All right so I am back now with the scan and you could see that I have the scan here which is showing
us port twenty one import 80 open.
Now when we look at Port 21 we've got the file transfer protocol.
Now if you recall that just means that we can upload and download files off of the server we're just
transferring files and we can see here that we have anonymous log in via the FTC and the files look
almost like a default IRS Web page.
We've got the IRS start Di HCM and if you've ever seen that you know you're just looking at the hey
this is a web page hasn't been built yet.
You got the welcome dot P and G.
It feels very very welcome page and then we've got port 80 which is you're saying hey it's Microsoft
I guess.
And it's gotten a seven header but it doesn't really say anything about what's on there.
So let's make a quick little journey out to the web server and see at 10 10 that 10 to 5 what we've
got.
And there it is it's a it's a welcome page.
Now if we right click on this and we say save in the jazz you can see the image is actually welcomed
at PSG.
So I have a little hunch when I'm just looking at this scan that we're actually sitting in the web server
directory itself.
Now what we have here is we have port twenty one open and while anonymous logging is bad all we can
do is put in delete files.
It becomes really bad.
We can change that exploit and actually execute a file.
So my hunch is that we can upload something malicious and then execute it with port 80.
So we're going to go ahead and test that out first we're going to just do a quick echo and say this
is a test and I'm going to put that into a file called Test stop tax from here.
I'm going to go ahead and FTB out to the server and I'm going to see if I can upload this file and then
access it.
So I'm going to go ahead and just type in anonymous and try to log in and I'm using anonymous as the
password as well.
We can go ahead and just say put and we'll say test that text.
Now if we go out to the Web once our files uploaded and we say test that text you could see it says
this is a test.
OK.
That works.
So what we're going to do now is now that we know we have execution we can go ahead and get malicious.
We can go with the new tab and what we want to do is we want an ISP ex type exploit.
Now why do I say that because this is an I.S. server we can see if you use lies utilizing something
like appetizer.
We've got ISP dot net obviously it tells us I guess.
So the filing center for that is a aspects.
Now if you've never done this before you can go out to Google and say interpreter payload chichi something
along these lines
and we got this boy payload chichi MSL phenom cheat sheet we'll go ahead and just use the MSF atom chichi
and any sort of web payloads we're looking for something like a S.P. or a SPF.
So this one will work right here creates a simple TCE shell for a as B.
So we're just going to use MSF Adam dash P windows interpreter reverse underscore TGP we'll set our
l host our airport and then our file type.
So that's the kind of syntax we're gonna be using.
You can just follow along with me you don't have to actually go out to that website and copy and paste
everything.
So this is gonna be the initial start of the payload.
We're going to say Windows interpreter reverse underscore DCP for the payload and then we need the L
hosts which I don't know my whole host so I'm gonna go out and say I have config and I am connected
here tend dot 10 to 14 dot for so I'm going to go ahead and use that as my host and then for my airport
I'm just going to say all fours and then remember we're going to need the file type.
So for this I'm going to use ISP X and then we're gonna go ahead and just call it exploit dot A.S.A.P.
X and that should generate a shell for us.
Now once that is generated what we're gonna need to do is we're actually gonna need to load up Meadows
flight
now this course is not going to rely on metal split a lot.
This is just the initial exploit vector and I'm going to show you some initial enumeration that you
can do with metals blight but everything is in be pretty manual moving forward after this little bit.
So let's go ahead and we're going to use multiply exploit exploit multi handlers sorry and we're going
to go ahead and say options.
So we're gonna do is we're gonna set the same payload that we just did.
So we're gonna set payload to Windows.
INTERPRETER And then we're going to say reverse DCP should be able to tab it out now if we go to options.
You could see that automatically sets the airport to the default for 4 4 4.
We also need to set an el host.
So I'm going to set my El hosts to tunnel 0 which is the interface that we are on right now.
So if you're on a different interface or you could set it directly to the IP address and then I'm going
to run this and this is going to setup that listener.
So now we're listening on this port for a reverse connection using VoIP to do so.
So I'm going to go in here and I'm going to reconnect because chances are this is probably timed out.
I'm going to go in here and just reconnect real quick and we're going to upload this file.
So now we're going to put the exploit the ISP X
and with our listener running we're going to go ahead and go out to the web I'm going to close this
out and I'm just going to forward slash exploit ISP X just like this hit enter.
Well let's see what happens okay.
We've got a mature operator session.
So session one is open.
We can say get you idc if that works.
OK.
And we can say sis info and you could see that we are on a windows 7 machine 32 bit or X 86 architecture.
We have a 32 bit interpreter shell and our I.D. here is I guess app pull sash web.
So we are not an administrator we are not a authority system.
So that means we have privileges to escalate.
So we're at the perfect stopping point.
And if this didn't make sense to you maybe you're not ready for this part of the course yet.
Maybe this is a little advanced you might need to go back and do some more studying.
You could check out my other Udemy course as well which is takes this and walks you through a lot more
step by step.
And we'll get you ready for something along these lines.
But this all made sense.
You figured this out already.
We're good to go.
We're good to move on and we're going to start working on these escalations.
So I'm going to see you in the next set of videos where we start talking about enumeration and how we're
going to look at and identify things that can be potentially explicable and allow us to escalate our
approaches.
So I'll see you over in the next video.