WEBVTT 00:00.440 --> 00:02.250 Hey everybody welcomes the next video. 00:02.250 --> 00:11.840 So now that we've gotten our user access we've got access impersonation tokens the user Jay Smith now 00:11.850 --> 00:17.940 that we're going to want to look at taking this a little bit more laterally so we've got an admin hash 00:17.940 --> 00:23.080 and we have a feeling that there might be a potential Password Reuse where the admin accounts. 00:23.100 --> 00:31.100 So a quick way for us to determine that is to quickly find out what hosts are running SMB so that we 00:31.100 --> 00:32.650 can use past the hash. 00:32.660 --> 00:40.870 So what we're gonna do is we're gonna go ahead and background this interpretation perfect so those sessions 00:40.900 --> 00:43.150 dash out we should see our session still there. 00:43.150 --> 00:44.170 Perfect. 00:44.170 --> 00:49.420 Now we're gonna use use auxiliary scanner port scan 00:52.850 --> 00:53.720 slash TSA 00:57.210 --> 00:58.000 perfect. 00:58.380 --> 01:01.310 Then we're going to show options. 01:01.320 --> 01:02.780 Let's see what options we got. 01:02.780 --> 01:13.700 We're gonna set ports to four for five for us and b set our hosts to 1 9 2 1 680 one hundred one dot 01:13.860 --> 01:14.660 one hundred two. 01:14.660 --> 01:15.570 One two three 01:18.890 --> 01:22.600 then we're gonna set the Reds to 20. 01:22.810 --> 01:23.810 I'm going to go out and run that 01:27.090 --> 01:27.510 perv. 01:27.550 --> 01:29.020 It looks like all of them are open. 01:29.060 --> 01:39.090 However let's see now 1 0 1 is the web host that we are already attacked arms 1 0 3 is the web host 01:39.090 --> 01:44.520 we already attacked it looks like one hundred is there as well so domain controller I highly doubt is 01:44.520 --> 01:49.380 going to be reusing the admin hashes so we'll take a look at 1 to 1 which is an unknown host at the 01:49.380 --> 01:51.740 moment that we have not we're not quite sure about yet. 01:52.680 --> 02:00.450 So the next thing we don't want to do is we're going to use P S exact in medicinally to go ahead and 02:00.450 --> 02:02.630 check that hash or pass the hash for us. 02:02.640 --> 02:11.970 Now we can do this manually board news madness boy just for sake of quickness and use exploit windows 02:12.620 --> 02:14.190 SMB. 02:14.650 --> 02:19.220 Yes exactly perfect show options 02:22.110 --> 02:27.260 or we'll set our hosts to 1 9 2 1 6 8 1 0 1 0 1 02:30.740 --> 02:41.720 then we are going to set SMB user to administrator and we're going to go ahead and Cat Out hash which 02:41.720 --> 02:53.260 is in our local directory here that we grabbed from our other machine one copy that set SMB pass to 02:53.260 --> 02:53.920 this hash 02:56.700 --> 03:11.270 and show options looks good so far so good and set a payload of Windows interpreter the reverse DCP 03:13.460 --> 03:23.000 then we're gonna go and sets l hosted 2 1 2 1 6 8 1 24 set Pt. 2 4 4 4 5 instead of 4 full or 4 which 03:23.000 --> 03:30.620 is what are using Amaru show option to make sure everything looks nice good perfect it does. 03:30.620 --> 03:35.770 Let's go ahead and run it and see if we can gain some access boom. 03:35.830 --> 03:43.150 All right so this info looks like we are on I.T. support 0 1. 03:43.280 --> 03:47.310 So I.T. support 0 1 is is an interesting system based on its name. 03:47.560 --> 03:49.390 So let's get you I.D. what are we. 03:49.420 --> 03:53.230 We are authority system perfect so we're already ready to go. 03:53.260 --> 03:56.960 So at this point we've started off with no access. 03:57.190 --> 04:03.550 We attack the machine exploit it Apache Tomcat with default credentials gain admin access to the machine 04:03.840 --> 04:11.290 dump to the hashes then impersonated a domain user and identified it a potential path the domain admin. 04:11.350 --> 04:17.260 Then after that we've gone ahead and use past the hash and spread it across a few nodes and we see that 04:17.260 --> 04:22.600 this particular one has using the same hash or the same password for their local admin accounts and 04:22.600 --> 04:27.990 now we have two domain machines with system level access on them. 04:28.150 --> 04:31.650 So it's just a matter of time past this point to actually move ourselves and domain admin.