Hi, within this lecture, we're going to deep dive into the windows commands and we need to know what
kind of comments should we run in order to gather information before we try and escalate our privilege
in a given Windows machine.
OK, so we hacked into the machine.
We are inside of the wall right now and we have an interpretation.
As I said before, there are different types of commands.
Are there different kinds of things to do when you have an interpreter session or when you don't have
one?
And we're going to actually see both of them.
So don't worry about it, OK?
So this is going to be exactly like the Linux version.
So we're going to start with a less or.
So if you remember Diyar or else gives you the same result, it gives you the actually available files
and folders.
And the reason why I am able to run this is less on a Windows machine is because, I mean, I'm interpretational,
OK?
Because this isn't a command defined in the Windows operating system.
We are typing Ellas in Interpretor and it translated into D-R R and now it shows us the available files
and folders.
But also you can run dear in the interpretation section as well.
OK, so it supports both of them.
So if we're on there it gives us the same format.
But I believe it's a good practice to exercise this in the actual Windows Shell as well.
So remember, any time you want to go into a window shell, you can just write Shell and you will be
presented with a C over here like a Windows shell.
And if you're on exit, it will get back to the interpretational over here.
So bear in mind that because there are advantages of having them interpretational, but also there advantages
of having a windows shell as well.
So I believe it's best to have both.
But if you're stuck with one, then you're going to know what to do as well after completing this lecture.
So far, so good over here after, of course, we see the available files or folders.
We need to actually go for the other commands like we did in the limbic section.
We need to understand what kind of users are there and what kind of permissions we have.
So you can't run since info.
You're to get some kind of a summary of the target machine over here.
And this info shows us this is Windows seven.
And if you go to Shell and you run system for, you will see that this is not a building command.
And for some reason, we lost our connection.
I believe this is not related to ceasing for comment that I have executed over here.
So I'm going to come out of this one.
OK, let me try to see your options.
Here we go.
We have the output Hidalgo's.
So I'm going to run explode one more time and I'm going to run my HP file on that server.
Remember, this is how we got the shell in the first place.
Now I have a station too, so I'm going to just go into the station to Sessions L.
Yeah, here you go.
This is Section two and yeah, for some reason I cannot go into that.
Let me try with sections too.
Yeah.
Here you go.
So I'm in the back in the interpreter section.
So if I say shout now if I say system in rather than siccing four in a windows shell as you can see
I get the same description but in a much more comprehensive way.
So since info in interpretor ok somehow we couso system info in windows but system info is actually
greater, is actually more comprehensive.
As you can see, you get much more details, routing system info in a Windows show.
So over here, use the operating system name operating system version and registered owner.
So Bubby's seems to be our owner or in this case and over here we have the VMware kind of thing because
it's a virtual machine.
So Windows directory, this is important.
So it's generally in the C Windows and the system directory.
Again, it's important.
It's generally in the C Windows system.
Thirty two.
However, it's nice to see it over here.
So system local.
It's Greek in this case.
And the time zone, it's in Athens or Istanbul.
So over here we have the physical memory.
I believe this is just one gig separate.
The fourth is only for this machine and over here.
We have the virtual memory or something like that.
These are not very important at this point, but again, we get a lot of information just by running
system info on a given Windows show.
OK, so bear in mind that this is one of the first things that you should do when you hack into a Windows
show.
So, again, we can come back and run some things in the interpreter and there are some things in the
sea in the Windows Show.
But as you can see there, they have both advantages situations.
Of course, it's good to have an interpreter.
We can do something like migration from one service the other.
But in Windows Shell, we can do stuff like this.
We can just run hostname.
We can see it's the devil.
OK, is generally not that important.
But again, why not?
So if I wear my we already see that.
I believe we have seen this in the previous picture.
We are something called is Apple.
And we're going to see what kind of things that we can do.
As an example, we don't have etsi password or etsi shadow over here, but we can run away my prayer.
OK, pre-existence for privilege.
And over here we can see the privilege, privileged information.
So in this privileged information, it's very important table actually.
