Hi, we did this lecture, we're going to continue exploring the other vulnerabilities that we see in
this digital machine.
I'm still in the wind machine.
I'm logged in as a user.
If you don't have that station currently going on right now, just open another interpretational with
running your SBX.
And this is the reason why we have chosen this machine in the first place, because it has more than
one vulnerabilities in order to escalate your privilege.
And I'm going to continue looking for those.
And Regans specifically focus on potatoe attacks because it can be found in caves and Pantex as well.
And that is this one.
So M 16 also in five is a reflection.
OK, so it says that target appears to be vulnerable and we're going to focus on that one and we're
going to see how to exploit it automatically if you actually have to.
Later on, I'm going to show you how to do it manually as well.
So if I search for that on Google, I'm going to go to report seven.
I'm going to go to GetUp!
In order to show you what potatoe attacks meet.
OK, so let me just come over here and see if we have a good description over there.
I believe in the rep at seven.
We only have a description or instruction, you know, to use this in the metal exploit.
OK, I'm going to, of course, show you how to do this as well.
But I'm going to find another thing over here.
Maybe this is good.
So this module, we will abuse the same person privilege.
So it is a commonly found vulnerability in services.
OK, I'd say so here.
And it appears to be so in real life as well.
So what do we mean by impersonation?
So if we go to our interpreter show, OK, and I remember we have gathered information when we first
hacked into the system and we had actually run, who am I?
So if I can get your ID, you will see that I am the apple.
I'm not an administrator or something like that.
And we're going to talk about tokens.
So tokens spell like this.
And if you don't know what the token is, think about the Web applications.
So it actually is a tool that defines our authentication, our user identity.
So if you go to a website, if you make a request to a server, generally, most of the time you get
a token back.
And that's how a server understands that requests are coming from you.
So it responds to you.
Think of it like a cookie and it actually is valid in the window system as well.
So you get a token as a user and other users get a token as well.
OK, so another thing over here is that you can actually impersonate some other users using their token.
So this isn't actually a vulnerability, I'm going to show you that, first of all, you're going to
have to run this load incognito because we're going to have to want to display this tokens by running
this list.
Tokens dash you.
And there is the underscore between.
It lists tokens that you so as you can see, the tokens are available to me is Apple.
And there is an in-person impersonation tokens available as well, which is authority user.
So this impersonation tokens aren't necessarily a vulnerability.
It can be used effectively in server administration as well.
But if there's some mistake, then we can take leverage off that.
We can impersonate the administrator user and without even having to know the administrators password
and without even knowing to have their names, admin names, we can just impersonate them and we can
be admin or we can run any comment as admin in a way that we want.
So in order to do that, first of all, we need to make sure that this is vulnerable.
This is available to us.
And we have seen the first sign in the methods deployed and for the other windows exploit suggested,
we see that this is open to potatoe attacks.
OK, so now I'm going to go into a shell around where my so I ask Apple and I'm going to run away my
slash prive.
So you remember this command?
I said that we were going to use it and over here we're going to have to look for this, impersonate
a client after authentication, impersonate privilege.
So it has to be enabled for some reason.
I'm seeing everything enabled right now.
But if you remember at the first when we hacked in, this was enabled by default.
OK, so if this is enabled and if there is a way to gather the administrator token, then we can run
this attack.
And this attack is called potatoe attack for some reason.
OK, so we can run a potato attack if we can see this table over here, if we are sure that these are
enabled for us, I mean, this is enabled for us and we can try to impersonate the admin itself so that
we can escalate our privilege.
Now, I'm going to exit out of this one into the interpreter.
I'm going to run get prints.
And this is how you see the current privileges in the interpreter as well.
OK, so you don't necessarily have to go into the windows shell and just around who am I?
You can also get prints in order to see your current privileges.
And once you impersonate privilege over there, then you are good to go.
Now we can do this easily in the interpretation.
OK, we can run this potatoe attack in a very easy way.
But it's spelled like this, by the way.
It's actually a potato, but I'm going to show you the manual way as well.
So if you run potato attack something like maybe with a Windows on Google, you can see a lot of resources
over here, like five million results.
So I'm going to go for this hot potato and let's see what we have, what we have here.
So it says that potato privilege escalation on Windows seven, eight and ten.
So server 2008, 2012.
And as you can see, there are some detailed explanations, technical explanations about this attack.
You can actually read this if you want in your own time.
It will be great for you to understand the theory behind it.
We have this hot potato, we know spillage escalation tutorial or some kind of blog over here.
So we see it actually is valid for like almost every Windows version over here.
And it's not about aversion.
It's not about a security patch.
Again, it's kind of a misconfiguration by the administrator user.
It also gives us instructions about how to take leverage of this in a real life example or in no interpretor
shall example, I believe.
OK, and let's see what else we have over here.
OK, we have another pentathlete that block.
So it's kind of a blog and we see we can actually run this potato that exi in a way that is that has
been displayed over here.
