Hi.
Right now, we are in the interpreter and we gathered all the information regarding capability escalation
over here.
So within this lecture, we're going to try and become administrator in the Windows machine that we
hacked.
So over here, we have the metal exploits adjuster and we have the others adjuster here as well.
OK, so we know six police adjuster is over here.
So if you just put them side by side, you can compare them to see what kind of similarities we have
over here.
Like we have this MS 11 a.m. Eastern, EMS, 59, 61.
And over here we have the same thing, like my son, 1092, 53.
OK, so these are codes for the different kind of exploits.
And we have the descriptions over here as well.
So you can just go for either one.
I'm going to go with the metal so gister since we are in the interpreter show, OK, because these are
also built in modules šemeta exploited.
So for example, we can just find this key pteropod in the metal exploit itself.
Of course, I'm going to copy this and go to Google dot com in order to show you something, because
you might think that what happens if I don't have an interpreter show and if I have the Keter Pods for
some reason available to me for an exploit way.
So what happens?
You can come over here to GitHub or Reppert seven in order to see what Keitaro Pod means or in order
to see how to exploit it.
Right.
So there is a sense of security over here.
There's exploit DB.
You can just take a look at all of those things.
So in the offensive security souce, it's what color?
Lennix we can just use the commands as usual over here.
And I believe this is the privileged escalation section.
It tells about the gate system.
It tells about the local exploits.
OK, so these are some of the options that we're going to be using during this lecture as well.
So this actually lets you understand how to use the robot exploits using the methods deployed one more
time in the offensive security.
OK, so if you don't know how to use it, you can just come along and just see yourself.
And again over here for for example, we have the available descriptions, we have the available codes.
So it's not only working with the methods deployed, you can manually do this as well.
But if you have an interpreter show that it's great to do it with methods because it will be very easy
for you.
So you can try to understand the description over here.
So understand how octopods vulnerability was discovered and how it works in theory as well.
And most importantly, what kind of Windows versions does it affect, like Windows Server 2008, Windows
XP Windows?
We OK, you can see it for yourselves and you can just see the whole message over here.
OK, and again, this Kitara part is very popular.
So this was the, I believe, one of the first ones that we have seen in the list.
So that's why I'm going to go with this first.
And if it doesn't work, of course, it might not work.
We're just going to go for the other ones.
So over here, I'm going to go with this Kitara part.
OK, so I'm going to copy this.
And if you read the description, it says that the service is running but could not be verified.
So we're going to just try, OK?
For some reason, I have exited this interpretation.
OK, so I have to open it one more time.
So I'm going to just run this one more time.
So I believe we are in the section for right now.
Yep.
Here you go.
Now, if you want to go out of a section, you can always run background.
And by the way, I just made sure that we are running this as I as Apple, not as administrator or something
like that.
So just run background.
Now, your session can be seen in the sessions list, OK, so you can come back to your session anytime
you want.
That's how you don't lose your session.
Now, I'm going to run this, OK, so I'm going to copy this, OK?
And I'm going to try and go into that module.
And by the way, this elevator is another popular one.
If it doesn't work, if the Keiter part doesn't work, of course, I'm going to go with this shallow
water and.
And over here, we have some other suggestions as well, we can try them all.
So let me clear this thing up and just use the exploit with those local counterparts.
OK, now we are in the control module, OK, if we go to Kelly Linux document documentation over here,
it says that you have to just make sure you set the sections, set the payload and the other stuff.
So I'm going to say all options.
Here you go.
We have to specify the station that we are currently running.
So if you might remember, a recession is in the background with Section four.
So I'm going to set the section to that.
So if you can run stations, all yours must be different because I had to open and close at a lot of
times, OK?
So right now, if I say show options, it will be displayed over here.
So over here we have to set the Al-Hussayen airport.
So I'm going to open the F config and see what kind of turns you or I have over here, 10, 10, 14,
19.
So I'm going to set my elbows to my 10 zero.
You can try to write one zero over here as well, but I believe this is a better way to do it.
