Welcome ladies and gentlemen to walk through Number 10.
We are at the last walk through this box is called Net mine.
So if you are scanning and following along go ahead and go to IP address ten dot ten that ten that once
they D2 to get your scan started while that's going on I do have a few words to say since this is last
episode in this capstone.
If you are feeling overwhelmed or you're feeling like you're just not getting everything that's 100
percent OK.
Rome wasn't built in a day.
Neither is your pen test career.
So please if you feel like you're overwhelmed just take a deep breath go back and watch some of the
videos again.
If you feel like you're struggling also utilize all the resources available to you.
Remember from the beginning there is a disco channel Please utilize the discord channel.
We are there to help.
So if you're struggling know that it's ok you will make it through.
Take good notes go back and try all these again if you need to.
With that being said I have full confidence in you and I'm ready to move on to the last video.
I'm very excited about it because we start to get into exploit development after this and we start to
get into Active Directory which is my favorite.
So we're going to go ahead and move on.
Hopefully your scans ready.
I'll catch over with you scan.
All right.
So let's look at our scan here.
We have a report back that says Port 21 is open which means we have FTB the file transfer protocol.
And right away FCP anon it says anonymous FTB log in is allowed.
This means that we can log in as the user anonymous and gain access to the file share.
Not necessarily a big deal except if you look at where it's placing us look at the printout of this
already.
This to me looks like we are in the C drive.
Right.
So see a user's folder a windows folder etc. So this not so great if you're a sysadmin and you allowed
this open on top of this we scroll down a little bit and we see OK port 80 is open or 80 has something
called indeed HPD eighty point one blah blah blah.
You see this parser PR Teague's Bandwidth Monitor network monitor net mine which is what the Xbox is
called box always gives you a good hint.
Right.
So we know we're up against this probably some root of exploit through net mine at least at least somewhat.
Right.
Usually there's a hint there.
So we'll go check that out.
We've got our P.C. open which we expect when we have one thirty nine and four forty five we see from
four or forty five that's telling us that this machine is a two thousand eight are two or two thousand
twelve.
We'll see how right that is and a little bit and then you see a bunch of RBC open up here.
There's also a web server open looks like on fifty nine eighty five and forty seven 0 0 1.
Both of them were not found.
So probably for all flooring of some sort.
That doesn't mean that just because it's a for or for there can't be a web page sitting beyond these
we could use door buster or look with dirt or whatever and tried to do some directory busting see if
there's a hidden directory back here just because the index for of course doesn't mean that the rest
of it's going to.
So with that being said let's scroll back up and talk theory.
So if we talk theory port 21 is open we have anonymous log in we already know the password we have access
to the entire file system here there's also a web server running.
So when we talk about port 21 being open and we've talked about this in the past with port 21 being
open we can upload a file.
There is no code execution there on its own.
Now this is Microsoft FCP if it was a different file it files protocol FCP server maybe there's remote
code execution already built in some sort of buffer overflow something allows us to you know get that
shell back.
But here with this FTC in particular it's not now FCP as a whole just from logging in all we have access
to is to put files and get files.
That's all it is.
We're transferring files.
It's a file transfer protocol because of this we cannot execute anything.
We could put malware on here all day right.
We could put anything malicious we want to.
Doesn't mean it's going to get executed.
On the other front we have a web page open.
Now this Web page I'm guessing just a hunch.
Not sure is likely running on this I net pub here.
Now iiNet pub is ISIS.
This is a Windows server so it's likely running I guess as a web server.
Now again I could be wrong here it could be hosted somewhere else and these ISIS servers could be for
this down here.
I'm not sure but the instinct that I have here and what I'm seeing when I'm getting at is the first
thing that I saw is OK.
Port 21 is open.
I have the ability to upload a file.
Now I need the ability to execute a file while their social engineering right we can call up somebody
say hey there's this file on this computer I'm helpdesk can you running for me the other option which
we don't have in this instance is to say you know how to execute a file that I put on there.
Well a web server is a fantastic way.
If you guys remember you remember boxes in the past that we've done we've executed files via FCP upload
into a web server.
Right.
So same kind of thought process here is if I can get this file on his Web server maybe I can execute
that and get a reverse shell.
Now I don't know if that's the boxes intention and when I went through those boxes actually a different
path that seems even a little bit easier.
