All right.
So now we're gonna need to do is we're going to need to download a file and that file is sitting on
our windows machine.
Now we need to transfer it from the windows vm to our county VM.
You may have your favorite way of doing this but I'm going to just launch a quick FTB server in Python
so I might do is I'm going to kill the python server I have now and I'm going to run Python dash M pi
FCP D lib.
Now if you don't have this you can run something like pip 3 install pi FCP D lib.
And that will run.
OK.
So I'm going to run this on Port 21 and then I'm going to provide right access so you should say 0 0
0 0 port 21 and then I'm going to go over to our machine over here and what we're going to do is we're
gonna be transferring over this file in Tool's source so the source file here and I'm just going to
shift and then right click open command window here and I'm going to say f T.P. tend 11th up for dot
114.
It's going to say OK we've connected.
I'm going to provide anonymous log in and get connected really quick by typing anonymous and anonymous
for the username and password.
Now I'm going to do as I'm going to put the windows service dot see file.
All right.
So now if I come over to this machine here and you can see that it has written so I'm going to go ahead
and control c I'm going to g at it this file windows service that she or dot see you could see right
now that we're running a system command.
If you do not understand C that's fine you don't have to understand any of this at this point.
We just need to understand what we're modifying so we're modifying this.
Who am I.
Command.
So instead of this who am I command we're going to grab this command here which is gonna say Hey Commander
EMC I want to run a net local group administrators user add user being us.
OK.
So don't get that confused with the user.
This is the username we want to add so we're gonna go ahead and come back into our text editor and I'm
going to just replace this and I'm going to paste here and save.
Now you need to compile this.
So take a big caution on this note here.
If you do not have Ming 32 or Ming WD 32 installed or Ming w 64 install go ahead and run this sudo apt
install GCSE dash Ming w dash w sixty four command and it's a sizable files about seven hundred megabytes
so go ahead and install that pause here if you need to and then come back OK.
So moving on I'm going to go ahead and run this command and it's going to create this executable so
we're going to say hey I want to take the C file compile it and I'm going to make it into X that easy.
All right so let's go ahead and paste that.
Sorry I didn't grab all of it.
Go ahead and try this now and paste it
OK.
If we l s the X that is should be created.
It is.
I'm going to go ahead and just spin up my Python simple HP server and we're gonna be doing is we're
going to move this to the temp folder.
Ok we're gonna places in the temp folder in our windows vm so let's go ahead.
Go back to the windows vm refresh here.
Give it one more go.
And then here is the X that you see so I'm going to go ahead download this.
Save it and then let's go to see temp and we'll save it here.
All right.
Now from here we're going to need to run our command.
So let's go ahead and copy this over here.
Let's walk through what this actually is.
So let's copy and we're going to pace this into a command someone say by here and I'm going to paste
OK let's talk through this and I'm going to actually come over to the try Hackney site since it's a
little bit bigger.
So we're going to be adding to the registry here so you can see we've got Reg ad and then we're adding
to this reg service.
Now we're going to do a slash V in slash V is going to say hey what registry entry do I want to be added
for this sub key.
What's the value name in the value.
Name is image path.
Now image path is a registry key that contains the path of the drivers image file.
So what happens is if we place an executable here when we tell the service to start in the image path
it's going to run the executable for us when we tell the service a start if you can see here this SC
down here is going to say Hey start the reg service and say hey when we service starts.
Thank you to the image path.
We're gonna go ahead and execute this executable.
OK.
On top of that we have a slash T which is the type.
Now Reg expand SC all it is is saying hey we're going to run a string here.
This is just a string value.
So the string value is this slash D or a directory or a data.
Actually this is our data we're executing.
And this slash F is just saying hey don't prompt me for this I don't want any confirmation when I run
this I just want this to go ahead and just execute.
So that's what we're going to do.
Let's go ahead and hit enter on this and you could see it completed successfully.
Now all we're going to have to do is start it.
So we're going to soon to say SC we're going to say start Reg service as DC before we do that.
Let's open up a command prompt one more time.
Now let's just say net local group administrative gay administrator are back doors there and TCM is
there.
Let's go ahead and run this gay.
And it says Start is pending.
It's going to go ahead and try to run it.
Look what happened.
The user got added.
OK so let's go back on this.
Remember we went here and we looked and we said OK.
Well the access control list showed that the interactive had full control interactive full control of
the registry key.
So what does that mean.
That means we we're able to generate a malicious executable use the executable here and we added that
into the registry under the image path and said Here you go.
And the image path allowed us to execute this file when we started the service.
So we started the service.
It executed the file for us and it added Our user to the local admin group.
So there we go now from here.
We're gonna go ahead and start moving on.
So if we check out what's coming up next executable files are coming up next.
Now what I want to do is I want you to terminate your machine and go ahead and re deploy your machine
from step 1 and meet me over in the next video when you're ready.
The only reason is I want to clear everything out and start over because we've done some escalation.
So you're gonna have me telling you this a few times throughout the rest of these just so we clear out
and we can re escalate escalate from different parts.
So I will see over the next video we start talking about executable files.