Welcome to walk through seven.
We're going to be covering a box called Optimum Optimum lives at 10:00 at ten.
Ten.
Eight.
So same as the last video.
Go ahead and start that box up start and map scan now.
Get everything ready to roll and then catch me in the next video.
If you're not doing the walkthrough as if you're just watching along go ahead and just keep the film
rolling.
Let's go ahead and get started.
All right.
So our skin is back and we are lucky again in two videos I do believe where we only have one port open.
So again we have port 80 open here which means that our attack vector outside of something like Port
knocking is going to be through port 80.
So because it's through port 80 we are very direct in what we can do with our attacks.
So right off the bat we can see here that we have this H TGP file server HP D two point three also known
as a Jeff s two point three.
OK.
So we can take this information and go to Google say hey is there a Jeff s two point three is there
some sort of exploit for it we can use search buoy and search for it but before we do any of that I
do want to go out to the Web page and just make sure we know what we're working with here so we come
to this web page and there's no files in this folder.
We understand that it's a file server.
So we should have the ability to upload files download files but there's nothing here.
And at the moment we aren't logged in as anybody either.
So we could go to the log in and attempt to log in and see if there are any user name credentials that
we can access with.
We could go to Google here and say hey is this HMS file server.
Does it have a default credentials.
And we can look that up.
Now each of us by default does not have default credentials.
Those are actually set up when you setup HMS HMs.
So in terms of security that's a good thing.
But you're going to find here that there is not so good stuff going on as well if we actually look at
these this link here the HP file server two point three you could see at the bottom that red Jetta dot
com pops up.
So Regina is the vendor This is who makes this file server two point three come down here and just go
to search flight and just say search boy reject oh and see what's there and you could see immediately
that well there is a medical module right.
There is some Python for two point X but two point three is showing up repeatedly.
So if we were to go out to the inter webs and do something like Brigitte go fast so that two point three
X flight just Google knows Google knows what we're after.
So there is a exploit dash DV.
We can check that out.
There's a rapid seven hour favorite because we can just use the pre-existing metabolite module if we
want to.
And we come through here you can see that Magento file server is vulnerable to remote command execution
fantastic.
This is what we want.
Right.
On Windows XP Windows 7 and Windows 8 is where it's been tested.
Doesn't mean it's not other operating systems as well.
When you come through here and we've got this we've got this as well we can download this python file
and attempt to execute manually.
But in this instance we're just gonna take what we know and we're going to take medicinally and try
to get a shell.
So this looks like a winner for us especially with remote code execution.
So let's go into here and we'll just go and boot up Metis FOIs
and we're going to attack this machine.
We don't know a lot about it.
Let's go back to the scan and see.
So the best guess here the best OS guess is that it's a Windows Server 2012 2012 R2 and you're seeing
that come through quite a bit.
So it's pulling down information that it really believes it's 2012 and even believes Windows 7 or Windows
8 so because of this I think there's probably a high likelihood that this machine is going to be a 64
bit as opposed to a 32 bit.
So we could try a 64 bit payload first if it doesn't work then we'll go with a 32 bit payload and just
be safe.
So let's go ahead and just search for a general quick and then we'll say use exploit windows HP show
a jet pass.
Exactly.
OK.
Options.
We're going to go ahead and set our our host
to ten point ten point ten point eight.
The rest of it looks OK at this point and then the exploit target is automatic.
Let's go ahead and just show targets and see what they're picking.
So all they have is automatic.
All right let's go ahead and set the payload to Windows X 64 interpreter reverse underscore TCB options
OK.
Set our El host and we'll set at the tunnel 0.
Now this is a trick actually sent in by a user.
So if you are watching this and you're the one to tell me about this.
Thank you.
This is actually a really cool trick.
You can just set your interface which if I ever read I would notice that instead of typing in your address
or having to go back and look for the I.P. address that you're working with.
So interface here port and then we can just go ahead and run this bad boy and see what happens and boom
right away we'll get a return fritter session.
So that's awesome.
Go ahead hit enter.
It's going to take a second I think with this cleanup trying to go on.
OK so we can say this info and we are 64 bit mature printer on 64 bit architecture.
That is where we want to be.
So now let's go ahead and look at the get you I.D..
Well they get you I.D. is cost.
So we're going to have to do some privacy.
So a couple of ways to give privacy which I say get system that didn't work.
We can background and we can say we could say search for suggest or gain and we can just use post multiply
recon political exploits suggest gesture.
