Hi, within this lecture, we're going to try and hack into this Windows machine so that we can see
how it's done and also we can move on to privileged escalation part.
So let me scan the map result over here.
As you can see, we have some open ports.
It starts with the twenty one.
It's NFTE port over here.
And it says that anonymous WP log in a lot, which is great for us.
Of course, we are going to take leverage of that to see if we can do anything with the FTP.
And over here, I believe you have to copy this if you don't know how to spell Anonymous because we're
going to use it for the user name and password later on.
And we also see that the system is windows and team, which is good.
So for the 80 part we have over here, we have a Web server over here and in the same it's not the Apache
server most probably has to do something with the Windows itself and aggressive operating system guesses.
Guess that it's just Windows eight point one, or it may be something like a Windows server or a professional
Windows version.
Over here we are definitely against a Windows machine, OK, which is good because which is this is
exactly what we want to practice.
So I'm going to go for the ten or ten or ten, five, ten, ten, ten, five.
I mean, and here you go.
This is the Web server that is running.
It says that a seven over here, which is great, but we don't see anything of her derri.
So if you just click on it, it will just take us to this dot net.
Oh, let me see the page source over here.
So it doesn't seem that there is much over there as well, like it's a standard HDMI code with a little
bit of success.
So we have this link.
If we click on the image, it will take us to that link.
Let me try to open this like in a new window and.
Yep, this is just an image.
Great.
So we don't have anything in the sauce over here.
And I believe we don't have anything in the report, like in the Web server as well.
So the definite part over here is that we have to go for the FTP because there is nothing over here
and we have only two ports open.
OK, so I'm going to go for the FTP port, so it's very easy to work with.
All you got to do is just work within your own machine and run the FTP command in order to connect to
that server.
They FTP service.
So this is how it's done.
FTP ten, ten, ten, five and it will ask for a name.
So I'm going to type in Anonymous over here.
OK, and for the password you can just type Anonymous as well.
So here you go.
We are not logged in today FTP so it doesn't mean that we hacked into system, we are just logged into
the FTP service.
Maybe we cannot even do anything with that anonymous user or and then the most login, so we're going
to see it.
So what do we do when we log into NFTE?
We can run their comments.
So Dear's stands for directory or something like that.
I mean it's it's the equivalent of a less in the Linux.
OK, so in Windows, if you want to see the available files and folders, you have to right there.
So if you do this in a FTP again, you get the available files and folders.
So over here we have this started out ASTM and welcome PMG.
So these are all the files that we have seen over here.
OK, so we are basically inside of the root directory of the Web server and we don't see much we don't
actually see much over here.
So what we can do, we can try to download these files and it won't do anything for us because we already
see it in the Web server.
And furthermore, we can just try to upload something and see if it gets uploaded and we can just upload
a reverse shell or something like that and try to execute it on the Web server.
OK, so what do we do over here?
First, let me create a new file, just txi I'm going to call it until that.
You see, I'm just going to create this as a test file, OK?
You can just write your own name and save it with control or enter and control X.
Now if I run SLA, I can see the until that is over here, I'm just going to try and upload this to
the FTP service, OK, to the server.
So all you got to do is just write.
Put and I'm going to stay put until that taxi.
And here you go.
It seems that we managed to upload it and here you go.
We see the hotel that you see before the start or company and it says it resides on in the root directory
of our Web server.
So I can just do this, OK, and here you go.
So it's very good.
And I believe it's very obvious what we should do and try next, because we can upload a file over here
and we can just see it, OK?
So, of course, I'm going to upload a reverse show and I will try to execute it and it will give me
back a shove.
So far, so good.
The plan is good.
Let me try to execute the plan.
So how are we going to proceed?
So should we create a reverse shell?
Should we create a python reverse shell?
Should we create a Batia reverse shell or what should we do in this case?
Of course we are going to create a reverse shell, but this time it will be it has to be compatible
with the Windows Server.
OK, so again, we can try to run that in the Windows Server.
OK, it's a bot, but the safer thing is that we have to run and aspects or a USB code.
So it's good because Aspey is going to work with Windows most of the time.
OK, not always maybe, but it's the most of the time working on Windows Server.
So I'm going to search for reverse shall cheat sheet over here and I'm going to open that.
And as usual, I'm going to say details and just ignore this, OK?
And here we are.
We have Dibadj, we have the Perl.
We have everything over here like Python, B, Ruby.
So you can try to do this with BHP or Tom, but it isn't guaranteed.
OK, so it is not very compatible with Windows since we can't find any aspects code like this.
OK, on line, as you can see, we get a lot of cheat sheets over here as well.
Why not?
We waste our time so payloads all the things reverse.
Chelsie, cheat.
Can you pour me.
So I'm just going to try and open all of these things and that.
Better yet, we can just try to do this with MSF, with them as well, by the way.
So let me see if we can find a good one over here.
Like interpretational.
Very good.
And it has to I it actually is a very good idea to get them interpretational back because it actually
contains a lot of useful widgets or a lot of useful extensions for privilege escalation as well.
So we're going to talk about what happens if we get them interpretational and what happens if we don't
get one in the privilege escalation section.
But again, it's always a good idea to get them interpretational if we can.
So you can just try to find it from here.
OK, let me just go over here and see Windows State University E.S.P.
Oh, yeah.
It's also give us the MSF, Brenham over here as well.