And we're going to leverage this a lot during the section.
We have the privilege names in the first column.
And as you can see, this is, for example, Primary Tolkan privilege, OK, in the right hands.
You can see the description.
And in the States column you can see either we can do this, either we can have this, either we have
this permission or not.
OK, for example, we don't have permission that shuts down the system.
We don't have a permission that generates a security audit.
But yeah, we don't have the remote remove computer from a docking station.
But we have something called bypass reverse checking.
We have impersonate a client after authentication, which is very important.
We going to see it in the potato attacks.
So impersonate privilege and we get to have like I create a global object enabled over here.
We cannot change the time zone, apparently, which is not a big thing.
But anyhow, this table is very important that you should take in all of this.
Who am I think you if you're unseals, it should clear the actual session in a given command prompt
in Windows, its equivalent of clear in Linux, but I believe it doesn't work over here.
So if you run who in my group groups, I mean, you can see the available groups or what kind of groups
are we in or what kind of groups do we belong over here?
And you can see the other groups here as well, apparently.
Let's see.
We have them.
Everyone over here, for example.
Yeah, everyone belongs to does everyone group.
So built in users.
OK, so enables group over here we have the anti-austerity service authority actually stands for the
administrator group.
But in this case I believe this is the alternative service and this is authority authenticated the user
and this is a charity organization.
So we are not an administrator user right now.
We want to be and we can see how it's done.
Don't worry, we're just gathering information in this point, OK, like we did in the Linux section.
So this was all concerning our current user.
We have all run this with who am I?
OK, so rather than where am I?
We can just go for some other users if we actually see some of the users and we have seen it by going
into the users folder before, OK, we can run that user to see the other users as well.
Like we only see the administrator Babis over here.
So if we are a net user, we can see at least the administrator, hopefully.
And if you want to gather and information about a specific user, you can run this net user, Babis,
for example.
So Ababa's is just the user in this machine.
It can be any user, as you can see.
We can see that account is active.
We can never expires.
Password never expires.
So here you go.
So you're gathering information about administrator user over here.
Of course, at this point, we don't even.
So if this information is going to do anything for us for the privilege of escalation, but again,
we are practicing the command prompt over here and we are trying to gather information about the system
that we are in, we can do this as well.
That user administrator.
So administrator is the new route is the route for the windows.
OK, so get used to that term.
And here we have the user commands.
We don't have a user command.
We have a counteractive.
Yes, it never expiries.
Password never expires.
So it's kind of the same with the Babis.
But over here, this is the default administrator user.
OK, this is the administrator itself.
Over here.
We can run it config, IP config rather than if config.
So it gives us the current IP situation.
As you can see, we have 10, ten, five over here and we have the default gateway is ten, ten, ten,
two.
So if you want, you can check for the AARP tables over here as well with AARP Desha.
And you can see if we have anything connected to our network or anything that we are currently interacting
in.
So this is basically the IP and Mac address matching over here.
So does network information gathering.
Most of the time it gets overlooked, but it's actually very important.
Maybe we don't have only one network in the system that we hacked.
May be there is a chance to pivot to into another network and there is much more information over there
or there is a very big vulnerability that we didn't even discover yet.
So it's always a good idea to check for the network information and configure IP config.
And RPA isn't the aren't the only options that you have over here.
You can try to run that site in order to track the connections coming in and going out in order to understand
what kind of services are communicating with or do we have any kind of permanent connection to somewhere
else.
You can always try route and OK, so I believe we have to run route print in this case.
Route print.
Yep.
Here you go.
So as you can see, the route print gives us the current through the network destinations and in that
mask's.
So we don't have any kind of different networks over here.
It's a very simple one computer network and we don't have a complex thing going on.
But again, it's worth a shot.
You can see all the network destinations and that masks and gateways.
Remember what we do over here.
Maybe it won't help us in in any way in the privileged escalation related matters.
But again, there is no one way to go for it when it comes to privacy escalation.
So we have to take everything into consideration when we do this stuff.
So after that, after our footprint, maybe we can continue with network information gathering.
We have covered users, right?