Now if I'm going through this fast it's because I've expected you to know this by now.
Right.
All these things we're seeing so far I've shown you.
Let's go ahead Andrew you say options on this one I had set a session set session to 1 and then we're
going to run this but then we're gonna automatically cancel it.
So let's control see actually actually no let's run it.
Sorry I was thinking ahead but that's fine.
So we're going to run this and let's see if it collects anything.
Now it should be noted that on 64 bit machines it's not it's not easy to gather local exploits from
the experts suggests or it's better for a 32 bit machines.
So you're going to see here that it's going to try some of these and none of them are coming through.
OK.
That's not a big deal.
So we're gonna have to do manual post exploitation and this is something we haven't covered.
But I have thrown out in the past that there are scripts out there on both the Windows side and the
Linux side.
We covered Linux.
We talked about the scripts that are out there.
So if you this is where you should have gotten this far with everything we've learned right and you
have the tools and the mindset by now to know hey OK how do I how do I get better how do I escalate
these privileges.
And we can say OK well we're gonna have to go to Google go to Google we can say OK Google windows privilege
escalation.
Now there is a great great guide out there by fuzzy security it is considered pretty much the Bible
when it comes to privacy.
Now we can go through we can check all of this information that comes through here.
Lucky for us some people have scripted some of this but there are still very manual methods to doing
this especially when we're talking you know just gathering some some of this information.
It can be automated gathering system info and looking for different items based on that or based on
packages of some of this is just really you're going to have to look through it and see what kind of
information comes back and if anything stands out or maybe there's programs that are running that you
can escalate with.
So we haven't dough too deep into this yet and that's OK privilege escalation this kind of stuff isn't
hyper realistic.
There's some realism when you're doing 10 test the majority of the time your privacy isn't going to
fall from any of this kind of things I doesn't mean it can't happen it just means it's not likely privacy
is is usually on the active directory side and it's not related to most of this stuff.
This is better for capture the flag type things you know doing the hack the box machines or any other
type of lab environment like this where they demonstrate the ability to use exploits and privilege escalation.
Now there is a tool that I want to point out that I think is really good and it's been updated recently
but we're still going to use the older version.
We could say Sherlock and this is written by a Rasta mouse.
So if you type in Sherlock Rasta mouse you can see it's a power shell script here so he can go ahead
and just clone or download this whole thing and we could see also that it quickly looks for the following
items and so all of these different privilege escalation of vulnerabilities on Windows.
The other thing that we could do too is we could go into our session again and we can just say ciao.
Are we going to say this info.
Right.
And we could see that we're on build.
Ninety six hundred we could say Windows 2012 are to do a copy on that and we could go to Google and
just say hey is there privilege escalation for this.
And the first one here is this MF 16 0 32 that shows up now.
OK.
And MF 16 0 32.
And this is for Windows 7 they're 10 two thousand eight through 2002 32 and 64 bit.
So it needs a race condition to see there must be two plus CPR cause if testing in a VM just make sure
they add a core.
OK.
So there is a there is a power supply exploit or power shall I think it might be part of the powers
play package by measure.
Definitely power shall high exploit that's available for us.
There is also we can search this as well we can background and just say search M.S. 16 0 32 something
like this.
And this does exist here.
So let's go ahead and copy this
and we'll just say use and paste.
So again the.
The OS information is important to build.
Information is important the same thing with Linux.
The one of the first things you're gonna be looking for outside of like looking at the history or looking
at sudo privileges you're going to want to look at on a Linux machine the type of OS that's running
the bill that's running and see if there are any exploits or privacy exploits specifically for that
that OS and the architecture.
So this is one of the kind of the basic one on ones of what to look for.
And even if you look back at this fuzzy security guide you could see that they're doing information
gathering the very first step that they do is they gather the OS name and the OS version.
So super important information here.
Now let's go ahead and type options and let's set the session here to one and then you see the target
down there is X 86 we know we are on x 60 for us let's show targets and we'll set target to 1.
OK.
Now I'm going to run this and then I'm going to kill it see if I can kill it.
OK.
Options.
So again it pulls the El host.
I actually tried this with setting my interface first and it's still messed up.
So we just have to kill it here.
Come back.
Set the El host to our channel zero.
Let's go ahead and pick a new Al port.
Let's put the El torture like we'll do four for three here and we'll try running this.
Now this exploit is iffy.