So if we go to first thing that we have found, foxgloves, security, potato.
We can see under binaries over here.
I'm going to share dealing with you guys and we we have the potato that you don't have to do that,
OK?
It's easily done with the interpreter, again, that I'm going to show you.
If you had to.
If we had to.
You can just follow along this as well.
Like potato type commands, disable exhaust or something like that.
There are a lot of parameters that you should run in order to make this work.
You can try this, OK, tries to disable the defender if tries to run the potato Yuxi and it tries to
escalate your privilege in a way.
OK, we're going to do this with metal split, as I said before.
But I just want to show you something else as well.
So I'm going to go into the shell, OK?
And we are under the window temp, so I'm going to run short util.
So you don't know that.
And this is one of the reasons why I'm showing you this.
OK, so if you run short util, that's your out cash dash dash f and then specify A you're.
OK, so let me find out, you are to specify I believe we have to just download this Potato Yuxi to
our Windows or Linux machine.
OK, let's see if we can do that.
And then I'm going to download this file.
Let me just say open because Khalid won't let me open.
Otherwise I'm going to take this potato Yuxi, OK, I'm going to cut this and I'm going to put this
on under my bar w w double W HDMI, which is why which is the root of my web server.
OK, so I'm in the callisthenics, I'm going around service Apache to start, so it starts my web server.
Now if I actually just specify this IP address, which is my turn zero from the interpreter, I can
download it.
Right, so 10, 10, 14, 19 and slash potato that xy.
So I'm going to call this potato that XY and here you go.
So why did I show you this?
Because this is like the equivalent of the we get.
OK, we don't need this right now.
You don't have to do that.
And let me run the IP config over here.
So minus 10, 10, 10, five.
So, yep, this is good.
You don't have to do that.
But if you need to, you should know how to do it.
OK, so over here I have the let me try to start this one more time.
Yes, Ted, this is running.
So I believe there is nothing wrong over here.
And let me try that one more time.
By the way, let me see if I misspelled insert util that the URL cache dash f htp um, ten, ten, 14,
19 potatoe that xy.
Let me see.
Yeah.
Potatoe that EIC.
OK, and now I'm going to call the spot XY and see if it works.
Yep.
I believe this is going to work again.
Make sure you take a note of this sir.
Teutul OK.
Yeah it says that comment completed successfully so if we on there right now as you can see.
Yeah.
Pury potatoe that X also here.
So it didn't fail last time but had to do it again just to make sure.
So again, why did I do that.
If I had to, if I didn't have a metal plate or interpretation opened then I should have done well done
this with the Potato Yuxi.
I remember how we go to Windows.
Stop like this.
If you cannot go to Windows Campi just make sure you run this in order to run the search util because
that's how you actually create a file, that's how you actually get a permission to write that file.
So anyway, if I didn't have the interpreter then I would have gone forward that way.
But since I have the interpretation, OK, I'm going to go with this thing over here, so I'm going
to get this into background.
So I'm in the Section two and I'm going to show you how to run this in the windows in the split.
So we're going out to find first the module name, which is M sixteen, also in the fight for your flexion.
So I believe you're going to have to make peace.
And remember that because this is a very particular one.
It's about potato attacks.
OK, once you go over here to my sixteen seventy five reflection, then it says that no payload configured
defaulting to Windows Interpretor reverse TCP, which is good for us.
But if you say so, options.
And if you don't see the payload, you can always set the payload.
So I'm going to set station to two, which is my current station.
I'm going to set my elbows to 10 to 14, 19 Alpert's.
We can change that part or we can just leave it like this.
OK, I'm going to exploit it and see if we can manage to become rudes or at least we can manage to gather
the administrator token.
So it says, that's my interpretation on point.
If I run, get the idea, I'm still it's Apple.
So let's do this and let's see if we can actually become the administrator, because I believe right
now we get the token and we have to use it.
So I'm going to go into the Incognito one more time.
So later on I'm going to list the tokens.
That's you.
And here you go.
Now, the impersonation tokens available is showing the.
User and altered the system, so I'm going to say impersonate, OK, impersonate token under underscore
token, and I'm going to paste this thing in within sight of the quotation marks.
And here you go.
It says that successfully impersonated the user of the system.
Now, let's try this.
Let's see if we are actually the administrator.
Here we go.
We are the administrator.
OK, so we are the administrator.
I'm going to go back into the shell.
I'm going around.
Who am I?
We are the administrator.
You can actually verify this by going into the users, into the administrator folder.
If you can go over here, that means your admin.
So if you go to the desktop, if you run there, you will see the router and you can just type it.
Here you go.
Now, again, one more time, we managed to become rude.
I mean, administrator in windows and we used potato attacks in order to do that.
This is a common mistake that you can actually observing the real systems as well.
So you better understand how to use it.
And I believe we covered every aspect of it.
Now we're going to stop here, but we're going to continue with the privilege escalation in Windows
again in the next lecture together.