All right.
Two videos left.
So now we're on to Grandpa and Grandpa lives at 10 dot ten 10 to 14 I think by this point if you're
following along you can probably do this one on your own so if you haven't tried it already on your
own.
Give it a go.
See what you can do.
See if you can piece it together and if not if you you like to follow along.
Get your scan ready and meet me in the next video.
Same as before.
So I will catch you over there.
All right.
Let's take a look at these scan results.
And I swear this isn't intentional.
This is probably the fourth week in a row I think that we only have one port open and that's again convenient
for us.
And I don't know if it's just an indicator of the easier machines having a smaller attack surface or
what exactly is the what's going on here but to our benefit nonetheless so we look at this.
And right off the bat we see that the version of the web server is Microsoft I guess six point zero.
Now that is a incredibly old version of I guess.
Don't quote me on this but I think there at least at 10 right now.
So we know that we've already got a dated version here so that's interesting.
The other interesting items here are the potentially risky methods.
So it's got a bunch of different methods that are allowed here one of which is trace.
And then the other which is put so with put potentially we could put a malicious file on the server.
That's not always the case put has other uses other than just putting a malicious file on a server.
And it's not always available to do so even if it is a method that's allowed.
But it is potentially risky.
The other one is trace and we may have talked about this in the past but there is something called The
Cross site tracing.
Now that is when you have a cross site scripting vulnerability and you have the capability of running
trace can lead across site tracing it's a much older exploit but when you see potentially risky method
of trace show up.
This is why.
And if I were to see this on a web app Penn test I'd probably say hey why are you running trace.
What's the point of leaving.
Leaving it open.
And most people will just turn it off.
Other than that we can look through here and see that the title is under construction so if we go to
the Web we could see OK it is under construction and this is an older guess under construction page
as well.
So just got really that old feel to it.
And another thing I should point out is if you're unfamiliar with the methods or if you're unfamiliar
with like the response codes like a two hundred or four or four etc. It's best to just pick those up.
It's only going to help you in your career.
So and it's probably probably web app one on one is just to cover you know the different response codes
and understanding the different methods you may be asked about those in an interview.
So definitely pick those up and understand what they mean looking through here we also see that there
is a Microsoft Windows 2003 possibility.
That's how old I am six point zero is.
It could also be 2008 server XP or 2000.
So let's go ahead and just take a peek at this first let's just copy the service.
The other thing that we could do is since there's nothing here we could run door buster and see if there's
anything hiding behind this Web server but because it's so old.
I just want to look at the service and see what kind of exploits might be out there for it.
Let's go ahead and just go out to the Google machines and we'll paste this and then we'll the search
for exploit because it knows us you could tell.
I've navigated out to this once before in the past but let's open up this i s six point zero web dev
and see what we can do with it.
Now you can see that web dev SC storage path from your l I'm going to go ahead and just copy this but
description here is this a buffer overflow.
OK.
And it's capable in the web DAB service in a six point zero in Microsoft Server 2003 allows remote attackers
to execute arbitrary code via a long header so we need to meet a few requirements here we have to have
the Web DAB service.
I think that's a check.
We have a six point zero.
That's a check.
And then Microsoft Windows Server 2003.
We're not sure but it's good possibility that we have it and we could take a look at the code and just
see what they're doing.
Looks like this is Python and they're just importing a socket.
So they're gonna say Hey connect over and we're going to connect over to this.
We're gonna send this along header and then they're gonna have a payload This is the payload and they're
kind of shell code and they're just gonna say Hey connect back to us.
And that's pretty much it.
If you seen a buffer overflow before.
This looks very very similar and very basic.
So let's go ahead and go back to the scan window here and I'm just gonna do a search for it really quick
on this and see what's available to us.
So Python that is 4 1 7 3 8 which is this one.
OK it's already on our machine but we also have the ruby module so Ruby means Meadows boy Midas Boyd's
our favorite.
Let's go ahead and just use the medicinally here of the MSF console.
And we're gonna give this a go.
So let's go ahead and search for that one more time OK.
And a trick somebody sent in is you can say use and then the number next to it which I do not know.
So thank you for sending that trick in very useful information.
And you guys teach me as much as I teach you.
So here's here's a little tip or tidbit from a user.
So use zero.
Let's go ahead and you say options OK.
The target your eye is correct.
We're not changing that.
Our port of 80 is correct.
So all we need to add here is the our host.
So let's just say set our host to turned to turned up 10 to 14 and then let's show targets and make
sure there's no other targets.
OK.
So has to be two thousand three are to service pack 2 on x eighty six architecture.
So fingers crossed let's hope this works
play a little bit of Jeopardy music here.
And it said no session was created.
OK let's try running it again and it may take a couple of tries for this to actually function the way
it should and let's try setting the El port to all fives as well.
We'll see if that works
if this doesn't work.
We might have to reset the machine yours hopefully work.
There goes.
So very tricky exploit to get going.
So even when you have the right exploit sometimes it doesn't work the first time.
