All right.
Let's look at our end map scan here.
We've got three ports that return back.
We've got a GDP on port 80.
We've got HP port Port 88 0 8 and then we've got S&P on Port forty five.
Now we see Microsoft I ask which is telling this.
This is a Windows machine and we see the S&P enumeration here which says Windows 10 enterprise that
we scroll down a little bit.
It also says hey Windows 10 enterprise six point three we've got 17 134.
So got a little bit of US information right here.
We're looking for any sort of exploit related to that.
We also see the computer name is SEC notes and we've got the workgroup of H G B for hack the box.
So the thing that we should probably do is go out and try to explore these web pages and then we'll
leave 445 for a later time though what we can do with four or forty five if we want to do some basic
enumeration is we can come out here and I'm sort of closed out of my tabs and we're going to say we
need to say S&P client we'll do a quick dash L for a list and then all this give it a 10 10 10 ninety
seven.
See if we can list this out.
Hit enter and we get access denied.
So that's why we're not going to enumerate S&P first.
Now let's go to port 80 because it does look like it has a log in page here where Port 88 0 8 just has
a basic I guess windows titled page.
So let's first explore port 80 so if we go to 10 that 10 that 10 that 97 we could see we are given a
log in page and it says hey give us your logging credentials and go ahead and log in.
Well if you don't have an account try to sign up.
So let's just sign up for an account and see what's going on inside.
We'll say TCM.
I'll give it a password or TCM twice and password must be six characters length all TCM 1 2 THREE OK
let's try logging with that
and we can see that we're viewing secure notes for TCM it looks like we can create some notes maybe
chest and then put a test note in here and save it.
OK so we've got our test no we can change our password we can sign out and then there's a contact us
where we can send a message to this Tyler at SEC notes that HDTV.
So this looks like we have a user name enumeration here we can say hey at least we know the user's name
is Tyler.
So it might help us a little bit later on when I see a log in page.
I'm immediately thinking some sort of sequel injection exists here.
So I'm gonna go try that first and I might just try something first on the log in page like a quick
one or one equals one and then something like this and see if that works and just use that ball fields
no account found with that username and we could even try.
Just like a just to generate an error here and it's saying no account found that user name.
OK.
So maybe we don't have sequence injection here or maybe we just run this through something like burp
intruder and try to see if we can get some sort of different response to come through.
But just for the sake of time for the sake of this class we don't have secret injection on this page
itself where the sequel injection actually exists is on the sign up page which would be the next place
to try.
So when we're doing any kind of web app testing and this is real world experience here if we're doing
any kind of web app testing I want to see what kind of malicious items I can dump into these pages and
get something back.
So I'm looking at if I can maybe create even like a script alert one for example if I'm testing a Web
site if I'm allowed to make a username like that and then I log in and there's cross-eyed scripting
that pops up.
That's not good.
Same thing goes for sequel injection.
What if I did something like one or one like this which is just a common payload.
And you again can run through the different payloads and see what works.
So you can take something like burp intruder and we can open it up and do an example here where we say
hey I want to create something and I'm just going to hit.
OK.
And you should be familiar with Bursley by this point so I'm not going to give you the full walkthrough
but we can start brb sweep and we can go ahead and just use something like Foxy proxy to turn on our
proxy.
All this is doing if you've never seen Foxy proxy before is going and doing our settings for us.
So like our preferences typically for burp sweet we would have to manually intercept 1 2 7 0.01 on 80
80 now Foxy proxy just allows us to go in here and say hey that's exactly what I want to do with this
burp sweet.
I just want to 1 2 7 0 0 0 not 1 on poor 80 80 and it will just set it for us.
So here's a quick flip of a switch instead of having to go to preferences dig in etc. so we can come
in here and we can say OK I want to do this and I'm going to do a password and confirm of the same.
And I'll just go ahead and intercept this request you'll see it goes into burp sweet and we can decide
to forward this or do whatever we want with it.
So I can send this to intruder and I could say something like just as an example I can give it different
parameters so I can clear all of these and we can say hey I want to do one two three here just for the
confirm and we'll say OK for the payloads what I want to set all the payloads to is this equal injection
so maybe I do or 1 or 1 or we do like the one we just saw where one or one equals one dash dash dash.
And with this sniper attack what it's gonna do is it's going to go ahead and just try to create a user
name in all these fields.
So it's gonna put this one payload that we set for all the fields that are set here.
If we wanted to do other attacks you could do like a pitchfork where we'd have three different payloads
for example and we'd say Hey payload one or position one we're gonna put here and then we're going to
go say for bailout two we'll put something else but for this I just want them all to be the same so
I'm going to go ahead and do a sniper attack and then I'm just gonna start the attack and it's gonna
say Hey brb sweet takes its sweet time for this and that is what it is you know because it's we're on
the community edition so we could look at the response and see what happens.
The user name is already taken.
That's OK.
Somebody is probably already been on this box.
No worries about that part.
Same thing with this one.
Looks like people were trying this.
That's OK if you're getting the usernames already taken.
Don't worry about it on this.
Eighteen fifty four you could see the payload changed slightly but it says the usernames already taken
as well.
So we're just going to do the manual method.
I'm going to go ahead and just turn the intercept off.
It's going to say that this username is already taken as well.
I'm going to go ahead and just go back to the home page and we're gonna try to log in with this injected
account and you can see now it says revering secure notes 4 or 1 or and.
Right.
So we're ending something here we're saying or 1 or and then we're starting something which just completely
removes everything else and we're getting the information for everybody.