So let's poke a little bit first before we go down this anonymous log and path and let's poke at port
80.
Now the other thing to note too is that if you have access to this machine as anonymous user you can
likely grab the flag of the user already depending on the permissions.
Even chances are you might go to grab the root flag.
I highly doubt that seeing it that's a capture the flag box.
They probably want to do something.
So you can probably grab the user flag off Port 20 and we're going to ignore port 21 completely.
Now if you wanted an adventure and you just want to play around a good idea here it would be to log
into port 21 be a FTB anonymous log in and try to find this file server and see if you can't execute
that against this year and get a reverse shell of some sort.
Given ISP X reverse shall our ISP reverse shell we've done it in the past.
I don't need to show you how to do it but think of that process through and you might go to get a virtual
that way as well.
But from here let's poke at this port 80.
So let's go to our our PR team here and I definitely want Canadian because that car horn scared me so
I said out there.
Let's go to our tend to tend not 10 dot 152 and you see that we have a log in here.
Now when I see a log in.
There's immediate things that I want to do I want to google immediately party G network monitor default
credentials let's do that OK.
So we'll go out to the interweb.
Go to Google and we'll say give for credentials.
That's one thing I want to Google and we'll look here and see if there is.
We'll go to this.
This is from 2010 so PR TV and NPR t g AB and let's try it.
It never hurts especially for doing an internal.
Oh my God on internal assessments all the freaking time default credentials and it just ends up being
bad.
Okay.
Credentials aren't default.
Another thing.
Let's talk about exploits.
Let's look at exploits here and perhaps there is a remote code execution for us so let's open a few
of these.
Let's open this one command injection OK I'm opening well code watch.
I don't know about code watch.
Let's just open this one first.
Party network monitor remote code execution.
But it says authenticated eighteen point two point three eight.
Does this tell us what it is down here.
Eighteen point one point three seven.
OK.
Let's read the description here and see so remote code execution version eighteen point two point three
eight.
So this was on a later version.
It doesn't say specifically in here whether or not this applies to earlier versions.
Usually you'll see like a little greater than less than sign telling you're indicating it doesn't really
hear what we can do is we can at least give it a go and see if it works we can download this and try.
We could see that it's just a batch script and then we just execute against a web page and we provide
a little bit of information here it looks like just providing our cookies.
So the big issue though that we have is that it is authenticated.
So we need to be able to log into this.
So we need to look for a database file or where that might be stored.
Perhaps you can go to Google and say something like DV file location and see where it stores its data.
So let's see where it is a store its data there is one.
This one looks like it could be promising as well.
And program files PR TV network monitor x eighty six party network monitor.
And there's also program data application data so it looks like we might have to do a little bit of
hunting around there's a log database configuration to do database there's backups.
So the reason why I'm thinking about this is I'm thinking about this to say hey OK well where can we
find this information.
Maybe a credentials stored that's maybe what I'm after here is like can I find a credential that is
on this system.
Like where where might have we got to find that.
So if they're in program files as a credential stored in a database move they can pull that down and
we can access that right.
So what we're going to try to do is we're going to try to look through the files we'll look through
the users folder and try to find the the files now for time purposes.
We're gonna go ahead and just kind of cheat a little bit.
So I'm going to go ahead and go back out and we're gonna open up a new tab make it all pretty big here
and we're just going to f teepee out to 10 that tend to end up of 32 and I'm back to being American
with my out anonymous.
Anonymous OK we are here.
We could say less and you see we're in the C drive so let's go ahead and see these two users I can type
and then Alice here and we are at the users folder.
Ok.
So let's see what else is here.
Can we.
Ellis L.A. this.
Hey look there's some hidden directories so let's try to go to see all users see if that works.
OK.
See these all users alas again.
Look there's that parser folder we saw.
Right.
So let's see into that.
And actually let's let's back up one little LSD L.A. to make sure because there was an application data
folder that we saw and I think actually that's where it resides.
So if we come back through here all users profile application data parsers that's a little trick there.
Let's see these into this application data and I'm guessing that there is a password folder in there.
Oh access denied
OK.
So maybe we can't get to the application data folder but maybe we can get to the parser folder that
we're after.
So let's go ahead and just copy this and see if there's not an option just to go right into that folder
so let's see and say paste here.
