All right.
So here we are at our telnet session.
Now when we spoke in the last video we talked about the command key slash list being the big hint of
what we need to do and when we talk about methodology this is just another tool to add to your toolkit.
From here there's a lot of different paths that we can take.
We can utilize this telnet session which is a shell and utilize this to navigate around perhaps we can
try to run some sort of power shell or run a tool like wind peas or like power up etc. see what the
lay of the land is.
We can absolutely even just look for hints around the environment itself.
We can navigate see if there's anything in the security folder or this user of security their desktop
documents.
If there's anything in the program files we're going to do our due diligence and kind of just will work
down a checklist.
And that's the point we're at is we're just working on a checklist.
So even though I show you the escalation path here it's just to show you a tool for your toolkit.
So keep this in mind again from the very first or second video I so told you to take good notes.
Add this to your notes.
OK.
So what we're looking at is a command key forward slash list.
If I could type its command key for its socialist and you're going to see here that we have currently
store credentials of the target of access administrator.
So that's great.
And we have a domain password stored.
So we're going to use a tool called run as Dot EMC which is built into windows.
Now I'm going to copy a command because you just saw what happened when I fat fingered this and I fat
finger all the time.
So I'm going to copy the command and then you can just copy this as well while I'm speaking about it.
So what the command is is we're going to run system 30 to run as that EMC and we're gonna say hey I
want to use the user access administrator and with this user of access administrator I want to run the
save creds save create is just hey I'm going to use the same credentials that are here for me.
We're going to run command EMC a forward slash see and then we're going to just copy over the route
text.
We're going to type it out.
This is basically an echo command we're gonna type out the command and drop it into the security folder
of route texts.
Now there's a lot of different ways that we can do this.
We could say hey I want to run commando AC and just run a copy and we can copy the file over.
So we have options right.
So the type commands just one way of doing this.
Now we're using full parts here.
There's a chance that we could just use run as that XY and command XY which is always good just practice
with using full path in case the path isn't there.
So if you were to come in here and try this and it doesn't give you any inclination in whether or not
it's working or not or whether or not the the run as is working at all then you might lose your mind
and say you know I'm sure this is it but maybe there's a different path out there and just abandon ship.
So you don't want to you don't want to do that you want to make sure that you call the full pass just
to be safe.
So here we are if we hit enter on this and we just now type in Dir you could see we've grabbed this
route that takes.
And we could prove concept by just doing a type here if we say type route that takes and see if this
works on the avenue we should get access denied so access is denied but now we've copy that file why
because we're acting as the administrator on this machine.
And that's really the big takeaway is if you have the ability to run as you've a lot of flexibility
you can run different commands.
We ran a command that you see with a flashy imagine the flexibility and types of commands that you can
run just because we did a type here or we could do a copy doesn't mean we can't do other commands here
that could be beneficial to us.
So hopefully that gets your wheels spinning as to how powerful this is.
You could think of this just as like a pseudo command.
I'm going to run sudo as this user.
So if you're familiar with Linux same thing we're running as a user the only benefit here is we don't
have to have the credentials they're stored for us.
So it's super nice.
So that's it for this lesson.
I'll catch you over in the next section.