All right.
For the first half of the video I kind of just want you to watch.
And then when we get into the second half of the video you can go ahead and partake in what I'm going
to be showing you.
So the one thing I do want you to do is go ahead.
If you're in amateur spirit or shell go ahead and change your directory and change it to see Windows
temp and make sure you do your escaping like this and I've gone ahead and downloaded a couple different
tools.
One tool that I've downloaded is win peace.
So I'm going to go ahead and upload one piece and I'm going to just say as upload and I just lost my
shell.
So let me go ahead and run that really quick and read.
Pop the shell and we're going to upload it and let's see that present working directory when they change
it one more time.
So Windows temp and what we're gonna do is we're gonna upload I've got it and route downloads and then
I've got one piece here.
And this is the X 86 version.
So then I'm just gonna drop into a shell and I'm going to try to run this and I'm gonna go ahead and
just say when these dot e XY and nothing happens why is nothing happening because it's likely that we
do not have the 4.0 version of dot net 4.0 or greater.
So we're likely encountering an error.
Nothing is happening here we don't see all the pretty colors or anything that we saw before.
All right that's fine.
Well what about a tool like power up.
I could probably run power up.
Well let me see if I can get into a power shall row.
So do power shall execution policy bypass and then it just hangs so I can type of command.
Who am I.
Anything.
Is going to happen here.
So we see sometimes in shells like this where this just hangs.
So that's fine.
OK.
Well maybe I can go back and in return fritter.
They have a load power shall feature so I can load power shell load the power up file that I have and
just give it a go that way while I try to load power shell and look what happens to me it kills my interpreter
session.
That's not very nice.
So now I've got to go get another more typewritten session.
So what we're what we're up against here is we don't have the capability to run a executable.
We don't have the capability to run a more interpreter power shell.
So we're gonna have to get creative.
There's other tools out there.
I just showed you four different ways to do this.
So the first thing we're gonna do We're gonna get our shell back
and then what we're gonna do is we're going to run the Post exploit module from Medavoy.
That is a cinch yester.
So what we're gonna do here is we're just going to type right in here is a run post and we can autocomplete
this
and then we just say post multi recon local exploit suggest her
and it's going to collect all the data from this box potential exploits here.
I'm going to open up a text editor because I'm going to save this out and I'm actually gonna open up
a couple of tabs because there's a couple things I want to do.
We're also going to drop into this box and we're going to grab system info.
So while this is running what I want you to do is I also want you to come in here and I want you to
come into the A on cyber here.
And so this is the windows explode suggested pi.
Go ahead and download this if you need to just go to Google go to get hub windows explode to gesture.
Again this was provided in last video.
Now all we're gonna do is just clone or download this.
We're gonna download the zip and we're going to open with.
And in case I did not make it clear make sure that you run this as well.
So now we're hands on we're doing other checks but you can see here that look at all the different things
that it comes back with as potentially vulnerable.
This is a lot and these are all for the most part here what are called kernel exploits and we'll get
to those in a little bit.
So right now we're just collecting information.
OK we're just running our tools.
We'll get to the kernel exploit portion in just a minute but we have a lot of options right.
A lot of options here.
And what we're gonna do is we're going to save these out.
I just want to copy these and then we'll also get information from our other tool.
So we need to go into a shell and we just need to pull down system info like this OK.
Just type in system info.
Go ahead and scroll up and copy everything and then paste it into a document and you can just save that
out so go ahead and save this it's gonna ask you what do you want to save it as.
And we're going to save it as well as calls this info dot t t OK.
And we're also going to extract the zip that we have so let's go ahead and extract the windows explains
the gesture into our route and if we go to the get hub again.
We scroll down a little bit.
It says hey you need to run the expo suggestion that pie with update.
So I'm going to copy this.
We're going to update the database so let's open up a new tab and I'm going to adjust to this.
I'm going to C.D. to my route or wherever you save the file.