It works sometimes and it works sometimes not.
So we'll see if we can get this to work.
If not we'll go back and we'll do the manual more manual method of getting it to work.
So I've gotten this to pull.
Once or twice but in the end it doesn't really like executing this script.
So we'll see how this works.
OK.
So we ran it twice here.
And for me it didn't work.
Maybe you got lucky and it works for you.
But let's go ahead and take a look at the more manual method that we can use and we'll go from there.
OK.
So I'm going to show you two different tools that we can use to do privilege escalation enumeration.
The first one that we covered already is this Rossum mouse Sherlock.
So let's go ahead and just click on this.
Sure locked up P.S. 1 and then what I'll do is we'll just take the raw version control a control see.
This will be the easiest way we'll come into our terminal here and then I'm going to open up a new tab
and then we will just say gee edit and we'll just call this you call it whatever you want to call it.
Sure.
P.S. One is for easy naming reference.
Go ahead and control the here.
Paste this in and save it ok.
Now on our end over here what we're gonna do is we are going to come back to our machine or go into
our sessions and then type in shall OK we're on our desktop.
That's fine.
Let's go ahead and grab that file so let's load up the file here.
We're going to do our Python simple HDP server with the dash cam of course and then try it and port
80 let that run and then we're gonna use cert.
You tell all this should be refresh your information right.
Sir you still to do your all cash and then a file of HBP and then are IP which I honestly don't know
the IP address.
I think it's dot eight.
Well do I have config I have stopped 14 actually 14 for Slash for it up.
Yes one will call this shirt.
Yes one OK.
If we say dir we should see that OK sure locked up.
Yes one is here so here's what we're gonna do.
We are going to execute this file and we're just gonna say something along the lines of power shall
die.
He will say execution bypass all we're doing is bypassing the execution policy.
This is something if you're not familiar with power shell that's just there to prevent us from running
files that perhaps could be malicious it's not really anything other than a protection that we just
turn off.
So we're going to turn that off here and then we're going to run a command in the command that we're
gonna run is something along the lines like this we are going to say import module and then we're going
to import good old shirt up P.S. One here and then we're gonna run the command find all volumes which
is part of the Sherlock template do this execute and there we go.
So come through here.
Sherlock executes.
And you can see that it's starting to search for vulnerabilities.
You see not vulnerable blah blah blah all the way down.
Scroll through.
OK.
And the 16 0 thirty two shows up again and appears vulnerable.
Zero thirty four one thirty five.
And it has NSA tonight as well and vulnerable.
OK.
So there's these three here as potential possibilities we've already identified and the 16 0 3 2 and
try with Mets play.
It did not work.
This machine is vulnerable to M.S. 16 0 32.
However it is a little beyond our scope.
It gets a little advance and how we need to exploit it.
And I think that it's possibly even a later episode that we can kind of start getting into that stuff.
It's very powerful heavy and involves a little bit of modification and downloading.
So I'm going to avoid that method.
But lucky for us there are a couple other methods that we can use.
Now this was just one item here right.
So we're using this.
We found three potential vulnerabilities that might work.
Let's look at another thing that we can do as well.
Now there is a great tool out there if we go to the Googles and go to Google dot com and we just say
we are going to search for Windows exploit suggest our in this GDI security right here.
Let's go ahead and just copy this and we're just going to clone this whole thing here copy this.
Come over here and we're going to do a get clone on this item and we'll see these into the windows exploit
suggest or allies.
OK.
So if you look at the file description down here you can see that we need to run this update.
So we'll go ahead and update it.
So we'll say Python windows X to gesture update like this.
OK.
Now you see that I wrote an Excel file out for us.
So now we're going to actually use that excel file.
Actually let's do one thing first.
So in order to run this we need the excel file that it just provided the database and the system info.
So we got to go ahead and type in system info on our shell.
So we go back to our show and we type in system info
we need to copy all of this information that just came out right here.
Copy.
And then we can just put this into a text file call it get it sis info that text paste that and save
it ok.
So looking at the syntax we need to run Python database something like this will copy it so to say Python
paste this our database is this two thousand nineteen right there should auto tab complete.
Next thing we need is we need our system info text file so dash dash system info and then says in vote
at text run that now it's going to determine if there's any types of vulnerabilities based on this let's
make this a little bit bigger and if we look through this we can see anything that lights up like a
Christmas tree in green is potentially vulnerable right.
So it's searching through.
