All right.
Let's do this the manual method shall we.
So remember when we found the exploit originally we did it fast to on search point and we saw that we
had this remote command execution for Metis Boyd.
Well we also have remote command execution down here in what appears to be a python file.
So that would be interesting to me.
I'm going to go ahead and just over to user share exploit database exploits windows remote.
And that's exactly what this directory is.
And then I just want to get it this 3 9 1 6 1 and let's read about it really quick
so we're going to use the usage of Python exploit that Pi the target IP address and the target port
number.
It says we need to have a web server using our hosting net cat on port 80.
We may need to run it multiple times to our success.
So if we scroll through here we can see that we have to provide our local IP address.
OK.
So mine is 10 dot eleven dot for 114.
And the port number we're going to host this up on I'll just call this all sevens for port three would've
been fine as well.
You can use whatever port you want here.
So all sevens I'm going to go ahead and save this.
Now that meets requirement number one requirement two is we need to host up net cat.
So we do a locate net cat.
You see I've already got it here in my transfer folder but you will have one as well and your users
share windows resources so you can utilize a net cat there wherever you are.
You just need to host that net cat files if you see I unless I have net cat here I'm just going to host
up net cat.
So python and simple HDP server on 80 and now we're hosting.
So now all we gotta do is follow the syntax we say target IP target port number.
So save this close it.
Python 3 9 1 6 1.
And then the IP is 10 dot 10.
That 148 that one thirty nine for me on 80 80 run that and would actually help if I was listening on
net cat I was not I'm very sorry net cat and the LP 7 7 7 7.
Now let's try that one more time
OK.
There we go.
You saw the get request was made last time and it did download neck cat.
Now we've gone ahead and we have a shell in this machine.
So if we say who am I.
We could say we are still mountain bill perfect.
All right.
So we are in the startup folder.
We can go ahead and do some enumeration here so let's go ahead and try uploading something like when
PS for example and we'll run one piece and see if we can get that to work.
So I'm going to host up where I actually am already hosting up when P 60 forward at EMC I'm just gonna
use cert you tell the Bring that over.
So sir you tell that I see your all cash dash F and then I'm missing a call out my IP address.
Ten eleven for one 14 and then I'm going to say I want when PS 64 forward EMC and we'll just call it
when PS dot XY see if it grabs it four or four not found.
So looks like the syntax was not correct let me try it one more time sir.
You tell that you see your all cache file HP ten that eleven up forward 114 and I'm just gonna paste
it this time think the syntax matters here and then let's call this one piece di you see
OK now we grabbed it.
So the capital W here definitely matters with the lowercase W.
So now we're just going to run one piece and see what comes back.
And it comes back in pretty color.
So nice.
I love one piece.
This is one of the best tools that you can run.
So if we start looking through here as it's scrolling down and spewing all kinds of information we're
looking for anything in red which would indicate that there is a perfect escalation or a mis configuration.
So we can scroll through here and eventually we're going to find that there is unquote ad service parts
and while we're scrolling through here we actually have auto log in credentials too.
So we can log in as Bill under three through eight nine now if we wanted to.
So just more dumping of information that we can find here it's awesome.
OK.
And if we look over here we could see we have interesting services under services information check
if you can overwrite some binary performed yellow hijacking also check for unquote ID service Pat no
quotes in spaces detected or space detected.
This is telling us hey we've got unquote service bad.
Beautiful right.
So this is exactly what we want and we're going to just do the same thing we did before we're going
to generate and drop a file into here.
So I'm just going to C.D. into this folder
go ahead and C.D. And I'm going to just paste that path like that.
OK.
Now we're in the advanced system care folder if we l s or sorry if we dare I'm in a Linux mindset.
We should have access to this folder we have the AFC XY that we need.
So what I'm going to do is I'm going to come to the transfer and this s c service that you see we're
going to regenerate.
I'm going to go ahead to control c what I want to do is I want to run MSF venom with a payload of Windows
X 64 actually windows sorry reverse underscore ECP and then we're going to just have a whole host of
ten eleven def forward 1 14 and then a l port and we'll say all eights on this one file type of E XY
and then we're gonna drop that right into this file name here this AFC let's go ahead and copy paste
it's gonna overwrite
and then I'm going to host up one more net cat so net cat and the LP of all eights
come into here and we're going to perform a certain hotel sorry it's windows shall reverse DCP Windows
shell reverse DCP
OK.
Now we're gonna come in here and we're going to just do a quick cert you tell your all cash dash f same
thing as before ten eleven up four out one fourteen forward slash I'm going to paste this I want to
paste it again make sure everything is running let's go ahead and start up our simple server so that
we're hosting it hit enter here K we are listening on this port for net cat.
So now all we got to do is start this service.
So we'll do SC start advanced system care service nine
and we've got a shell.
Who am I.
We are authority system we've owned this machine so that is it.
Hopefully this was a good section for you I really try to hammer home on this section because it is
one that you're gonna see and it's very common in the CTF types you're never going to really see this
I don't think on a live machine but you never know but when it comes to CTF types or exams or or certifications
labs whatever this is really common.
So it's important to know important to just kind of lock that in.
Remember what Ben parts are.
Remember what the UN quoted service parts are and why they exist and now you've seen the manual way
to do it using one piece and the net Cat version and you've also seen the interpreter slash Metis boy
with the power up tool as well.
So couple different options that you can use to kind of hunt these down and you can make this your own
so hopefully this all made sense from here we're going to move on into one more walk through before
we start getting into our Capstone challenge but we're going to talk about a fairly new escalation as
of twenty twenty this is from twenty nineteen and it's CV twenty nineteen 13 eighty eight it's pretty
neat and I will show you in the next section how we can escalate it.