We have covered the basics and now we're covering the network and then we can just run.
And that's that.
That's a and.
Oh, so that's that dash.
And oh, in order to see what kind of connections are we having over here, like TCP passwords.
And there are some interesting things over here, like we have seen some of the ports over there, like
as you can see there are a lot of ports on listening state and within that we have only seen twenty
one and eighty ports, I believe.
So we have something like over here like one three five four four five five five seven.
So we haven't even seen them.
So maybe there are other services over here.
They are vulnerable or not.
I don't know, but it can be helpful.
OK, so nienstedt that you know, again, it's very important thing in order to keep your keep in mind.
So you better take note about this as well and see some other information regarding to your current
server, because if you're doing a pentathlete, maybe you should put that into your report as well.
Maybe there is another vulnerability that hasn't been discovered yet by you.
OK, so you don't want to overlook this.
So over here we have the TCP connections and we see some other ports and so far so good.
I don't think it will be helpful for the privilege escalation.
But again, why not?
So over here, we can run the find comment, as we did in the Linux section, remember, we have tried
to find the passwords and in the Windows, we can do this with fine string as well, fine d'astier.
And the syntax goes like this.
So if you just write Slash Essi and password, for example, and for the extension you can write Stardate
means that anything with that extension, OK, anything, any file name with that extension, of course,
maybe text is not the only extension that we are interested in, but for right now just assume it is.
If we run this, nothing comes back OK, because it tries to find it in this system.
I know that's over here.
So let me try to do that in the system 32 and see if we get something back.
Here you go.
Now it's running.
I believe we're going to get something back.
Here you go.
We have a lot of information over here, like please enter your password.
These are not very helpful.
But again, remember what I said in the Linux section.
OK, it's very important for us to try this, even though we get something like, please enter your
password and hash tables.
But it's not very helpful for us in this case.
But people tend to actually store their passwords in plain old text like text files.
So if you find one, then you can just escalate your privilege.
You can just pivot into something else, maybe work your way up there.
So another thing you should consider over here is to just search for the password one more time, but
for the IRONI files.
So there is nothing in this case, but it can be a case where a password you saved in a file as well,
maybe an example file.
OK, so some software can keep logs in the example files and you can try to find it as well.
Maybe let me just run this like that.
OK, and here you go.
We have a lot of things in regarding to example over here.
Maybe we can try to find something within this mess.
As you can see, a lot of information, but again, it's worth a shot.
So, Texte Ironi, an example, searching for passwords.
So maybe it's logged in an example file or something like that.
You can find a good password that you can use for maybe an NSA connection.
I don't know.
Last but not least, I believe we should learn about the SC queries.
So this is for understanding the status of the services that runs in Windows.
For example, we can run a C query wind event so we can defend stands for the Windows Defender.
And you know, this is like a protection mechanism or antivirus mechanism that is embedded in the windows
itself.
And as you can see, it's running in the state and you can see if it's running or not because it may
actually affect your strategy of privilege, escalation or inspiriting or in any case, OK, you can
also write security type equals to service and you can just see all the services that is running on
this machine.
And again, this is very important.
OK, for example, Windows search, maybe it's not that important, but security center.
So over here we have the windows and we can see the window and we can see other services here as well.
So as security is again and musts in your notebook, OK, you should take in all of that.
For example, you can see the firewall states over here as well.
Aside from the Windows, Defender Windows has its own firewall.
So maybe we can just try to see it's like Netezza firewall show state.
OK, so it gives us the state of the firewall services over here and over there.
We see the operational mode is enabled by the remote admin mode is disabled so we can gather information
about the firewall that we are currently facing.
So no powers are currently open on all network interfaces.
So here you go.
Yeah, it says that Net S.H. Firewall is deprecated just using that S.H. ad firewall firewall instead
of.
So if you experience a problem at this command, you can just use this as well, apparently so.
Here you go.
Now, this is just for information gathering.
As I said before, now we exercise the command prompt commands a little bit.
Now, let's move on to the other lecture's where we actually experience privileged escalation into about.