High within the section, we're to solve another Windows machine from the hack, the bugs, which is
called Arctic.
OK, so if you don't have any VIP membership, just make sure you wash the section and not skip it.
So if you come over here, you can search for Arctic and just find the machine yourself.
OK, so this machine is considered easy, but and also, again, it's created by the chap.
So I believe this is the guy that has been in our life because we have already sold one of his seats
in the previous section.
And if you take a look at this, you can see it represents the real life and it also leans toward the
sea, we in the privileged escalation side.
So that's why we're actually trying to solve this.
So it actually includes a service called some kind of adobe service that is commonly used in government
buildings or government facilities and also in some big corporations.
So it's a good practice to solve this not only privileged escalation wise, but also getting access,
gaining access wise as well.
OK, so my IP address is going to be 10, 10, 10, 11 for this machine and my VPN is running on the
Michael Linux as usual.
So I'm connected to the hack the back servers.
So let me see.
Here you go.
I can pick the machine now.
It's very good.
I can pick this.
And as you can see, I have the same IP address in my turn zero over here.
So what I'm going to do, of course, I'm going to go for and that you can do this with that map as
usual.
Or you can.
I'm just going to go for the Internet scan that we have been doing so far.
OK, you can just go for any of this, by the way.
Like you can go for the old Tsipi parts or something like that.
Or you can just go for the old parts if you want.
OK, so it really doesn't matter at this point.
You can just go for your custom and map.
This is not on any map cause I assume you already have some experience on this.
I'm just going to go far and map all parts with intense scan and with verbose, OK, and I'm just going
to go for it.
So here you go.
Since I'm doing this for old ports, it's going to take some time.
It's already started to find some things like I believe we have discovered open part 135 over here.
So it seems like we don't have any eighty part or like a Web server, but maybe we have I don't know
yet.
So it's going to scan sixty five thousand five hundred thirty five ports.
So it's going to take some time, as you can see, ten percent of the system.
And again, why we are doing this, because we want to understand how to gain access to the Windows
machines and after that, how to escalate our privileges in a way that we haven't seen before.
And this represents real life in a good way.
So that's why we are going for Arctic litmus if we have any kind of Web server going on over here while
we wait.
So I'm going to go for ten, ten, ten, eleven.
And let's see.
Yeah, it seems like it's trying to connect, but nothing is happening over here.
OK, so we are just waiting.
We're just waiting.
Yeah.
I don't believe we have a web service, at least proper service right now.
So I believe we're going to have to wait until this is done.
So I'm going to post with video and wait for three minutes to come back here.
So just do the same thing.
So here you go.
I waited for three minutes and this is our result back.
So let's see what kind of pause our services are.
We are we are dealing with.
But before that, I'm going to just copy this as usual, OK?
And I'm going to put this output into a file in my documents folder.
I believe we have a folder.
I'm going to create a folder called Arctic.
I'm going to go into the Arctic and I'm going to neno a new node staticky.
So I'm going to paste all the things that we have copied.
And I'm going to save this by clicking control or enter control X.
So far, so good.
So now let me scan this a little bit.
It started to scan it found some parts.
Let me see.
We have the one thirty five, which is Ms.
AAPS, our P.S. sorry I we have something called FDM P but I don't know what we can do with that.
Over here we have the windows as operating system.
Yes.
It's definitely Windows, we don't know the exact version or version over here, and it doesn't seem
that we have too much information, right.
So we're going to go for either of these like 135, maybe 500.
So let's see, maybe we don't even know what is MSRA PC.
OK, so we can just go for him as our PC exploit to see if we can find some kind of exploit that works
for all our PC versions.
OK, so as you can see, our PC is the Microsoft remote procedure call.
OK, so if we come over here, we can see that kind of a service that lets us remotely do something
on the target machine.
So if it's not configured, then most probably we can get a callback or we can just execute a cold in
a way that we want.
But we don't know yet.
We don't even know the service version over here in the version, as you can see, we only get those
Microsoft Windows, our PC, but we don't get a particular version.
Maybe we can try to run and map one more time.
But before we do that, let me just search for the FTP as well.
So what does that thumb tip its flight message transfer protocol?
Let me just go for the exact part.
So, as you can see, eighty five.
So what is that tbh?
