Hi, we did this lecture, where are you going to see the other tools rather than the experts I just
saw itself in order to understand the alternatives that we should look into when we try to find a vulnerability.
So over here, we still have the shell and we're going to exit out of this one and go into the interpreter.
And apparently we cannot clear that.
But don't worry.
So we're going to see the advantage of having an interpreter shell here as well.
OK, so interpretor shell actually gives you a lot of possibility, like you can run, and that's,
for example, rather than there.
But other than the eye, this kind of cosmetic things, we also get to see some nice features like get
system.
OK, so if you on get system, if metallurgic can find a way to escalate your privilege in an automated
way, it will do it, OK?
You just have to right.
Get system.
So this will just look out for the basic opportunities in order to escalate your privilege.
Most of the time this won't work, by the way, but it's worth a shot.
That's just one comment.
So insects might it might work in real life, Pantazis?
I don't think so.
However, it's worth a shot.
And also, this is not the only advantage that we get when we actually have an interpreter.
Well, the other thing is it has a post exploit suggestion module built inside of it, OK?
It's not built inside of the interpreter itself, but it's built inside of the metal exploit itself
so that we can actually use the section that we have over here as an interpreter station and we can
supply the station's info to that module in order to understand if we have any suggestions in order
to escalate the privilege.
So all you got to do is just run this run post exploit and the suggestion itself.
But you got to do this in the background.
OK, so let me show you what I mean.
I'm going to run this run post multi or multi, OK?
And then slash recon and then slash local exploit suggest or so this post multi recon local exploits
register is a module of the metal exploit itself.
OK, so when we run this from inside of the interpreter, it tries to collect the local exploits for
the windows and it will try to just give us some suggestions, give us some outputs like this.
Here we go.
It works.
As you can see, we already have some output.
We already have some information over here and they are similar with the Windows exploits.
I just heard Tingay that we have seen in the previous lecture.
OK, so this is very good.
This is very practical.
You can do this with only one command and I believe we lost the session over here for some reason.
So before we lose this stuff as well, I'm going to copy this, OK, and take note of this.
I'm going to copy this and I'm going to save this under my notes as well.
We did that in the windows, exploits Gister, and we did that under the CTF folder, under the digital
folder or here.
OK, so I'm going to just do the same thing so that we can compare our results later on and come back
to see if we have any much more information.
Do we need, if any, information is needed.
So let me come over here and I know a new tax code at this point suggested that I'm going to paste the
output over here and I'm going to save this and I'm going to try and open the session one more time.
So let me see the sections over here so that I shall.
Nope, we don't have any issues.
We don't have any jobs.
So I'm going to say all options.
Yeah.
Here you go.
I believe our al-Hassan outport is correct, so I'm going to explore one more time and I'm going to
run our aspects and to see if we have the section back.
Yeah, here you go.
Now I'm going to run sections two and here you go.
Now we're interacting with the section two.
Now we're back in the section.
OK, but of course, this doesn't end here.
So we have already seen two tools in.
Understand if you have any possibility of previous escalation, but also there is a very popular third
one here as well.
So let me show you what I mean.
I'm going to go for Google dot com and I'm going to search for Limpus.
So this limpets is actually for Linux.
And this is a batch file, as you can see.
You can use this in Linux as well.
OK, so this is kind of a search for these vulnerabilities and show us back to results.
So we're going to look for the vampyres over here.
So they are named after the same syntax as you might have already understood that.
And over here, under the car laws, we have the windpipes that ETECSA.
So if you want, you can compile it yourself.
You have the source code over here, or if you don't want it, you can just download the one piece that
exi and try to just use it.
OK, so this is Windows privilege, escalation of some script.
So this is the aberration of our piece come from.
OK, previously escalation.
Awesome script.
So it's again in the book, the tech tricks that exercise that we have seen this before.
So if you haven't bookmarked yet, I suggest you to do so, because this is not the only thing.
This is not the only path that we should follow when it comes to Peruggia escalation, as you can see
in the hack tricks that X, Y, Z, we see a lot of things over here like system information, searching
for kernel exploits.
And of course, we are following the same path over here.
But you may just get a lot of different comments or a lot of different techniques in order to understand
if there is any possibility for privileged escalation.
As you know, this is a book like an online book, and it gives you a lot of information, much more
information that we actually see over here.
So make sure you take a note of this.
For example, over here we have some Mentos upload payloads like we can use with MSF, Vietnam.