Of course I forgot to copy a paste it now.
Aha successful if at first you don't succeed pick yourself back up and try again right.
Don't ever do that was Alia Ashanti one of the two.
Anyway so now we're in here and look at this beautiful beautiful stuff.
We've got this party configuration that the old got back and we can look through these and see you know
what we can find here.
So how about we we download these.
So let's go ahead and just do a get and we'll download these three items submit a copy of them
and paste OK and then I'm going to say get and I'm going to copy and paste again I'll switch that to
old and then I'm going to get.
And then we'll just paste or more time and we'll do all that back like that.
OK.
So we've got all the files now let's go ahead and hit by exit out.
So I should have less.
If we graft the BRT we should have the three in here.
So let's try to cat out the party configuration and that and we'll just grab for that party admin because
that was the user name that we used.
OK.
There's that there.
Let's go ahead and let's get at this party.
Let's see what's in there.
And let's do a control H or control f I should say.
Control Athens will say the R T G admin and there there's a one of 1 when we see a log in.
We see a password.
The password here has been encrypted.
OK.
So this one is not it for us.
Let's go ahead and do a cat PR or we'll do a G at P R T G configuration.
Old and we'll do a controlled fine let's search on password.
That's not going to work but search on P R T G admin again.
Let's look at that password that password is also encrypted for us.
So let's try one more thing here let's try a last one of get it e.g. add in or that all that back to
control F and we'll do PR e.g. admin there we go look at that.
So of course somebody is driving by with a really loud car.
OK so we've got PR TGA admin and we've got these credentials let's go try to log in shall we.
So let's go here.
Let's go paste and let's go one more where I can find my edit and we'll copy this and paste it now.
This is gonna be realistic.
Watch this log in.
It's gonna fail.
Okay let's do it one more time.
G.G. Alvin I'm going to paste this I'm going to back out one and do it 20 19 I'm going to put a nine
in there and hit enter
and now things have changed OK.
Why.
Why is this realistic.
Why do I say this is realistic.
This is realistic because we just changed one number off of a password and gained access password reuse
is one of the biggest issues that we have in the industry.
When we talk about like the fall 20 19 some are 20 19 people use that all the time.
So if I see somebody is all password was somewhere 20 19 I'm going to try fall 20 19 or if I see somebody
whose previous password was like Joe Bob twenty eighteen And now it's 20 19.
Guess what I'm going to try 20 19.
You have to think logically think of the year you're in and think that.
OK well this passwords from a backup file.
It's old.
So we're gonna go ahead and just give it a go with the new year and see what happens.
So we did that.
We got the new year it worked out really well for us so from here I'm going to open up burp sweet and
I'm going to close out of my other brb sweet OK.
And we are on the free edition.
Actually I'm on professionals still.
I guess I have two professionals up.
That's fine.
You're gonna be able to do exactly what I'm doing on the free edition and mustard is removed on this
one.
So what we're gonna do is we've got our proxy setup.
It's already grabbing stuff so we're gonna have our proxy setup.
If you don't have your proxy setup already makes you intercept is on.
You should be familiar with Bursley.
I'm using Foxy proxy here.
However if you want we can go into preferences and we can scroll all the way down and we can go to settings
and you can also do the manual configuration here which would be 1 2 7 0 0 0 dot 1 or 80 80 and you
should be Gooch fan so should be good to go once you have the up.
All you have to do is set up your intercept and then try to refresh a page.
So it should hang when you refresh it.
Okay.
And now what we're after is this cookie.
So if you recall from the exploit we come through here and you see that we have your cookie that you
need Once authenticated you grab your cooking use it with the script.
So it's got a little bit extra here with the cookie.
We don't have that we just have this octopus.
So we're gonna take this octopus cookie and use it in our script.
So what we're gonna do is we're just gonna copy this guy and there is a download feature.
Delicious copy this and what we'll do is we will make a quick script so we'll come in here new tab and
then we'll just say get a new age because this is a shell hit pace and then make sure you put it enter
here at the top so it can declare this.
I had issues earlier with it not declaring.
So we'll go ahead and save this and then we're just going to run it via the parameters.
So we're gonna run.
I knew that s h u for you URL with the IP address and then see for cookie.