It's really flight message transfer protocol.
So we are against a very different part over here.
So I don't believe I have seen this one in previous CTS, not only in this course, but also all the
previous codes combined.
So as you can see this to enable the international operational requirements for the coordination and
transfer of aircraft.
So I don't know what we are going to do with those.
Right.
So if I come over here, we can see it can run on the part eighty five hundred really.
And it's in its both, it can be both the TCP UDP apparently.
Let me just try to connect to those like this, so let me see if it can work over here, if it's kind
of sending a request or if you're getting a response back and I don't believe it's working, so let
me go for the other ones.
So let me see.
We one thirty five and forty nine one five four.
So in the eighty five hundred we have to thank.
So let me come over here and if I click one of these, let me try to open another tab and this one as
well.
And for some reason, as you can see before we get a response, we are waiting for some minutes or some
maybe ten seconds or let me see.
Let me see if we get a response back.
And here you go.
We're waiting for some kind of internal over here.
I don't know why it's happening or is is the buck.
So we're going to see later on.
So it happens everywhere.
If we just click on one of these, as you can see, we wait until it's shown for a certain amount of
time.
And I believe this is how the server is configured.
Right.
For some reason, we don't know that reason yet.
So under the Sieff docs that we have found, we have a lot of files and folders and we're going to have
to see and understand what it does.
So over here, we have some jetpacks or images.
OK, so we have HDMI files over there, a lot of e-mail files.
So we can just take a look at those if we want, like go into that events.
I don't know what it does.
So, of course, we can try to see the JPEG over here.
I don't think we are going to get something out of that.
But anyway, so we have a Sieff on file over here.
We have a DB folder, database folder.
Let me just try to broaden this a little bit, and it's annoying to have that thing that time out to
me.
And I believe it has a reason that they gave us this timeout.
So if we just click on one of the images over here, it says that cold fusion.
So this is a hint, but we don't see much more for that as well.
I believe over here we have some kind of cold fusion documentation link again.
And over here we have kind of new files and folders.
Let me just go into the administrator.
Folder, we have the application that CFM one more time, so let's click on that and see what happens.
So cold fusion, by the way, is a service and adobe tool or a service.
We're going to see how to work with that.
But again, I believe this is a hint that lets us know that this server is capable of running cold fusion
or actively running cold fusion.
So if you search for cold fusion, OK, on Google, you can see a lot of searches for that already like
exploit or something like that.
You can just search for it and you will see that it's Adobe products.
So it's a commercial web application development platform.
So again, this is commonly used in government facilities or in big corporations.
So if you see that there is this is OK, by the way, if it has the proper configuration or proper patches
or proper security settings, but if it doesn't, maybe it can lead us somewhere.
For example, over here we have found an administrator panner like this.
So the user name is admin, apparently, and we have a password over here.
So if we can find the password of this admin, then we can log into the cold fusion.
OK, so this is under Sieff ID ACFID folder that we have found in the first place.
And when I saw the administrator folder, I just clicked them.
So if you cannot find it, just go and type this link.
So let me just try this password.
Here you go.
I just give a single quotation mark to see if we have a basic sequel injection over here.
But as you can see, it actually is kind of decrypts or encrypts the message or encrypts the password
before sending the request.
And the response gets the response back that we got is invalid password.
OK, so what can we do over here?
As you can see, we have found the administrative panel and we have to find a password of this admin
user.
So there are a couple of possibilities.
We can go for a sequel injection, we can go for bruta farseeing and we can try to find the password
or like in a hint or in any folder or file that we have been presented with, or we can just try to
find if we have a vulnerability regarding to called wishe Friesian aides in the administrative panel.
Right.
So I believe the time out that we're getting is there because of the brute force.
So I believe the CTF doesn't want us to do any brute force.
OK, so there isn't any type in the Weezer's page as well.
So what I have in mind is that we're going to have to search for the exploit of this cold fusion ET
rather than try to brute force this because each passwords try will take like 10 seconds to complete
and it will take ages to complete this.
As you can see, once I refresh that, it will make me wait 10 seconds or something like that or maybe
eight seconds, I don't know.
But it's close to 10 seconds and it will then give me the response back.
So we get to we're going to have to get creative over here.
Let's stop here and do get creative in the next lecture.