So I'm going to change the outport to something else or maybe we can live it as it is.
I don't remember if we're.
Yeah, here you go.
We have used for two, four, two.
Maybe we can just leave this as it is two four four four four or you can change it to one, two, three,
four.
It really doesn't matter as long as you find a working port.
So I'm going to say, sure, payloads and we have a lot of payloads over here.
So I'm going to say all options.
Let me see.
We have the module and here you go.
Yeah, we have the payload over here.
We know from Interpretor Reverse DCP, this is fine.
If you don't see it in this options, you can say set payloads to this.
I'm going to exploit this and see if we get a back.
So good.
It says exploit completed, but no station was created.
So there can be a couple of reasons for this.
Maybe it's it doesn't work here, OK?
Maybe doesn't work here.
Maybe we have to run explode Jay-Z, OK.
And then just list these sessions.
Now we see only WCD station for now I'm going to say show options.
And over here, let me check the towns zero over here.
Yeah.
It's actually good.
I'm going to change the outport to something else like one, two, three, four and try with that.
OK, I'm going to exploit this one more time in the background and let me just run l nope.
We don't see it as you can see.
So again, maybe it doesn't work.
Maybe we're doing something wrong.
Maybe we have to just try it one more time.
I don't know.
Maybe we have lost the connection to the server, lost the session in four.
Maybe we can try that.
So it happened before, right?
Just out of blue.
Our station has been closed to the hack the back servers.
So we had to just connect one more time.
And after trying that, if it doesn't work as well, we can go for the elevator or any other exploit
suggestions that we see over here.
So, for example, if you come over here and just say, session's out, we don't see it, OK?
And I'm going to go into the stations for I'm going to run a comment to see if I lost the connection
over here.
Yeah, here you go.
I believe we actually lost the connection.
If I run, get Eweida, it doesn't respond to me.
So for some reason, I believe we cannot connect to the server.
And as you can see now, it's dict.
So.
Well, what I'm going to do, I'm going to go back to my multi handler one more time and try to open
the connection one more time.
It happens.
OK, so I'm going to show the options and here you go.
So I'll hostis is correct.
I'm going to exploit this OK.
And I'm going to connect with my Xbox One more time.
So here you go.
Section five opens.
I'm going to directly go to the module key theropod module over here.
So let me find it.
Yeah, here you go.
Now I'm going to show options and we have to change the station because it's stuck in for over here.
I'm going to say cessation to Fife and rest is good.
I'm just.
And they exploit this and see, here you go, it says that exploitation six opens, if I say, yep,
here you go.
Now we see the anti-austerity system at the wall.
So this is route.
This is administrator.
So I'm going to go into decision six.
I'm going to say get UID and we are authority's system.
So far, so good.
So let me try and see if we can go to shelter.
Yep.
Here you go.
Now I will.
Around who.
My immaturity.
And I'm going to try and see if we can go to the administrator folder so that you can see where the
flags are located under hacked box machines.
So I'm going to go to see and from there and I'm going to go to users.
I'm going to run there.
Here you go.
Now, let's see if we can go to administrator.
OK, and yeah, I believe I misspelled that.
So let me try this one more time like this.
Here you go.
Now, I can run this over here, so it should be on their desktop.
So let me run there.
And here you go.
Route Steve.
Let me just try to type it.
It's like catting it.
OK, so here you go.
This is the route FLAC.
This is Dedman FLAC.
We owned this system in this machine, as you can see, took us a lot of time because we were trying
to understand the theory behind it or the trying to find the exploits that can be helpful for us.
And if it didn't work, if this didn't work, I would go for the elevator and for the other ones here
as well.
Maybe you were going to have to try a lot of things.
Maybe you're going to have to search a lot of things in the Google in order to understand how to leverage
all of those exploits.
Maybe you won't even have a mature position.
So you're going to have to do this manually.
But again, it's a good practice.
So we're going to stop here, but we're going to continue learning about privileges, escalation in
Windows machines in the next lecture.