We have some kind of Amazigh installation, something like that.
You got to take this into consideration as well when you're trying to solve a CTF or a real test.
So over here we have the binaries and also the source codes for this awesome script suite.
But we all also have the XY over here.
So I'm just going to go for the latest obfuscated version.
OK, so I'm going to go for the latest ETECSA and just download it so you can find it under Bhim.
And this is the X Files.
So we have the any X Files, 64 bit and 32 bit over here.
So you just going to have to just use it one that fits you.
OK, so you can try to use it with any that XY.
OK, I'm going to go for that and see if I can download it so I believe I can not download it.
Is it a previous one over here.
So let me try to delete this or let me just try to download it one more time.
I believe we are in a 32 bit environment, as you might remember from the system info.
So I'm going to go for the X eight to six over there.
And once you do that, it contains the color of the things it contains and malware.
So you going to have to open it and just find it under your download folder.
Here we are.
OK, I believe I have the any 64 bit and the 86 bit over here.
So I have downloaded these things before.
So I'm going to delete this old one and go for the latest one.
So let me just rename this, OK, so let me just rename this and here you go.
I have all three versions.
You you're more than welcome to download and try it yourselves, OK?
And if you have an interpreter session again and very important aspect of this, that you can just upload
something to the server, upload something that you're currently logged in to your target machine.
OK, so if I run PWP, I mean the system 32 Einarsson ratio, I if I want I can just upload its upload
this to here or I can go to the temporary folder as we do in the Linux.
But again, this is actually placed in somewhere else in the Windows and it's better for us to know
where it's located so that we can use it.
But of course you can try to upload it anywhere like in the system Gerta or in the sea directly, but
most of the time it won't work.
OK, so it's better to go into the temp folder.
In order to do that, you're going to have to write it like this.
So CD into C and after Kullen you're going to have to do some backslash just like this and to back slashers
in that case.
OK, so see column two back is windows and two backslash is temp.
So if your windows is not located on the C like this, you're gonna have to adjust it yourselves and
you can get this information from get system info.
Right now we are in the C Windows temp, as you can see.
So this is the equivalent of the temp folder in the Linux.
So most probably we can have have permission to write files over here so we can try to download the
file.
But I'm just going to upload it using our interpreter shall.
And in order to do that, I believe we need a full page.
We were here, so this is located on the route download, so if yours is located down there somewhere
else, make sure you copy that because we need to supply that information over here.
OK, so let me pass the clipboard.
And after that, we're going to have to supply the whole name, which is weird.
Please let me write that when whimpers X 866.
See, I, if I run this, it will upload this to our target server.
They fire on the less I will see.
Let's see if we can see this actually.
Yep.
Here you go.
Yeah, it's under the tem folder and also we have a lot of temp files over there.
Don't worry about it.
OK, we have it over here.
And of course if you want you can try it wimps any EXI as well.
It should work in this case, whether it's six or forward or 32 bit.
But I believe you're in a 32 bit environment and we can try to migrate to another Tingay later on if
we get a show.
So I'm going to go into the windows shall if I run there we see the wimps over here.
OK, so it's there now.
I will try to execute this by just typing the name over here.
And if I hit enter, as you can see, nothing happens.
I don't know even if it's if it got executed or something like that.
But remember, we also had the wind defender and firewall enabled in this section in this actually targeted
machine.
So maybe it's blocking the connection.
So it's always a good idea to avoid running Ekis on the target if we have alternatives.
OK, and in this case, we already have one and two different kind of suggestions.
But as you can see, I'm trying the third one.
Maybe we get a different kind of output.
I don't know, but we cannot seem to do that.
Of course, we can try to exit and try to load power, shell power.
Shell is kind of a shell that you can run.
Some system commands like a powerful execution of shell limitation in windows, OK?
And in this case, we can try to load the power shell from the interpreter and try to run it with power
shell as well.
But again, we lost the connection.
Let me try to exploit it one more time.
It really does matter because I already tried it and it doesn't work in the power shell if you just
type low power usually and if you can try to execute it from there, it won't give you any result back.
But it's not important because we already have the exploits register and the metal split posts joester
results back here.
OK, so make sure you open your session one more time because I believe we have a lot of information
to elaborate right now to evaluate and see if we can elaborate something out of that to become administrator.
And that's exactly what we are going to do within the next lecture, because I believe we have already
covered the information gathering phase over here.
Let's do that in the next lecture.