All right.
Let's do this the manual way.
So remember we generated a payload with MSF venom and we utilized that to get a mature printer shell.
This time we're going to use utilize it to get a basic net cat shell.
So I'm going to do is a mistake MSF venom and I'm going to say a payload of windows and then just shell
reverse TCB.
I'm going to give it an L hose so turned out turned up 14 to 5 which is my current L hose at this time.
And then I'll pour all the stick with 4 4 4.
Remember the file type again is aspects because we're up against an IRS server and I'm going to put
this into something called manual SB X and we'll let that generate now at the same time.
We're gonna go ahead and go over to this new tab and I'm just gonna make a connection to the machine
turned up turned up 10 to 5 on F.
Remember we have anonymous log in so I'm going to log in and then I'm going to just go ahead and just
put the manual aspects there we can go to a new tab and what I'm going to do is I'm just gonna run net
cat NBL P all four so we're setting up a listener on all fours here and I'm going to go out to Firefox.
We're gonna go and just say hey 10 10 10 to a five and then manual dot ISP X look at our connection
and hey we've got a connection we're not using Midas plate whatsoever.
So we do a click.
Who am I.
And you could see that we are the I S app pool OK.
So we know that this is a kernel exploit and we're going to take the alternate path.
Now I showed you how to run the Windows exploit suggests her well with Windows explains the gesture
when we ran that what came back for us.
Well we've got a bunch of these different potential kernel exploits.
We've got some Internet Explorer exploits.
I wouldn't look at these.
I would start right away with the kernel exploits and kind of work my way up from the bottom of the
list so we can go and just say something like M.S. 10 dash 0 1 5 exploit and you're going to see what
that's going to actually bring up so we'll do M.S. 10 dash 0 1 5 exploit
and it's gonna bring up the windows kernel exploits the SEC quickie.
So look at that.
So if we look at this one guess what it is it is.
Get your pod the one we actually ran before now we're not going to be able to actually run this one.
If we take a look at the proof of concept the proof of concept shows a shell spawning and then we actually
spawn a new command prompt utilizing the executable that they're giving.
So they're providing this executable.
It pops a new shell and in this shell your authority system.
We're not on a machine that is capable of getting a new shell.
We're not on like RTP or anything like that where we have a gooey interface.
So we just kind of have to deal with the shell that we're given which is just this basic shell here.
So we need to pop something that can run inline on the shell.
So that one's out of the question so we can start working our way up.
We can look at 0 forty seven and zero fifty nine.
So if we go to zero forty seven in this list and I just like to look through this list because it has
compiled exploits already and you see forty seven does it exist the fifty nine does something to click
on fifty nine and there's just this juror Skeeter dot sees it and there's not really much on the read
me it shows you the tourists Quito the EFC how to run this you can looks like you can run a commander
AKC and get a net user and add a user that's one way of doing it.
So what about we look this up M.S. 10 dash 0 5 9.
We'll see what exactly this is.
I'll type and exploit me there's more information on it somewhere so Jimmy Cherry is the other name
for it and this is a very well known exploit as Jimmy Cherry We can look at the exploit database as
well and just see what kind of information we can find about it so we can look at a screenshot that
PMG and see what they've got here so if you look at this it runs a Jimmy cherry and it says this exploit
gives you local system shell usage is Jimmy Cherry IP address port so then it says OK tributary to XY
port eight thousand and then you can open up a another port here for a thousand and establish a connection
as well so we'll take a look at how this is gonna work we'll see if this has any information on the
chimney Cherry itself either it does not.
So what it looks like we need to do is it looks like we need to provide an IP address which is hiding
here tell it what port we want to connect back on and it's just like a reverse shell.
So we're going to go ahead and just give this one a try and see if this exploit works and if you want
to do more research on it you can absolutely go out to Google and just say Jimmy Cherry exploit
and see what information you can pull down there's the MSE or 9 0 1 2 as well for this what so what
we're gonna do is we're going to download out this M.S. 10 0 5 9 exploit.
When I click on it I'm going to download it.
Say that and looks like we've got contains malware.
I'm going to go ahead and just go open which should store on your computer if you see that error.
So from here I'm going to see these over to my downloads folder and I'm going to do a quick Python dash
and simple HP server.
And if you want to run in Python 3 you can as well.
Remember that's Python 3 dash m h TGP dot server.
So we're gonna do here is now we're loading up our basic server we're going to go ahead and just make
a simple get request.
So we're gonna say let's go to maybe see we'll dot dot will dot dot.
One more time and we'll the C.D. And the tenth.
Let's see if we can write into 10.
So we'll do a cert you tell and we're going to use this to transfer files it's just like W get.
So we're going to say start you till you're all cash and we'll do a file and we'll say HBP double dot
slash slash 10 10 14 dot five whatever your IP address is and then we're going to say m s dash 10 that's
0 5 9 you see I do believe and I'll just call this MSR XY when I bring it over.
Let's see if it actually gets that file
it's taking just a little bit here and looks like it has got the files successfully.
So now if we do a quick Dir.
Let's see if the files in here and mess that EMC does exist.
So if we say MSR that EMC it says this exploit gives you a local system shell usage MSA XY IP address
port okay.
So I'm going to say MSA EMC my IP address is turned out 10 to 14 to 5.
And let's just call the port all fives and what I'll do is I'll go ahead and open up another net cat
on all fives and then we're going to go ahead and just hit enter.
Cross our fingers.
Say who am I.
We are authorities system.
I love Colonel explains they're so easy.
So again we had the ability here to look through.
We lost it.
There it is to look through this Windows X voice suggests.
And this is just another tool set right.
So we didn't have the ability for the other tools when we were doing our normal nation we didn't have
the ability for any sort of power shell or any XY.
So we utilized Metis boy and we utilize their suggestions and they had the ability to run kit your pod.
We did not.
So this easy easy one.
The kitchen pod is really nice and meets boy.
Not so nice on its own but we look through the list and we find one that kind of works for us.
I again like this this.
Windows kernel exploits SEC wiki because you can just come through it has it already compiled for you.
And super easy to to run and run against a machine.
Usually they have a little bit more information than these but the cherry exploit has been around for
quite some time.
It's one that I'm very familiar with and you'll see come up again.
So keep that in mind if you see a box vulnerable to M.S. 10 0 5 9.
Chances are you can probably run that exploit and give it a go.
Worst thing that's going to happen is you're going to try it and it's not going to work.
And then you move on to the next one but I would work my way up from the bottom list you'll come up
with your own sort of methodologies and your familiarization as you go you can see most of these where
Internet Explorer related anyway but we're interested in anything that is kernel related that could
have escalated privileges.
So there are only a few options in total so that's it for this lesson we were able to take a completely
medicinal portable walkthrough and turn it into a completely manual walkthrough utilizing the same sort
of tool sets.
So from here what we're gonna do is we're going to start looking at another escalation path which is
passwords and it's gonna be a pretty fun box.
We're going to move on and take a look at that escalation path and take down another machine on Hack
box so I'll see you over in the next section.