So what we need to do as always if they exploit we're going to add the plus X on the change mode so
you can make it executable then we're gonna say new the S H and then we're gonna say HBP can backend
10.
I want to be two and we've got to provide that wonderful cookie that we have.
Let's go ahead and just copy this guy
and paste it and let this fire
OK so this is going to go through and if it's successful it's going to try to create a user penned test
and the minute Streeters group with the password a pen test.
Now this is going to do it on the actual machine itself so we can try to connect to this.
So what I've showed you in the past before is using something like P.S. Exactly.
But I do want to point out and we've used that in maternity.
I want to point out that you can use that without or with metal play but we can use it without midas
fly here.
Right.
So there is a tool kit already built in to your Carly Kelly Linux but I want to actually show you a
better way of using that tool kit.
So if we go out to the Google machine and we go to Google and I still have my intercept on let's go
ahead and turn our intercept off and we say impact it.
Get hub.
Now already had this installed on my machine.
This is my pen test machine.
But go ahead and click on this first link and let's go ahead and just do a clone or download here.
You're going to copy this and what you're going to do is I want you to go into your opt folder.
This is where I like to install things in my out folder say get a clone and paste that in mind shouldn't
clone because I already have it.
So lets users install a really quick.
I'll stall here and talk for a second.
Once it's already installed or downloaded at least go ahead and go to see the impact and it should just
be a pip install.
I believe is how you run this.
So pip install period.
So if you do not have Pip you can do Pip three I do believe or you can do apt install pip or Python
Pip.
Are the options and that will get you Pip as well.
But you should just be able to do pip install period and that will install everything for you.
Mine should have most of this already installed yet.
And it says I need a newer version of Pip that's fine.
So it did actually install some new stuff for me.
But what's nice about this is that it will install this and allow things to run like I had to start
typing and P.S. exactly and we could say yes exact pie.
Now when it comes to pen testing this method is picked up a lot less than the Metis point method.
They still upload some sort of reverse shell but Metis place picked up a lot easier by antivirus especially
when you don't know what you're up against your against your first shell etc. Even better is something
like SMB Zac or w am I.
Exactly.
All of those use the same syntax syntax are part of the same package SMB exact and w my executive picked
up way less than yes exact does but I do like a good Yes exact.
So let's go ahead and just try this and what we're going to do is we're just going to use those credentials
will say pen test and we'll just say P3 and T three s t exclamation like this and then we'll just say
at 10 and 10 that one fifty two and let's see if this works
so immediately we know we have an account here immediately because it's requesting to share and if found
a writer will share.
Now is trying to upload that file onto that share open this is SBC manager and hey let's say who am
I.
We did it.
We're on there.
We didn't use Betty's boy we got on here.
Sol you people taking the OCP or wanting to take the LCP you yell at me about using my display.
Look at this.
It works OK.
So now you can go find your flag.
You'll be Gooch again.
So what we're gonna do.
We can control C out of here too.
And just to prove point for a real pain test environment w my exact not a fully executable shell similar
interactive so you will build a run some commands some you won't.
But this is a good way to kind of navigate yourself around the network and just kind of see where you're
at.
Or you can see dir and see where we're at.
OK.
So you can see where you're at in in the system and kind of get a feel for that control see again and
just to prove check out SMB exact and see if it works.
So different ways of getting shells again semi interactive the fully interactive is the P.S. exact and
I love the Mets boy or mature prettier version because you do get that extra benefit of having that
C2 server and you you also have the benefit of having all the packages that you can load with maternal
fritter.
But here's a proof of concept that you can use.
Yes exactly.
And especially if you're up against antivirus or something then you can go to like program files or
you can even look through you know you can query and see what kind of antivirus is in there what kind
of firewall rules are in there and you kind of get the lay of the land with your SMB exactly w my exact
or even P.S. exact before you actually try to attempt a return British shell and tip off on the antivirus
side of things.
So that is that is it for this lesson.
Hopefully you guys found it interesting and understood the thought process that I have.
And you know I do challenge you to start thinking outside the box in just thinking the little things
don't like like good example is getting and finding that password and then trying it and then just being
like oh well you know it didn't work I got to go look for something else you know increment the number
it's 20 19 increment the number and see if it works just think think like a dumb user would think and
you will be successful all the time.
So thank you as always for for you know watching these videos and until next time I really do thank
you for joining me.