You can see the test note that I made here for nineteen twenty twenty.
We could see the many sticky buns ingredients.
We're getting all the database draft out for us.
And here we can see that there is a sec notes that HDTV backslash new dash site looks like a SMB folder.
We've got Tyler and then it looks like credentials here.
So that's good.
And so we've just basically done sequel injection and gone into this Web site dump these credentials
out and now we can utilize them to try to get a shell on this machine so what I've gone ahead and done
is I'm going to go ahead and try P.S. exact for example just in case you want to know here's a P.S.
exact pie from the impact impact tool kit.
Yes exact pie.
And we're just going to say hey I want to connect let's do a dash dash help.
And this is just to prove a point here you don't have to follow along and we're going to say OK we need
a username and password and then IP address.
So I'm going to supply Tyler and then I'm going to supply the password which is on this page
and I'm going to put that in quotes and then I'm going to supply the IP address of 10 that turned out
10 got ninety seven.
I will try to run this area see OK.
Adnan's not right.
Well he's not in Amman.
C is not right.
L found a rateable share uploading a file and it's not able to open it up.
It's trying.
It's not able open up sometimes a series out.
I'll give it a second go.
But for me this wasn't working.
So this is like a quick win.
I'm just thinking hey maybe P.S. exact I can upload some sort of malware.
Get on the machine and go.
Maybe there's antivirus or something blocking this or I like Windows Defender or something along those
lines is saying nope you can't do this sort of attack.
I'm going to go ahead and block this attack.
So we're not getting in here.
Other route that we can take is we can go explore the new site and see what's there.
So let's go ahead and just try that we'll say S&P client and we'll go ahead and just do something along
these lines 10 dot 10 that ten point ninety seven and we'll see a new site and then we'll just provide
a user name of Tyler just like that.
Going to ask for Tyler's password which is right here I'm going to copy that again and paste it here.
OK.
And we got it.
Now let's just do a quick Les now.
We've got this.
I start in this I guess that PMG which reminds me of a default home page similar to Devil from beginning
of the course.
Right well where did we kind of maybe see that already if we go back to our map scan you could see that
we saw possibly a default I page overrun 88 0 8.
So if we go look at 88 0 8 we can maybe confirm that.
So let's go ahead just do 88 0 8 here and see what's going on.
OK.
So we do have a default page now to skip a step the wheel spinning in your mind you're probably thinking
well maybe I could just do a medicinal payload try to run that get to go with it aspects and I tried
that as well.
It does not work.
So we have to think outside the box now something is going in there and deleting things very very quickly.
It could be antivirus again there could be a script running saying hey delete everything out of this
that you know doesn't belong here.
I'm guessing we're probably up against some sort of antivirus but we're not sure at this point.
So what we can do is you could say well we're in here.
Maybe I can upload something like net cat and then just run a malicious BHP shell or something along
those lines.
So if you've never seen this before.
Let me walk you through it.
So on your box your Cally machine you have the neck cat.
You can do a quick locate neck cat EMC and you can see we've got this user share windows resources binaries
net cat that we've talked about this in the past right.
Well let's go ahead and do something like this.
We'll do a copy paste and we'll say just neck cat the EMC right into the root folder which are just
copying this binary into our route and then we're just going to go over to this SMB which we launched
in route Amazon to say put net cat dot XY
and then what we can do is we can go ahead and use a malicious BHP file.
So I've gone ahead and created one.
Let's go ahead and check it out.
So I've called it just a that BHP reverse step BHP and we can go ahead and just look at the command.
So we're gonna say Hey when we run this go ahead and execute something on the system and you're going
to execute net cat you see we're going to execute the command at EMC and we're going to say 10 dot 10
to 14 dot five.
That's my IP address and then I'm going to listen on 4 4 4 4.
It's going to be a basic reverse shell written in P P.
OK.
So go ahead and get that typed out.
Pause if you need to.
I'm going to go ahead and just close out I I'VE ALREADY GOT IT SAVED AND THEN WE'RE GOING TO RUN THIS.
SO WHAT WE'RE GONNA DO IS WE'RE GOING TO DO A QUICK alas make sure our net cat still there it is.
I'm gonna put in this reverse stock p p and I'm going to run a net cat listener.
So NBL DLP four four four four.
We're listening.
I'm going to go to the Web page and I'm just gonna do a quick read that BHP and it's stalling which
is usually a good sign when come in and you could see.
OK.
Hey we're at C iiNet pub new site.
Do you click.
Who am I.
SEC notes Tyler.
And then we can just do a quick system info go a little bit information about this computer etc. But
what we've done up to this point is we have now gotten access o look system info is actually denied.
Let's see a quick query to see if we're up against when defend well it might be up against Gerri it
is running so the windows 10 version of of this is probably doing a lot better job than the Windows
7 that we've seen the past so there's a good chance that we're actually getting some sort of some sort
of antivirus that we're up against.
But from here I want you to do a little bit of thinking outside the box on your own.
I really do believe with the little bit of guidance from this article this is the payloads all the things
again from your course resources.
Look at this look at this closely utilised commands that you can run against the machine to find where
Bashar XY exists or w SL that e XY exist.
Figure out how that might work for you and how you can utilize this and see what level route use your
eye or what level of user you are going to give it away.
You're going to be rude but do a little bit of enumeration try to get into the system itself and go
from there see if you could figure out how to find your way to escalate privileges into system.
I have faith in you however in the next video we are going to walk through this and I'll show you exactly
how to find this file how we're going to abuse it and how we're going to elevate privileges.
OK so I'll see you over in the next video.