And it's looking through all of these right and let's see if we scroll down the bottom.
OK.
It does pick up again and picks up 0 32 here another potential exploit is right here.
This M.S. 16 is zero ninety eight second one down the list for us.
Thankfully we wouldn't have gone too far.
Now the nice thing too is it provides us a exploit DV link so we can actually just open the link go
right to it and download this exploit here
so it's going to save into our downloads in a see format.
So let's go ahead and open up a new tab here and I'm going to C.D. back into downloads and then we have
to GCSE this.
So we're going to JCC for 1 0 2 0 dashed that see here.
We'll just do an output of E X that EMC we've got a fatal error OK.
Let's take a look at that fatal error.
We don't have a Windows dot h file.
Let's see if I O We need a Windows that H OK we can actually also download the binary right here it
looks like let's just copy this and we might actually even have it on our on our computer as well.
So windows that h we could download that and put that into our compiler.
But let's see if we can just do a locate on for 1 0 2 0 and see if there's EMC already built in.
There is not.
But we can go ahead and just download it.
We can search for it as well.
Just to make really quick sure that we don't have it.
It is M.S. 16 not twelve sixteen zero ninety eight
and we've got the c file already download it here which you could have grabbed and then the text.
OK.
Let's go ahead and just paste here and download this and we'll save this OK.
And from here we're going to kill out this and go ahead and open up are Python web server in this folder.
Because we just downloaded it to the HTC folder
sorry I am backward simple HDP server or 80 OK.
So now we're hosting up that file let's go ahead and put it on to this machine.
So we're still on a shell here.
We're going to do cert you tail again or do your alt cache again file transfer and we said we are at
14 that 14 for me.
And then this one was called for 1 0 2 0 that XY and we'll call it s h dot c OK.
Unless you can see.
Sorry sir I'm losing my mind today guys.
OK.
We try to run s h dot EMC and let's see what happens OK.
And it's not working.
Why is it not working.
Because if you look up in the upper right hand corner and you look at this actually you see 0 bytes
actually transferred over because we never really transferred over the file we just transferred over
it placeholder.
Firefox is determined this was malware.
Let's go ahead and just hit open come back.
We're actually gonna have to kill this shell here and then we're gonna go ahead and say Shell one more
time we'll do our CERT you till again your oil cache file and this may have actually worked for you
if you didn't get caught by the Microsoft or the sorry the Firefox here.
You can do 10 10 to 14 but 14 forward slash and this is for 1 0 2 0 that you see.
Give it a safe shot.
You see what is right that file if we can do a DA now and you see we actually have executable DSA QA
EMC
and who am I.
We are authority system so we have routed this machine.
OK that was a bit of a cluster [REMOVED] and you could see me struggle at times as well.
This one was not.
Now this one is fully capable of being routed from everything we learned in the past though it is not
completely easy to do so right up until this point.
I've given you the tools necessary to be successful and I'm guessing most of you probably got the at
least the path into a user.
Now we have relied on some things like the local exploits to gesture for windows and we have done some
privacy with Linux but we never really touched on the methodology needed for the Windows side of things.
That is a little bit of the work harder aspect of pen testing is to kind of try to figure this out on
your own and hopefully some of you got the idea to go and look for some of these exploits now again
it's probably time consuming right.
If you come through and you see the list of just different types of exploits that are possible and again
there are more than one ways to skin a cat here.
The 0 3 2 would work and there are some power shell modules that we could use against it now.
Again it's a little more complicated.
I do welcome you to try it and see if you can get it to work but that's something that we will work
on in the future.
But in this video we did manage to do privilege escalation with the windows machine and use a couple
of new tools to do so right.
We learned about the fuzzy security and this is a great guide that anybody should keep in their back
pocket especially if you're doing hack the Vox style machines.
We learned about Rasta Rasta mouse and the Sherlock which has actually been deprecated.
I'm not sure what they've moved on to but it's called what's Watson now everybody's new thing is to
write in C or C sharp and then make these SL and files and you have to compile them yourself into X
cables and this is actually in net so everybody's moving away.
It seems like from power shell now and into these.
This is the new the new hype.
So.
But we're not going to use Watson today.
The Sherlock was was plenty good.
And also this Windows XP suggestion was actually pretty good as well.
So a couple of new tools that we learned along the way.
So until next time I really do hope you learn something out of this video and I hope to see you in the
next episode.
Thank you very much and I will see you in the next video.