commands that we can try to run. 00:02:51.040 --> 00:02:52.850 The first command is beroot. 00:02:53.940 --> 00:02:56.810 Beroot will explore potential vulnerabilities that can be 00:02:56.810 --> 00:02:59.660 leveraged to obtain higher privileges and test whether the 00:02:59.660 --> 00:03:04.390 connected user already has any elevated privileges. Taking a 00:03:04.390 --> 00:03:07.450 look at the output from this command, we can see a few different categories, 00:03:07.460 --> 00:03:10.840 which show us the startup registry keys, some output from 00:03:10.840 --> 00:03:14.990 the task scheduler, a list of interesting files, in this 00:03:14.990 --> 00:03:17.260 case, the Unattend.xml file, 00:03:17.270 --> 00:03:20.050 which is used to automate the installation of Window 7 and 00:03:20.050 --> 00:03:22.050 may contain credentials as a result, 00:03:23.220 --> 00:03:28.070 a test of the current account's privileges, and the presence of 00:03:28.070 --> 00:03:31.050 well‑known vulnerable surfaces and writeable paths. 00:03:32.000 --> 00:03:34.740 We can either exploit these vulnerabilities, or we could use 00:03:34.740 --> 00:03:38.520 another built‑in Pupy tool, Get System, to escalate our privileges 00:03:38.520 --> 00:03:40.250 to a system level in the local machine. 00:03:41.030 --> 00:03:43.090 To run that, we use the command get system, 00:03:43.280 --> 00:03:47.750 followed by a ‑m to select the method, in this case, impersonate. 00:03:50.840 --> 00:03:54.230 After this tool runs, it opens another session with our server, 00:03:54.520 --> 00:03:56.250 which, if we view it in sessions, 00:03:56.940 --> 00:04:00.850 we can see here that it has system‑level permissions with our Windows 7 target. 00:04:01.540 --> 00:04:04.470 Another method we could use to obtain these permissions or 00:04:04.470 --> 00:04:07.570 impersonate other users is to use the Impersonate tool. 00:04:07.770 --> 00:04:11.250 To do that, we run the impersonate ‑l command. 00:04:11.510 --> 00:04:14.880 This will give us a list of available SIDs to impersonate. At the 00:04:14.880 --> 00:04:18.339 bottom, we have a list of our options. To impersonate this system 00:04:18.339 --> 00:04:25.660 account, we will need to use impersonate ‑m ‑i followed by the SID 00:04:25.660 --> 00:04:26.850 of our system account. 00:04:29.410 --> 00:04:32.570 This command will also spawn a new session, again, 00:04:32.580 --> 00:04:34.250 with system‑level permissions. 00:04:34.740 --> 00:04:36.060 Before we go to the recap, 00:04:36.120 --> 00:04:39.610 let's quickly go back to session management. To change our 00:04:39.610 --> 00:04:42.760 selection back to all of the sessions, we'd use the sessions 00:04:42.760 --> 00:04:47.450 ‑i command again, but this time, type 1,2,3, and 4, 00:04:48.140 --> 00:04:50.600 which will then give us access to all of our sessions, 00:04:50.840 --> 00:04:52.750 which, when we verify with sessions, 00:04:53.240 --> 00:04:57.510 we now are running commands on all of our sessions at the same time. We 00:04:57.510 --> 00:05:01.600 really don't need two system‑level sessions, so let's kill one of them 00:05:01.610 --> 00:05:05.370 using sessions ‑k followed by the number of the session we want to 00:05:05.370 --> 00:05:09.970 kill. I'll kill session 4. Careful not to use the uppercase with this 00:05:09.970 --> 00:05:11.310 command, in other words, 00:05:11.310 --> 00:05:14.950 dash capital K, because it will kill all of your sessions. 00:05:15.340 --> 00:05:17.050 Unless, of course, that's what you want to do. 00:05:17.710 --> 00:05:21.400 Exploring the sessions command further using sessions ‑h, we 00:05:21.400 --> 00:05:24.920 have additional options to drop the connections abruptly. Now 00:05:24.920 --> 00:05:26.450 that we understand session management, 00:05:26.840 --> 00:05:29.450 let's go over a quick recap of what we covered in this demo. 00:05:30.110 --> 00:05:33.440 We covered how to run commands on a single session rather than on 00:05:33.450 --> 00:05:37.020 all Pupy sessions and also how to manage interaction with each 00:05:37.020 --> 00:05:39.450 session and kill sessions we no longer need. 00:05:40.340 --> 00:05:43.190 We used the credential dumping tool to obtain a list of other 00:05:43.190 --> 00:05:46.890 users and their hashed passwords and saw an example of use of 00:05:46.890 --> 00:05:48.650 another tool to find the password. 00:05:49.440 --> 00:05:52.110 We also learned how to use tools within Pupy to find 00:05:52.110 --> 00:05:54.150 available paths to escalate privileges, 00:05:54.570 --> 00:05:57.350 as well as a tool to obtain system‑level privileges. 00:05:58.140 --> 00:06:00.630 In the next demo, we'll be using a few more tools within 00:06:00.630 --> 00:06:02.750 Pupy to gather information from our target.