Hi, within this lecture, we're going to try and escalate our privilege, so in order to do that,
I'm going to show you a new technique.
So if you come over here with a shell, then you can try to actually escalate your shell into a metropolitan
shell anyway, because, as you know, we try to get them a temperature shell, but we actually try
to discover a way to get that.
But we haven't found it yet.
But since now we are inside of the network, we hacked into the machine.
Then we can try to create a new shell and upload it over here and get a like a interpretational back.
And by the way, I just mean regular back door.
OK, so how do we do it?
We can create an easily with MSF venom, right?
We can come over here and just run the MSF venom with a interpretor payload like windows.
Through interpreter Reverse TCP as usual.
OK, and I'm going to give the Al Holston outport as usual.
And for the outport I'm going to choose something other than four four four four.
I'm going to go for one, two, three, four, because we are already using that and the format will
be an XY and I'm going to save it under my I double double the amount which is my web server route and
I'm going to call it my back door that XY.
So this is basically a back door that we have seen in the complete ethical hacking course.
If you have gotten that from us and that's it, that's how we create a back door.
So rather than sending back door to a victim, we're just going to upload it ourselves.
And in order to do that, we can use to use the certitudes that we have seen before.
But this time, if the circuit util doesn't actually run or if Circuital doesn't work, I'm just going
to show you a way to do it, an alternative way to do it as well.
And it's done with the power shell, OK?
And it's a little bit lower command and you need to memorize it.
So it's a little bit annoying.
But again, it will be very helpful for you if you can not download a file with a search, do so.
You're going to have to take a node off this one.
And I'm just going to ah, just read it through my notes in order to write it over here.
OK, so this is Power Show.
And again, Power Shell is a shell that we actually use in the Windows operating system.
It leads us to run the commands in a more powerful or more privileged way if we can actually do this.
And of course it doesn't.
And there you can run a lot of commands in order to effectively manage your Windows operating system.
And so the syntax goes like this.
I'm going to say new object system.
That's not that Web client.
OK, so this is a Web client in order to make a request to VEP, and this is exactly what we are trying
to do.
So we're creating a new object of the Web client and you can just call, download file method of that
Web client object.
OK, so and after that, you're going to have to specify the URL over here to download the file that
you need to download.
And I'm doing this with a single quotation mark.
As you can see.
I'm going to write my baktir that ETECSA over here, of course, you're going to have to write your
own name and your own IP address.
And after that, you're going to have to specify what to call it after downloading.
So I'm going to call this my baktir that one more time and close the a single quotation mark over here,
closed apprentice's and close the double quotation mark that we have opened before.
So syntax has has to be exactly like this.
OK, so over here we're creating a new Web client and using the download file method of that Web client
in order to make a request to this vector that easy.
And after that, we going to save it.
Now, if I run this, it can actually download this and save it.
And by the way, if it doesn't work over here, you can try to go into the temp folder and try over
there.
But as you can see, I believe it's working or it's trying to work.
It's downloading that Excel file.
Let me try and see if it is going to work or not.
And again, sometime.
Circuital doesn't let you do that.
And this Perusia will.
So it's good to know the both of them, so take note of this comment and also the research to comment
as well, like the broadcasting that we have seen before.
Now, here you go.
I believe now it's done.
It took a while.
I'm going around there and here you go.
Now we see my back door that the exit and after completion, maybe you're going to have to hit enter
in order to trigger it a little bit.
Now, I'm going around the MSF council because we're going to create another listener for us, this
time with the interpreter Paillot, so that we can get an interpreter back.
And if we get the interpreter Shellback, we can easily run the post exploit module's.
So that's why I'm having this hard time over here, OK, so that it can make our job very easy afterwards.
So I'm going to set my payload to Windows.
Interpreter to reverse TCP.
If you say all options, you will see that you're going to have to write the host and of course we're
going to have to change the outport as well to one, two, three, four.
I'm going to explode this in background and now I'm going to run my back door that exit from the windows
over here.
And here you go.
We have the back.
So I'm going to hit, enter and interact with that station and it has to be sections.
Here you go.
Now, if I say get uid, we are told us one more time, but this time we have the interpreter station.
So if I run this info you will see that I have the current connection with the active windows.
Very good.
