OK so this segment is a hands off segment and it's just to show you one of the features of Metis flight.
Now this is just a shell that I have on a local windows 7 machine here they called Windows 7 privacy.
Now there is a built in tool that I have not shown you yet because I wanted to get through the impersonation
and the other who am I.
Such privileges.
Just so you understand those privileges first.
So now that we have an understanding of that I can show you this technique.
Now the technique is called Get system.
Now we run it and you can see that it tries to elevate the system in a few different ways.
It tries two different types of name pipe impersonations and it tries a token duplication.
Now if we do a get system dash h it tells you hey you can run this and run all three as zero.
Or we can do a dash T and run one or three or two or however we want to do this.
Now what is happening when we run this get system and when should we attempt it.
That's important as well.
If you're on a box say just capture the flag type box running get system number Hertz.
If I pop onto a machine and I run get system and it works great.
Game Over Easy win.
OK.
If you're in a real environment not so much in this might come up in an interview where you might need
to know what this is actually doing so it doesn't hurt to understand.
So I kind of want to point this out.
It's just a real quick easy way to try to get win but you should know what you're doing.
So there's a great blog from Cobalt strike that talks about what happens when you type get system.
Now there are two techniques that are pretty much the same.
There is the name pipe impersonation.
OK.
So we are impersonating and we're going to try to impersonate into system.
All right.
So it's going to create a pipe when it is spawned the command that you seek next to maturity is named
pipe interpreter has the opportunity to impersonate that security contacts that's technique one technique
to identical except that it drops in to disk.
So drops on disk.
So it is recommended not to run this because this can actually get caught by antivirus.
You don't want to run this or get detected then I would just skip running to completely.
But it does run on desk drops a DL out to the disk and schedules a run dial up 30 to 60 as a service.
You try to elevate here now technique three takes advantage of something else the SC debug privilege.
OK.
So it loops are all the open services that is running and tries to find when running a system and that
you have permissions to inject into.
So if you have all this enabled here then you're able to inject and it's going to attempt to get the
system for you as well.
So you show a little bit of a deeper understanding as to what's going on as opposed to just like hey
firing this off and letting it run.
So if you're ever asked you know what are you doing when you run get system say Hey there's two different
types of named pipe and impersonation ones in memory and ones actually on disk and I probably shouldn't
run that one.
And then number three is this token duplication and it requires that as he debug privilege to be enabled
and you go into a lot more depth.
OK so keep going into depth on these learn read take good notes understand these at a deeper level but
don't just fire willy nilly without knowing what you're doing and the reasoning behind it.
So this is the get system great technique to try especially on again these Capture the Flag systems
but avoid just running this on any system that you have if you're doing a pen test for example and this
could actually crash a machine so you should be very careful when you're running this.
So that's it for this lesson.
So I'll catch you over in the next section.