All right let's take a look at making this shell interactive for us.
So we're going to run the same situation here.
I'm just going to tab up because I already have it saved.
So let's put up responder again.
If you're just catching up.
We have TV off.
We have S&P off and we've got responder listening.
Let's go ahead and load up until I'm relay and the only thing that I'm going to do here a little bit
differently is at the end I'm putting in a dash I now Dash I stands for interactive and we're going
to try to get an interactive shell here.
Let's take a look at what this looks like.
So go ahead and enter.
This is just going to sit around and wait and we're going to trigger that event again.
So let's go ahead and do that.
I'm going to log in
triggered this event one more time.
Let's see what happens over here OK.
So you could see it says received the connection.
It's exceeded and then it says it created an SMB client shell on 1 2 7 0 0 1 eleven thousand.
So you're should say something very similar to that.
Go ahead and open up a new tab and just say something along the lines of net Cat 1 2 7 0 0 1 eleven
thousand and then it says type help for a list of commands let's say help now we are in a SMB shell
essentially and we can do quite a bit of things here we're in a file share.
So what can we do.
Well we can we can look at the shares.
We can use a certain share.
We can change the password of our current user and we can look at making directories or moving directories
or removing files we can put new files get new files we can create a mountain point there's a lot of
different things we can do.
OK.
And so let's take a look at this.
So let's just say shares and we've got the C drive admin IPC and we got that share folder that we created.
So let's go ahead and just do something like use C dollar side OK and let's go ahead and just say allies.
Now look or at we've got access to the C drive here if we wanted to use the admin which we could get
to this other way we just say use admin hit Enter Al s and look now we're in the admin so we're in system
32 here on a Windows machine and we just have full control of this computer we can add files get files
we have a lot of control here.
So there are other things that we can do as well that we're not going to cover by do encourage you to
explore.
So I'm a control C this couple of things to point out is we can say something like dash E for execute
and then we could set up a mortar printer listener like test out EMC we can generate MSA venom to create
a payload and then we can set up a mature printer listener and go get a shell and met point with multi
handler we could do a dash C for command so that this executes some specific command when we run the
machine it could be something as simple as Who am I to a complex power shell reverse shell or something
along those lines that we can talk back to us as well and get a shell with that.
So the interactive shell is not the only way to do things but it's another way to do things.
So we just want to improve upon everything that we get.
So again we have those hashes we're going to figure out what we can do with those hashes later.
So again make sure you have those saved once we get to the post compromise attack section.
We're going to abuse those frequently.
So for now that's it.
Let's go ahead and talk the next video about defenses and then we'll talk a little bit about gaining
shells and some other attack vectors before we get into post compromise enumeration.
So I will catch you over in the next video.