Hi, within this lecture, we're going to see how we can turn the information that we have gathered
into a valuable suggestion in order to privilege escalation in this case.
So remember when we actually ran system info in a windows?
Shall we get a very detailed information from the Windows shadow over here like this?
OK, so we can try to understand if you have a kernel exploit or any other exploits available just by
looking at this information.
OK, because their version information over here, configuration information, built types.
So operating system information, anything that we need actually in order to understand if we have a
kernel exploit or version exploit or any other vulnerability that may lead us to privilege escalation.
So in this case, if you remember in WI in Linux, we have downloaded some exploits, Algester and we
have actually supplied some information or just ran the script in order for it to gain information and
give us back an output.
But in this case, we're going to do a little bit different things.
We're going to do it in a much more simpler way.
We're going to download the exploits, register to our own machine, OK, in our own colonics, and
we will just supply the system info information to that tool in our machine and we can get back some
suggestions so we don't need to download anything in the windows.
OK.
And by the way, if you need to download anything later on, we're going to see what can we use over
here, like we get off because we don't have we get in here.
We have different tools.
We can see all of those things later on.
But for right now, what we need to do is just understand if there is any current version of vulnerability
that we can take leverage off, because it's the most simplest way and it's the most effective way that
you can think of.
If there is one if there is one way to exploit this, then we should definitely go for that one.
So let me show you what I mean.
I'm going to go to Google, OK?
And I'm going to search for the Windows XP register and find the link that we should find.
So I'm going from Windows Exploits Adjuster.
So here you go.
I believe this is the one that we are looking for a on cyber Lapps, OK, AOA and Cyber Labs.
So I'm going to click on that.
And over here we have a python file again.
This is the link.
So this is the we know six plates register and we can just download this and use this.
OK, so as you can see in the descriptions to compare Target's patch level against the Windows Microsoft
vulnerability database in order to detect potential missing patches.
So if you think that, yeah, this is a good tool, but it hasn't been updated for years right now.
So how do we understand if there are current vulnerabilities or not?
Don't worry.
I'm going to show you some other tools as well.
So this is just one of the tools that we are going to use.
And also it will try to update itself.
If it's get updated in the database, then we're going to have a current one.
So I'm going to save this file, OK?
I'm saving this file in my Linux.
So let me just open this download file folder over here, OK?
And I'm going to unzip this just we need the PVI file, the python file from there.
I'm going to put it over there.
And I believe we don't need this, but I cannot seem to find our file because it's a folder.
Let me just cut this folder from our downloads folder.
I'm going to go into the documents, OK, under CTF and I'm going to create a new folder called Divil.
So I'm going to put this on there, Deval over here and paste it.
And yet here you go.
Now we have the python file over there.
We don't have to do it with anything.
But let me open this with Genea and show you what it contains.
As you can see, this is a python code and it contains a lot of information regarding to current databases
or current information on vulnerabilities in certain Windows versions of certain Windows patches.
So we need that information in order to let this tool and just let it make its work and find the vulnerabilities
that they're matching with our.
Inversion.
So how it's done, we need to run this from terminology using Python, and it's also instructed in the
guitar pages as well.
OK, so let me open the tab.
I'm going to go for the document CTF and the will over here and under the Windows XP.
So just a master.
We have the python file over there.
So what I'm going to do, I'm going to come back to this explanation description part.
As you can see, it says that run the profile, but first run it with the update command so that it
gets updated.
OK, so once you do that, it will give you an excellent X, so an Excel file.
OK, and we will need that file.
So make sure you just run the update command.
OK, and here you go.
It says that writing to file and this is the thing that we are looking for.
So we need this Excel file.
So this is an Excel file that is kind of a database.
It contains the vulnerabilities.
Are we going to compare it against this XOS file?
Actually?
So how do we use it?
We know what kind of information we have from our Windows machine.
Right.
If we come over here, it says that installed the dependencies.
I believe these are preinstalled in Linux.
But again, it's no harm running this.
So people install Excel already upgrade.
So if you had an upgrade, it will just do it for you.
OK, so very good.
I believe we are getting that.
Yeah.
Here you go.
Now we have the six or D.
If you didn't have that, just make sure you have it and come over here and run this final comment.
So in this comment we are running the experts.
I just to one more time and for database we are giving the Excel ASX that we have created previously,
OK, and we need to give that as a parameter.
And also we need to supply the system for as a parameter here as well.
So we have to create a system for that 60 or any text file and we need to copy our system info and paste
as in so we can totally do that in our clinics.
All we got to do is just come back to Windows Machine and after running system info like this, just
gather everything, OK?
Gather everything after system info.
Just make sure you copy this thing and come back and you can create a new file from your terminal over
here.
Here is our Windows XP.
Yes, sir.
Now I'm going to nanoha a new file.
I'm going to call this Windows.
Exploit that, Steve, but you can just call it anything you want.
I'm going to place the clipboard.
Here you go.
So this is the thing that we have copied.
So this is all the information that we need over here.
I'm going to close this down and I'm going to run this comment.
So basically, we're going to supply two parameters.
It's very easy.
First of which is database and the second one, sys info.
So we have all the files that we need in the same folder.
Beware of that.
OK, so if you don't have that, you're going to have to supply a full path.
But in this case, I'm just going to say Windows exploitative 64, the system for parameter.
And over here we're just going to change the dates like twenty twenty here, eleven here and twenty
one here.
OK, and I believe.
Yeah, here you go.
The extension is also different.
So we have the Zellous over here, but in the sample command we have the access X, so I'm going to
delete this and here you go.
Now we initiated that and here you go.
We have the output.
So in the output, what do we have here?
We have suggestions.
So this is a suggestion.
This is a suggestion.
We can try to understand this vulnerabilities and we can try to exploit them one by one, as we have
discussed in the Linux section as well.
Remember, we had a lot of suggestions in the Linux exploit such gesture and we have the same suggestions
over here.
We have possible vulnerabilities that we should take care of.
We should just try and test and we're going to try all of those things until we find a working one.
So I'm going to create a new folder or new.
File over here, OK?
So in order to just to save this and I'm going to call this something like maybe Windows exploit suggestions
or something like that, OK, I'm going to call the suggestion.
You can call it anything you want.
Just make sure you saved us so that we won't have to deal it.
Deal with it one more time.
I'm going to save this in my nano.
And here we have the final results.
So this is only one way to get this, OK?
Of course, there are alternative ways and we're going to have to learn every one of them so that we
can compare and we can find the one that is working best for us.
We're going to stop here and continue with the same process within the next lecture.