So the guys in this room will be doing the registration technique, will be seeing that that is insecure
service permissions, so we have a service running and the service permissions are insecure.
So that means a normal user can change the permissions for this service like or the entire binary or
reading the part of the solid C and how to do this through the discretion technique.
So first of all, you should learn about this access to data so it is easier to check the access permissions
for the user of the particular service, a particular binary, a particular process, etc. So you can
download those that access the access to the exit from the Internet.
So it will be available from this internal schools.
So I have already downloaded this one.
So first I will show you HelpAge.
So we need to know about the few comments.
And sees for queering for the service and before only showing the territories and EUFOR integrity levels,
and so you can see here care for registry keys.
All right.
Now you can see the P4 process, nimar possessory and then our eyes only to show the objects that have
the red Xs and OS.
Ferguson is so new for suppressors, for verbose and W4 right axis.
So with these sutures we need to enumerate the services.
So the IP address you need to login as our DP.
So the credentials, username and password to do one.
So so this is the.
So this is the think of it as a normal year after we get the reversal.
So from here, we need to transfer the access, check that exhibit so you can transfer that using the
set up by transfer and then you can use the of.
So access to food or water and access check, it will show you some excerpting, so you need to suppress
that error.
So if you run normally so.
So if you don't normally.
OK, I don't know, it's been closed, so they will be a tick box need to accept the terms and services
and then you need to open that.
So to suppress that because you are in the command line, need to use this excerpt.
And then what we're going to use is minus you for any errors and for verbose.
And I think you are used for quite so after these procedures, we need to provide the W, so we need
to find that w writable what we are going to find services.
So we are going to find the right services and Interahamwe.
What they have done is they have already specified that this Darcel service are discretionary access
control list.
This is being run as, uh, system user.
They do not show us how to find this one because we don't know when we were doing the boxes.
So what you can do is you can put this card here.
And if you run this and it would give you are the services which other rerate access so ensured of,
uh, for our users, you need to define your user.
So what is my username?
That is user.
And now you can see, uh, for the user because we are the user.
And I have quoted for all the services which have the right access for my user and I came up with this
LASO service, so here's what I can.
Ginnie's service Cherney config service start service top.
So that means I can change the configuration of this service and also I can start and stop the service.
So if you do not have this access, then you do have if you do not have this, you need to wait for
the computer to restart.
So we found that, uh, service, which is being written.
So we don't know whether it is running a system or not.
So to check that, we need to see.
So this is a sea manager and see you need to query for the user service.
So it is oh, I think they should give us enough information, so let's go and.
And now you can see the binary partner, so see the escalation for the reverse order.
So I have already changed this one, so I will show you how to change this one.
So type A C config.
So I'm going to ask for configuration for this service.
Now, what continues?
You can change out of these properties.
So one we are interested is one report.
So go to this current Xbox and make the reversal with the added hostname your card next to zero and
the report and output.
That's reverse psychology.
So after that, you make sure you are going on a listening.
So now what, we're going to a config.
Those are reasonable and the property of this service.
So it is binary pot, so we are going to change the binary pot further to our malicious river security.
OK, so you need to put the Backwords rush for this.
Um, Walcott's.
So it's in the process.
So I think they should do it.
So now it has been changed.
Now let's query again, sorry.
Now, you can see the binary part is this one, our money, just money so we can use the net command
to start this one.
So let's run this now, you can see we got the shirt, it's like, who am I?
So we are system.
So what we have done is we have found that there is a service.
We can write the properties of the service.
So you can also start and start that service.
So what we have done is one of the properties Bernadi partner.
So we have changed our dinner party.
So dinner partner with this one subprogram, first National Service and Dirty ACCE.
So we have changed to our malicious bernadi which use the reversal to us and then we hashtag the service.
So let's exert.
So first of all, what we can also use, you can argue for better trees that are right.
So suppressors and show the output and then use the W so W for writable and then backtrace.
So program.
So I want to search for are the territories from the C program files and I want to put that.
Yes, because to search for recursively.
So from there on, what I want to check whether I can write or not.
So you can see there are a lot of.
There are a lot of military, so I think I consider using this username, so we are the user.
So in your windows, you are the user name is at or some other user level.
So you need to put this one.
So for me, the directory I can write is C program files.
So uncoded parts service.
OK, so the D will be doing the next one.
So you can also I think you can also search for Armel Directress.
You go into service so there is no.
So I think we cannot find a service like this, so all we can find the services.
Users.
So this you'll find four hours of users.
So you can see we got a bunch of wineries, so why we why did we get the winners?
Because we did not include the seat.
If you include the Sivewright, it will search only for services.
So you can see now we have got only one service, so I want another take I want to show you is using
the power of.
So there is a partial shutdown in your witness box.
So you can tell that whether the person has been installed using that power shell, shut the door and
maybe use, uh, water table.
So this will give you the latest version and also are the compatible versions.
So if you had a power sharing site, I'll show you one script.
That is the power of that person.
So if you go to Google, you can search for power up and you can download the script.
So in this world that they have provided all the files.
So this is the power of that one.
So I will show you one liner to execute all the functions in the power of.
So partial.
But module, so we want to import the module, so which is the module that is this power of that piece.
So after importing immediately, I want to invoke article so there is the function.
So there is a function inside this part of the screen, what are the text?
So this will call are the functions like Invoker services and insecure service functions and etc..
So I'm going to run this and you can see here Autofill put.
So service executable and argument permission so that we name is the service and the party.
This one.
So we have changed this one, that's for sure, like this modifiable file.
So this is one.
So about also how some functions so you can create the binary on the system itself without the use of
it.
So we'll be doing this.
And later videos when I'm showing the in peace and power up, etc..
So we have also the file permission service.
So that is located at this one.
So I think there are two services so that we file permission services.
So, OK, if they did not cover this one will be trying to do this one, so it's similar to so you can
think of it as an exercise and query for this using the C command and then modify this one to reverse
each one of these.
So there are two subways running on the service permissions, maybe we have only on this one, so,
OK, we'll see what the output of our other functions did.
So always in salt water.
So you can create a fake MSA and you can install that once it will give you reverser.
So this part of it is very helpful when you have the power to shut down the system.
So that's after this video.
We have seen the how to modify the service permissions.