OK let's talk about executable files as a service.
So occasionally we're going to see services running that have executable attached to them.
And if we can manipulate the executable and it has say file all access permission on it guess we're
gonna be able to do.
We're going to be able to do the same thing we've done before.
Create a executable and have that do what we wanted to do which was in the last video.
If you do recall with the registry which is very similar here we created a executable that did a command
XY added us to the local group administrators.
So we've already got that file saved out that excite you see we're going to use that again to escalate
here and you're going to see how this is going to work.
So let's go ahead and open up our machine now.
I'm going to tab up for the our desktop.
My IP is changed to 10 that 10 dot 156 254.
So I'm gonna go ahead and just swap this out really quick and get connected
and then again it's user password 3 to 1 so from here what I want to do briefly is I want to run power.
So let's go into our tools.
Let's go ahead and go to power up shift right click and we're going to open a command window here.
We're going to save power shell execution policy bypass just like that and then we're going to import
power up there remember it's invoke all checks.
So we want to invoke all checks hit enter let that run.
And while we're waiting on that to run let's go ahead and run command we're going to say command that
XY.
Now the way this was shown to us here is it says Hey let's go ahead and take this access check again
with the dash WVU and we're going to do the file permission service.
So we're going to go ahead and run this against this.
I'm going to paste in I had some issues earlier with this.
I'm going to just make sure that this is the correct syntax hit enter.
We're gonna have to agree to the CIS internals and then you're going to see on this file perm service
that e XY.
We're going to see that we have read right file.
All Access we've kind of seen this before right with the access check we've seen file all access.
Now let's go take a look at the power shell here with power up.
Now we ran this and we can see if we scroll up just a bit that we have the file perm service it says
checking service executable argument permissions.
So it found an executable running in the services.
It found this file purchase service that you see.
I like the power version here because it's finding this for us one in two it's giving us more detail
this version here in the way this is guided is just saying hey let's know where this is that already
and we're going to just know the service exists.
That's not always going to be the case.
We're not going to know the services are going to exist.
We might have to do some manual queries we might have to show all the services do SC command show all
services see what's running identify this service as the file perm service running or we could do something
awesome like run a tool like power up and see that it identifies as executable running and it knows
that we have the ability as everyone to to escalate.
Here we have the file all access here on everyone.
So we have modifiable file identity references modify file permissions and we have modifiable file say
that three times fast.
So now that we know this vulnerability here exist we need to go ahead and attempt to exploit it.
So remember we're able to identify with power up or if we know already what the service is we can go
ahead and identify that with the access checked.
So we're going to go ahead in the next video exploit this.
So let's pause here.
I'll catch you in the next video as we escalate this vulnerability.