Now again, we did the same thing.
We did not escalate our privilege, but this time we escalated our shell.
So we are in a Windows interpretation, right.
That we fear I shall be can't go back to the shell that we were currently in, but this time in the
interpreter.
I can run run post Malti over here and recon and local exploits.
I just are not exploited but exploit suggests are over here.
Great.
Now if I run, does it automatically collect all the data regarding these exploits?
I just use it will display some results back to us.
And here you go.
It will try for the turkey for exploit checks.
Great.
Now we see some of the things that we have seen before over here, like Shell Aviator.
And yeah, we have the M6 075 reflection here as well.
This time I'm going to go for the elevator because as I said before, this is one of the most popular
ones and we haven't seen it yet.
So if you go over here to Google dot com and search for decelerator yourselves, then are going to see
the tests.
Cédula XHTML Privilege Escalation Tingay.
So go into the rapid seven.
Of course you can go for the other ones here as well.
You can just see the descriptions over here as well as the usage as well.
OK, so it seems that we can run this on both architectures like 32 bit, 64 bit.
It says that it's collecting the local exploit for church to beat over here, but our architecture seems
to be 64 bit.
So I don't know whether it's going to cause any problems or not.
But we can easily try this, right, because we already have the module over here.
All you got to do is just copy this, OK?
And I say use an interpreter station.
And of course, we can have to just background this and then we can say use in the metals section,
not in the interpreter section.
So when you do that, if you on show options, you will see that you're going to have to set the station
and our station is one.
So I'm going to set the close to 10, 10, 14, 19.
And for the outport, I'm going to choose something that we have never used before or 555.
Here you go.
I'm going to run, explode and see.
Yep.
It says that there's a problem over here.
It says that try using an X sixty four interpretor.
It's very good that we get this error back.
As you can see, it asks for a specific version of the environment over here.
So we're going to have to be in the six to four environment and we can try to switch it.
So we haven't seen that before.
So this is a great opportunity for us.
So I'm going to go into the station one.
So I'm going to say get UID or siccing for rather than get you ID.
We see that architecture is already sixty 64, but I believe our station is in the.
Her to OK.
As you can see, the interpretation is in the 32 bit, so that's what's the that's what's causing the
problems.
So what we can do, we can try to migrate our process into something 64 bit.
So in order to do that, you're going to have to display the processes that is being currently running
over here with the comment.
So if you ramp's comment, you can see all the process lists in the Windows operating system.
And as you can see, our ACMD is the X Eighty-six, which is 32 bit over here.
We're going to have to migrate it into something cold or something like 64 bit over here.
Maybe we can just go into this one, Jiron EXI, which is the cold fusion.
So all you've got to do is just migrate 11 84, which is the pide, OK, and if it doesn't work, you
can try to go into other 64 bits as well.
But this is I believe this worked very well.
Now, if you have gotten the complete article hacking Kinkade's, you know what it means to migrate
over here.
And as you can see, the interpreter is now in the 64 bit as well.
So we generally do this migration in order to persist our session.
But this time we did it in order to go into a 64 bit session, which is most of the time much more stable,
by the way.
Now, I'm going to come over here and say show options to the elevator.
A recession is still in one hour, host and outport is still OK.
I'm going to run the exploit.
And this time, as you can see, it's working.
I didn't complain about the 64 bit thingy.
And now I'm going to say, get your idea.
And here you go.
Now we are Rootie.
We are administrator.
So we manage to escalate our privileges.
So if I run PWP, I mean the System 32, I'm going to go back and let me rumpy W.D., I mean, the C
I'm going to go into the users and I'm going to run alerts to the administrator folder over here.
I'm going to go into the administrator and if I run, unless I can see all the things regarding to administrator,
I'm going to go into the desktop because that's where we find the root flag in the hack the box.
OK, I'm going to cut this thing out and here you go.
We managed to get the root flag.
So this is how you hack the Arctic.
Again, this is not a very good CTM because we're going to have to wait like ten seconds before we do
anything.
But again, it teaches us a lot.
And we haven't seen this shallow or we haven't seen the migration.
We haven't seen a lot of things in the section that we haven't covered before.
So that's why we have chosen to do this.
So far, so good.
I hope you enjoyed this section.
See you in the next one for closing.