OK so let's look at our end map scan.
We don't have a lot here to go with.
We have this a chat system and then we have an chat chat system here.
Looks like this is over HDP.
And then there's an a chat here.
So the first thing we might do is just something quick like search flight and say hey what's a chat.
And we can also of course go over to the actual exploit itself and see what's running so or we can go
over to the web page itself and see what's running.
But here we can see there is a remote buffer overflow.
There is one in medicinally and there's also a manual one this 3 6 0 2 5 dot pi.
So if we go ahead and we just we can copy over the user share exploit database and then we'll do exploit
windows remote and then 3 6 0 2 5 Pi.
And again if you don't see that path the path is right here up top and then the rest of the path is
right here.
So I'm going to copy that and I'm going to just copy it here.
I'll just call it three up pi so we'll put this in our directory and then if we go ahead and just get
it or whatever your favorite editor is and just look at this we can see the actual exploit itself.
So this is a buffer overflow exploit and it looks like a very very typical buffer overflow.
They actually give us the MSF venom here and before we dive in and we just say hey we're for sure on
this we can make sure and go check out and see if there's any more information on this just before going
through all the trouble in firing away so we might just go out to Google and we might just say something
along lines of a chat exploit and see what's out there.
So we've got this one here we can open it up see if it's any different.
This is 3 6 year to five it doesn't provide any information sometimes at the top it tells you hey there's
you know this is a buffer overflow exploit and a little bit more information on that.
I don't see anything here.
Rapid 7 does have something on it.
We're going to avoid using my display for this one but it says this exploits a unicode SDH buffer overflow
and a chat.
So by sending your craft a message to default port 9 to 5 6 UDP it's possible to overwrite the SDH a
handler.
So this is running on Windows XP Service Pack 3 and Windows 7 that it's been tested on so if we go back
to our scan let's see if it tells us anything about the OS.
Guess it's guessing Windows 8.
Some store windows version but it doesn't know exactly what it is.
So there's nothing reliable there either.
So we don't have a lot to really go off of.
We can also go over to the chat itself.
So if it is living on port nine to five five we can go and look at that really quick and see what's
there.
So we can just go HPD over that slash slash ten ten ten seventy four and then nine to five five and
see if that takes us anywhere which it doesn't look like a dead try one more time.
Ten ten ten seventy four and then nine to five five or copy that just in case but it looks like it's
not going anywhere for us.
So so we can't access the page there's not much going on even the site doesn't have a title so it looks
like there's nothing really there.
So we kind of just have to have to make a guess at this and see what we can figure out.
I so I'm going to go with the buffer overflow exploit and we'll see what we can do.
So I got it open in get it.
Now the thing that I see here is they have a platform Windows architecture x eighty six that's fine.
But the payloads is execute which executes a character EMC so wherever they're running it just pops
a calculator out.
So it's not really what we want but they have gone through and if you're familiar with buffer overflows
it's gone through and just done the bad characters for us.
Which is really nice.
So we'll have to worry about bad characters or any of this and they give us a command kind of.
So what we can do is we can just modify this command a little bit.
We can just say windows and then we'll just say something like shall reverse TCB.
It's like Shell reverse TCB and then instead of Calcutta you EMC we're going to take that out and then
we'll do l host is equal to your IP address of mine right now is 10 dot 10 to 14 not four and then we'll
do an outpour.
I'm going to it's going to choose four for three.
The encoding and everything else is fine.
We just want this to pop a reverse shell.
So I'm gonna copy this and I'm going to go ahead and just open up a new tab and make this bigger for
you guys and I'll go ahead and just hit enter.
This should generate some shortcut for us.
So again we're doing architecture of x eighty six platform Windows and then we're doing the windows
shell reverse DCP.
So we're gonna have to run net cat here in a second.
So let's go ahead and copy this down.
And paste it in.
I'm just gonna replace what's in here
it's a little bit larger of code.
They had 512 on the bytes.
Let's see what we ended up having seven seventy four.
So hopefully that doesn't mess with the address space we should be OK but we'll we'll take a look at
the end of this and if it doesn't work maybe we'll have to adjust it but we'll come through here if
we scroll down.
We've got to create a UDP socket.
So we have to go over to the UDP address itself.
We're gonna go and navigate to 10 10 ten seventy four and I'm going to go ahead and just save this out.
So this is going to make the connection.
It's going to do a little bit of this code and then it's going to inject the buff here for the code
and do a little bit more advance of a buffer overflow.
This is a 32 bit SDH bypass so it's the next step above.
If you have seen like the Volm server exploits or something along those lines it's just the next step
above that with the SDH bypassing.
So we're gonna go ahead and just try to fire this one off.
So what we're gonna do is we're gonna run net cat here and we'll do NBL P A 4 for 3 and we're also going
to just go ahead and try running Python 3D up high.
Now big caveat to this box and you may have run into some issues with it is that if you're not the first
one to run this exploit against this and it doesn't work then there's a chance that somebody else has
done it.
You only get one chance when trying to say you get one chance and this exploit.
So if it doesn't work get to reset your box or if it works and you lose a Shell or whatever you have
to reset your box that's the only unfortunate thing about this one.
So go ahead and run this.
See if we get any kind of shell we got a connect.
We've got a connect from my machine.
Let me turn this one off.
Sorry and let's go ahead and run this one more time.
There we go.
So sorry I was trying out some exploits earlier from a windows 7 machine.
So OK we've got the connection here we ran it.
We're good to go.
So now if we say who am I.
You can see we are Chatterbox Alfred we are not system on this machine.
So we need to improve upon that.
All right.
So from here I'm going to go ahead and hit pause and we're going to move on to the next step which is
going to be the escalation.
So what we're gonna do is we're going to escalate this machine again if you want to give it a go.
I have full faith at this point that you could do it again you can use this privilege escalation guide
follow everything down to the point of this net start with blink.
So if you can kind of piece it together look at the the net start running on the machine look at the
ports that are open and then hunt some passwords down since this is password hunting section it's a
little bit of a hint and see if you can figure it out and then I will catch you over in the next video
when we walk through the rest of the steps.