So I believe we get to go with them.
As a Wynnum, I tried to find the code over here rather than just type them as having them co command
komando in my Linux.
But again, I believe we have to do that.
So I'm going to go for them as Wynnum payload windows and interpretor over here.
But rather than e I don't even want any XY.
Why would I want any agcy.
I want an SBX.
So let me just copy this and we will just change it.
I'm going to paste is over here.
So again I'm going to go for the MSF venom for the payload of course it will be windows from interpretor
and for the connection type of course this can say versus E.S.P.
There is nothing wrong with it.
OK, we just have to change the host Al Port and the format of the file that we need.
So for the AL hosts, let me come over here to another tab maybe, or you can just open a new tab over
here.
Let me run the config.
So you're going to have to give your ten zero rather than your zero, obviously, because we are doing
this in the outer network, not in that network.
For the outpoured.
You can go for whatever you want, but just take a note of that one, because we will need it later.
On for the format of this file, we don't need any yaka again, I'm going to go for the aspects, OK?
And I'm just going to put this under something called maybe until that aspects or something like that.
OK, so make sure you execute this and wait until it's executed.
Wait until until that aspect is created.
Or you can just do it with your own name, obviously.
OK, so this will create an SBX shell for us.
And if I run the SLA and let me grab that because I mean my root directory, there can be a lot of things.
Here you go.
The other aspects.
So if you kept that, we can actually see the shell itself because we can see all the things that is
related with this code.
But again, we are not very interested in this.
We we are actually interested in delivering this to the server so that we can get a reverse shellback.
Don't forget about this.
Allport over here is four to four to OK.
And if you change that, it's OK to just remember it so that we can get the shell back.
So I'm going to go into the metal exploit here.
I'm going to search just open the massive console and it will bring me the metal plate framework over
here.
So if you have taken this course, I believe you have worked with metal before.
So it's a very wide framework that you can use for any kind of exploitation you want.
So we're going to go for the use exploit multi over here.
We can use multi handler to set the payload for us.
And in this case, our payload will be windows from Interpretor Reverse TCP.
So this is the payload that we have chosen.
Then we created our payload with metal deployed.
So over here I'm going to say show options and I'm going to give my tongue zero over here as I'll host.
And for the outboard I'm going to go four four two four two.
OK, so next thing to do is actually go for the exploit, right.
Because it will listen for our connection.
So this is a coolant of doing this with Netcare, but in a much better way.
So if you just do it with explode Jay-Z, it will bring this into background and it will start listening
in the background.
So I'm going to put the until that aspect is over here and here you go.
It says that service is not available very much.
So we're as close to connection.
So I'm going to do this one more time.
So anonymous.
And let me do this anonymous as well and put until that aspects.
And here you go.
Now we see the tool that SBX over here.
So what I'm going to do, I'm going to go over here to my Web server and just run until that aspects.
And here you go.
It seems like it has been executed.
And here we have the interpreter station opened in here.
OK, great.
So we managed to hack into the Windows servers.
I'm going to close everything down over here.
I'm going to leave this open in case we lose the connection or something like that.
I'm going to hit enter now.
If I run Alsatians dash l, I can see all the available stations to me.
I can run stations.
They should run in order to interact with the first section.
And if we run system info and since info.
Here you go.
Now we hacked into the double and the operating system is operating system seems to be Windows seven.
OK, so architecture is X eight is six.
So domain is hack the box and here you go.
So if you're on there or else it really doesn't matter at this point because we are in the interpretation.
I'm going to show you what I mean.
We are inside of this listing over here.
OK, now I can try to go back like code dot, dot, dot, dot, like exactly like in Linux.
OK, I can run TWD over here.
I can still run some Linux commands because we are in the interpretation.
I will run there and here you go.
Now we see the user's folder.
I'm going to run.
Who am I.
But it's not going to run.
I'm going to run Shell and just put me inside of a windows shell.
I'm going to run.
Who am I.
Yeah, here we go.
We are something called ice I.
S a pool.
And if I run dear, I can see all the users over here.
I'm going to go for the users and I will run dear.
So like as you can see, we can see the administrator over here.
But I, I.
We cannot go into that and it will say access is denied.
So administrator is the route in the windows.
OK, so let me try to go into classic dot net apple and here you go.
We cannot go over that.
Let me go into the Babis.
We cannot go over data as well, so we cannot do anything.
We hacked into the windows, but we cannot see the things over here.
I can, of course, go into the public directory and try to go into the documents or desktop.
I don't think we have a desktop over here.
So I'm going to go for the documents.
I'm going to just run there.
And as you can see, there is nothing over here.
So we have to find a way to escalate our privileges so that we can become administrator user.
OK, if you exit out of this, it will go into the interpretation.
And I believe we cannot cleared that.
For some reason.
Clear doesn't seem to be working an interpreter.
And any time you want to get out of the interpreter, you can run background and then you can interact
with the sessions like we have seen over here with sessions.
OK, so there are some differences between using the interpreter or the original Windows Show.
As you can see, we got into the original Windows Show by running around and we got out of it by running
exit.
So we're going to talk about these differences.
And also we're going to talk about Windows operating operating system command line as well, because
we need to know the comments.
We need to know how the command prompt works in windows so that we can get a hold of it and escalate
our privileges in a way that we want.
So let's do that within the next lecture together.