Hey, we didn't lecture.
We're going to see how we can escalate our privileges with a manual exploit or manual leverage and privilege,
escalation, opportunity.
OK, so far I have managed to show you how to manually download and exploit into your windows shell,
but we haven't actually executed it, so we haven't seen how it works.
So I'm going to find that one that will not run on the Métis Floyd modules.
OK, so I actually opened the Windows exploits register over here, other metal plates adjuster.
And we're going to go for one of the suggested vulnerabilities over here, which is Amsden, all 59,
which is this one.
OK, and as you can see, it says that this service could allow elevation of privilege.
So this is a gain and exploit or we can use this to escalate our privilege, but it doesn't have that
module Inmet exploit.
So what I'm going to do if you come over here, you can check to see yourselves that we don't have Maston
all 59 or dare.
So rather than searching it in the metal exploit, I'm just going to go and search it in Google and
find the exploit itself.
So I'm going to open the Google over here.
So let's close this down and just go to Google dot com.
OK, let's close everything else over here.
So I'm going to Pastis and just search for Moyston 059 exploit.
OK, so as you can see, we get a lot of results back and it starts with the getup and it's also in
Exploit DB and Reppert seven here as well.
So far so good.
So I believe we have another one over here.
But I want to draw your attention to this GitHub page, which is which actually contains this Moyston
059 Excel file.
OK, and apparently the usage of this file is very easy.
All we have to do is just run it with these parameters over here, OK?
And it will just escalate our privilege like this.
So we're going to see how to use it and how to give this comment.
But before we come over there, let me try to find some more information about this exploit.
And I believe there is not so much of intense description in the exploit.
DB as well as you can see, only says that an attacker can exploit this issue to execute an arbitrary
code with the system level privileges.
So all we are doing over here is just we are exploiting some kind of vulnerability and it can lead us
to execute an arbitrary code and it has the code in here.
So it has the code in the offensive security setup.
OK, if we leave there?
No, it doesn't let us see the code, but we can always go for that zip file and see the code ourselves.
Of course, we can try to search for discrepant seven here as well, but I don't believe we have a good
thing over here.
So let me try to save this file.
Does that zip file and let me try to find that file on my downloads folder.
So let's see.
Yeah, here you go.
As you can see, we have the source code over here so we can try to compile it ourselves.
And as you can see, it's only gives us the descriptions and instructions for compilation of this file.
OK, but I'm going to just delete this because we have already found the file.
I just wanted to show you that if you don't trust the X Files, you can just compile it yourselves.
But again, why not?
Why not?
We tried these files ourselves.
The GetUp page that I have shown you is actually a very good page and actually very comprehensive page
when it comes to Windows privileges escalation.
And it has a lot of XY files embedded in it, so you can't trust that one.
So let me show you one more time.
So this is the one that I'm talking about, SEC Squeaky.
OK, just make sure you follow this page.
You're just like this page.
Follow this page.
And as you can see, there are a lot of repositories over here.
What we are interested in is the windows currently exploit, but it also has the Linux kernel exploits
here as well.
And as you can see, we have a lot of different.
Exploits for each kind of vulnerability over here.
So what we are trying to find is the most 059, but then you find a kernel exploit or kernel vulnerability
in the windows.
Just make sure you come over here.
So I'm going to download the MSM all 59 GHC to my colonics.
It will just give me a warning, but I'm going to say open and find the file on my downloads folder.
I'm going to cut this and put it in my file system.
VAR W-w HDMI and here you go.
So this is sitting in my web server is route so I can reach it from the outside world.
So I'm going to rename this to Amstetten, that a.m. Eastern 059 that XY.
OK, so it would be easy for me to find.
And right now we have the Métis Floyd Interpreter station actually if on Session Zel and we are in the
interpreter, I'm going to background this and show you that I have the section.
OK, as you can see, we have the station, but we're going to pretend that we don't even have an interpreter
station in this case so that we can actually try to see what happens if we don't have the interpreter.
OK, so I'm going to exit out of this one and just do the thing from scratch.
I'm going to go into the metal exploit, OK, by running MSF council on my machine and we can try to
get the station back from that exploit in the metal exploit.
Of course, that would be our first choice.
But if it doesn't work, we can always listen with the Netcare as well.
So let's see how it works.
I'm going to go into the use exploit multicenter.
I'm going to set the payload to Windows Interpretor reverse TCP, OK, and I'm going to show the options.
I'm going to set the Atheros to my own IP address, which is done zero.
I'm going to set the output to 42 42.
I'm going to exploit this and I'm gonna go back to my SBX and run it so that I have the station over
here.
So here you go.
We have the station.
So what I'm going to do, I'm going to go into that station and as you can see, it's in the station
one so you can just interact with it, OK, in order to just download this from our Web server.
So it's sitting on my route right now.
So I'm going to come over here and run sections one and I'm going to go into the shell.
As I said before, we're going to pretend that we don't even have the metro station or an interpreter
station.
So I'm going to go into the temp folder, as we have seen before, and I'm going to run the 32.
So I'm going to say Circuital Eurail cache.
And for the F, I'm going to just specify the HDB tunnel.
Ten, 10, 14, 19, MS.
Ten 059 XY.
And I'm going to call this Amstetten Data XY.
OK, so it will be downloaded to my temp folder over here.
And once we download this, we have to actually have this file on our temp folder.
Let's see, it says on line and here you go.
It says completed successfully.
If you're on there, then we can see them a standard X over here.
So far, so good.
Now we need to run this file and we need to listen for incoming connections.
OK, Onaka Linux, obviously.
Now, if I may stand out, it will say that Chimichurri or Kemistry, I don't know how it's pronounced,
but it apparently gives us the local system shall if we use this as IP address and port with IP address
import.
So this is kind of a back door, but we need to run it manually.
So it's very easy for us to do that.
All we have to do is just supply our IP address along with Siavash part number.
So I'm going to supply it.
And for the port.
No, I'm just going to go with one, two, three, four.
Now again, you can try to get this reverse shell back in Mattos loiters bhau, but we're pretending
that we don't have anything to do with the MSF council, Ormet, the split itself.
So I believe we can go for the next cat in order to listen for incoming call and then choose and see
what happens if we get the child back with that cat again.
It's advantages to get this with an interpreter, but I don't think this exploit gives us the interpreter
shot anyway.
So I'm going to go for NCM VLP one, two, three, four, OK, and I'm going to hit enter over here
and this will just run the country.
Or whatever it is.
OK, and let's see if we get the connection here, let's wait for a minute and let's see if we can get
the connection.
Um, yeah, it seems like it's working, but we don't get the connection for some reason.
Let's try to.
Yeah, here you go.
It gives us something.
And yeah, here you go.
We have the shell.
So if I were on.
Where am I.
Here you go.
We are the end theater to system.
So it took a while, but it gives us the shell.
So that's what's important and very administrator right now, as you can see.
So this is how you do a manual exploitation in order to gain an escalated privilege in the windows as
well.
So far, we have covered a lot of topics regarding the Windows exploitation.
I believe it's time to move on to another machine for windows so that we can get to practice what we
have learned so far and also learn something new.
We're going to do that within the next section together.