So please if you are if you have a hunch give it a go a couple times.
Don't just give up on the first go.
We've got it running so that's awesome.
Let's take a look at who we are.
And you could see that we're getting access denied okay let's say sis info we are x eighty six architecture
X A6 interpreter.
That's good.
There's two logged on users.
OK let's say.
P.S. And look at some of the services that are running this.
Give us an idea as to maybe who we are.
You see the user here in this session is empty.
So really we don't know who we are at the moment but we are not system.
We can identify with that system one because that command is failing to because if we are a system we
would see that we were capable of looking into any of these here.
Var session is running here on these these services.
So we're going to have to pick and choose one and see if we can't get it to work.
So let's go ahead and migrate and see if we can get a user with the network service since we're not
getting a user with the get you I.D. right now.
So will the same migrate and we'll pick the first one 1788 and see if it works.
Fingers crossed.
Hopefully it works and it works so let's try and get you I.D. again OK.
So now we're the authority network service.
So let's background this and we're still not system.
So we're gonna have to do some privacy.
Let's do the.
Suggest her.
Now this should all be very very familiar to you.
Right.
Let's check options and we'll say set session to 1 run this Fatboy OK.
So this should all be very familiar to you.
The whole process of enumeration I think this machine is probably easier than optimum.
Especially when it comes to privacy.
Now optimum you know we saw that X 64 is not very reliable with the windows place the gesture but it
should still be something that we're going to at least checking if we have a metal splint shell and
we're doing capture the flag type box like this.
This isn't super realistic when it comes to you know the real world honestly because we're probably
gonna be looking at some sort of actor directory privacy.
I can't even recall the last time that I've used a local privacy to actually get system on a machine
other than maybe doing some limited stock assessments and even then get system from medicinal it worked.
So we should always be you know keeping them on the back for mind but this methodology is good to have
and good for a beginner mindset.
So please do keep in mind and hopefully your mind went right to hey OK I got the shell and now I need
that local exploit suggested to at least give it a go.
OK.
So now we've got three different options four five six seven eight nine potential options actually we
can just copy these and try to go down the list and see if it works.
So let's do let's say use and I'll paste that one if this one doesn't work we'll do the CPI piece I
do know that works what's the options here.
Set session to one.
We're going to run it.
It's going to fail because a look at tries you could see that it's on the wrong IP.
So let's do that.
I'll host to eat zero or tunnel zero sorry.
And then options.
Make sure that's correct.
Let's try running it again and see if that actually explains hey OK let's see what we got CIS info get
you Heidi we are authorities system we have routed this machine so let's go back and talk briefly about
everything that just occurred.
Well first of all we ran our scan we saw that the service is potentially vulnerable.
There was some other stuff in the service too right.
We saw potentially risky methods.
I explained a couple of them that might be risky with the put in the trace.
I do encourage you guys again to go back and learn these methods.
The other thing that we saw was OK.
They're using a default under construction page and there's I explain zero.
This is probably the first thing we're going to target with a scan.
If we didn't find anything malicious here then we would go back to the drawing board and probably run
door buster or some sort of deeper enumeration into this Web site to see maybe if there's something
hiding the back.
But we did find a potential exploit.
We ran that exploit and realized it takes a few times sometimes for an exploit.
Got it to work went into this get your I.D. and saw something we haven't seen before which is access
is denied because we weren't getting access denied.
We can take a look at the piece which is a similar same thing as a task manager and just see that there's
nothing here.
There's not a service on this run dial all 32 or a user.
So we migrated to a user that we can actually use if we were to attempt to actually use this suggestion
here with a without this user.
And I think we would run into issues.
So it's always best to switch over if you can and migrate the process and then just kind of go from
there.
So we did that we ran the suggestion we picked the first one because we're a little bit of script kiddies
that's OK we just grab the first one and gave it a go.
Chances are more than one of these work.
I know the TPP works as well.
So we grab that.
Set our standards and then ran it and got our authority system shell.
So now you can go in into the shell and actually grab the root that tax user I'd text if you want and
go from there.
So now I'm going to go ahead and pause the video you showed positive video as well.
I'm going to get the scan up and running for Granny and then we will meet back over in just a second.
All right.
The scan looks eerily similar to what we saw before.
We've got port 80 open.
We've got Microsoft.
I guess HPD six point zero we've got some potentially risky methods we've got under construction and
if you go out to the page it looks exactly the same.
So here's my challenge.
I'm actually not going to walk through this box because it's so similar it because I just gave you the
methodology I want you to do this one on your own if you've not done this one your own this is your
opportunity now to go and do it.
Now the path is slightly different.
You might have to find a different exploit to get into this machine.
So don't just think you can copy the methodology precisely from the last one but you have a 90 percent
similar overlap.
So give this one a go take everything that you've learned in this lesson with the service enumeration.
Do a little research on Google get those exploits go in and then figure out how to ask this machine.
I have full faith in you guys and know that you can do it.
So that is it for this lesson.
So thank you everybody for joining me.
Until next time.
My name is TCM.