I'm just going to paste this.
So again dash dash update it says hey we've updated.
OK what's the next step it's going to say hey what's the database.
So we need the database and whatever that database just was we also need to install the dependencies
actually.
So we're going to do install Python Excel already which is going to be pip install Excel D upgrade.
So go ahead copy and paste that.
Now you might have issues with Pip being installed if you don't already have pip installed.
So I'm going to go ahead and copy out a one liner for you guys that I utilize to install Pip.
You might be able to use Pip 3 but just in case here is that one liner OK I'm pasting it here.
So it's going to be a curl and then we're going to say h G.P.S. double that slash slash bootstrap dot
pie P.A. I Io forward slash get dash pepped up pie a dash oh we're going to do a get dash pepped up
pie semicolon here and they're going to say Python get dash Pip dot pie.
Now I'll try running this.
I've already got pip installed.
You're going to see that it says hey successfully installing Pip.
That's fine.
Or just overrode it.
So make sure you install that.
If you do have a pip issue on your machine if you're to have pip installed that's great.
And then we're also going to do the pip install Excel R.D. dash dash upgrade.
OK.
So now from here.
Make sure you know what database you have.
So we've got the Excel x x here or the Excel s sorry.
So we're gonna say Windows explode to gestured up pi and we're going to follow the syntax that I have.
So when you add dash dash database dash database and then we're going to say see it saved it out here
20 20.
It did.
And we also need to know the dash dash system info.
So we're gonna say a dash system info and we'll say sis info dot DSD.
Just like this.
So go ahead and run this and send a go and try to collect this.
See what vulnerabilities are out there that might exist.
And the nice thing is it updates like we have an updated database here and we know exactly what we're
up against.
So even more modern updates are more modern exploits may fall into here.
So identified Windows 7 32 bit.
And you can see that it came up with some vulnerabilities for us to try as well.
So we have different vulnerabilities we can look up these different M.S. 0 1 0 or 1 0 0 1 5 for example
0 forty seven and see what's in here and you can see a lot of these say hey Windows kernel Windows kernel
Windows kernel.
Well that's a little bit of foreshadowing we're gonna get there here in just a second.
So here's the takeaway.
Let's let's take away in a big summary.
There are a million tools that you can use out there.
One piece is probably my favorite because it's just an executable that you can go out there and run
but as you saw when pieces and work all the time.
OK.
Maybe we need to try something like power up power up to a great tool as well.
I would use when user power up first.
If you can't get power shell if you can't get the executable to work OK there's still options.
If you're in an environment where you don't have medicinally you can't use medicinally.
Then you don't use metabolite.
You don't have the suggestion.
That's OK.
There's this suggestion you run system info you pull it down you get this.
There may be roadblocks.
There's there's.
OK.
There's always gonna be roadblocks in Windows privacy.
Any privacy is very difficult and a lot of the times they make it intentionally difficult.
They put an intentional roadblock.
So make sure that you know there's other options there's always other path.
This box is vulnerable.
It's meant to be exploited.
You're going to figure it out.
So the big takeaway.
No your tools have good notes.
Again as always have good notes.
Write this stuff down notate all the tools go play with them play with them now put them in a lab environment
try on your computer do what ever you need to do but play with these tools understand what they do why
they're doing what they're doing.
OK.
So take advantage of your time there.
No need to rush through this.
Go play with these tools run them on on Hack the box run them on anything run them on the CTF run on
at home.
Figure out what they do and utilize them.
Now in the next section we're going to start working on our exploits we're going to start talking about
kernel exploitation and kind of just going from there.
So we're starting to get into all the privilege escalation tactics were out of the enumeration portion
and I'm ready because we're about to start firing through all kinds of boxes and learning different
tips and tricks and it's it's really exciting.
So I'm excited to see you over the next video when we we root this box a couple different ways and then
we'll move on to the next one and keep going from there.
So I'll catch you over in the next section.