All right.
So let's go ahead and serve up this file that we had before.
Remember we had the x that XY served up so I've actually already got it.
Still running from previously.
But if you need to go ahead and serve up this X that you see that we generated an earlier video and
then I'm just gonna go ahead and go out to Internet Explorer and download that.
All right.
So again my IP address is ten eleven and forward at 114 should pull down this directory listing and
I'm going to download X not easy but we're going to save it to the C program files.
So let's go ahead and save it there.
We're just gonna overwrite this file perm service that exceed so we're gonna make this run as the service
instead so we're gonna go ahead and just go to program files file permissions service and then we're
going to rename it this save it and replace it.
All right.
And then we're gonna close this and now we're gonna do is we're going to come in to command and again
let's go ahead and do a net a local group.
Administrators
you could see just administrator and TCM on this machine.
So now what we're gonna do is we're just gonna say Hey let's start the file perm service
start pending.
And if we have done this correctly we'll see now that the user has been added to the administrators
group and we have successfully escalated this so quick recap.
Remember we found this with the power up right with power up told us hey we have an executable sitting
here running as a service.
We have this modifiable file permissions here for everybody and we can utilize that to use something
malicious like this.
So make sure you're looking in you're looking closely when you run a toll like power up and you understand
what this means if you see executable services you're going to come back you're going to say hey I know
I can escalate this user that I'm on with a simple C script and make that into an executable elevate
this up.
And here we are now we have full permissions as an administrator user so that's it for this video in
the next video we're going to talk about excluding startup applications.
So I'll catch you over in the next section.