All right.
Next up is actually a service escalation dealing with the registry.
So we're going to be doing is we're going to be looking at the reg service which is the registry service
and we're going to see if we have full control over a registry key if we do have full control over that
registry key.
Well we can do is we can compile a malicious executable that's written in C and we're going to make
the executable run a command.
Now the command that we're going to make it run is we're going to say hey I want to add this user to
a group and that's it.
So we're going to just run a local group administrator's user ad from there.
We're going to run it and you'll see how this all works.
So let's get the setup going.
We'll talk about the enumeration that will actually perform the exploitation.
So let's do the detection and first let's copy this.
Get ACL come in now get ACL is a command that is built into power shell so we're getting the access
control list for this registry itself.
So we're going to look at the registry entry.
So if we come back here and we just say let's just open a new command actually we'll put a command and
we'll say power shall execution policy bypass and we'll run this pasted in there and again I'm having
copy issues so I grab that one more time
paste in here.
Fingers crossed it works.
OK.
All right.
And now we come into here and we can see that we have the authority interactive allow full control.
That's us.
So for the authority interactive that is us we're not a authority system right now nothing but we do
have complete full control over this.
So what can we do with this full control.
Well we can maliciously add this executable to a service and then start or start that service that service
will then come back and add a user for us.
So we could do a lot of things with it again we can get a reverse shell this time we're going to add
a user you're going to see how this works.
So from here let's go ahead and pause.
The big takeaway is I want you to know that this get ACL command exists that we're looking in the reg
services here and we're going to see if we have full control over this.
This interactive so I'll catch you over in the next video and we work through the exploitation process
of this escalation.