1

00:00:00,180 --> 00:00:06,200

All right, so here we are, in fact, the box VIP edition, if you haven't signed up for the VIP plan,



2

00:00:06,210 --> 00:00:07,620

make sure you go ahead and do that now.



3

00:00:07,860 --> 00:00:11,340

Or if you're like me and you just like to go through all the videos first and then go back and sign



4

00:00:11,340 --> 00:00:11,530

up.



5

00:00:11,580 --> 00:00:12,300

That's cool, too.



6

00:00:12,450 --> 00:00:14,290

And I know how you feel.



7

00:00:14,790 --> 00:00:19,600

Anyway, once you sign up for VIP logging, I'm going to show you now how you can get started.



8

00:00:20,040 --> 00:00:24,220

So in the past, and this is relatively new in the past, you would have to go to VMware, right?



9

00:00:24,240 --> 00:00:25,110

So let me show you something.



10

00:00:25,120 --> 00:00:26,040

What we used to have to do.



11

00:00:26,740 --> 00:00:28,200

I go to VMware workstation.



12

00:00:28,350 --> 00:00:28,710

Right?



13

00:00:29,880 --> 00:00:37,890

Actually, first before that, I'd have to go to my colleague and, you know, go to downloads and then



14

00:00:37,890 --> 00:00:41,970

download this, install the right way for this three point seven gigabyte file to download.



15

00:00:42,600 --> 00:00:44,670

And then I'd have to load it into the anywhere.



16

00:00:47,510 --> 00:00:53,120

Right now, let's see if we can look at the pain right there up in the VMware, and then you have to



17

00:00:53,120 --> 00:00:58,520

like install it, you know, make sure your system's beefy enough to handle all the system requirements.



18

00:00:58,990 --> 00:01:02,120

I mean, it was a huge pain in the butt no more.



19

00:01:02,630 --> 00:01:03,590

This is really, really awesome.



20

00:01:03,600 --> 00:01:07,980

So you can actually get started with zero on prem infrastructure.



21

00:01:08,030 --> 00:01:10,200

You don't need to install anything on your computer.



22

00:01:10,220 --> 00:01:11,360

It's all done through the Web.



23

00:01:11,390 --> 00:01:12,130

Let me show you what I mean.



24

00:01:12,600 --> 00:01:14,930

You are going to hack the box upper right corner.



25

00:01:14,930 --> 00:01:18,290

You click connection settings, go here and you have two options.



26

00:01:18,290 --> 00:01:19,010

Open VPN.



27

00:01:19,760 --> 00:01:23,550

That's the oggi way of doing things like the original gangster way of connecting to a machine.



28

00:01:23,840 --> 00:01:25,670

This is the new way poun box.



29

00:01:25,700 --> 00:01:25,940

All right.



30

00:01:25,940 --> 00:01:26,960

Let me show you how awesome this is.



31

00:01:27,470 --> 00:01:28,040

Po box.



32

00:01:29,330 --> 00:01:31,320

And you can see right now my instance is offline.



33

00:01:32,120 --> 00:01:33,170

So let me go out connect first.



34

00:01:33,170 --> 00:01:34,930

You need to select a location this close to you.



35

00:01:35,480 --> 00:01:39,860

So I am in the United States and you can see I have twenty five milliseconds of latency, which is not



36

00:01:39,860 --> 00:01:40,280

too bad.



37

00:01:40,670 --> 00:01:43,320

If it's red that means it's kind of kind of slow.



38

00:01:44,150 --> 00:01:49,130

I'm going to connect to the Indian servers in India because, yeah, I'm going to have some delays.



39

00:01:49,490 --> 00:01:50,570

Nine states is looking good.



40

00:01:51,290 --> 00:01:53,360

And then what I do is I click the VPN access.



41

00:01:53,930 --> 00:01:55,010

I'm not on a free lap.



42

00:01:55,340 --> 00:01:56,660

I'm on the VIP lap.



43

00:01:58,700 --> 00:02:02,890

The free lap will only get you the most current retired machines.



44

00:02:02,900 --> 00:02:07,200

I think it's like the last two, but the VIP will give you all the retired machines.



45

00:02:08,650 --> 00:02:13,820

OK, so then we go out and select the server and I go a VIP here.



46

00:02:15,020 --> 00:02:15,620

There's a lot of them.



47

00:02:16,070 --> 00:02:16,790

Let's go and click.



48

00:02:16,940 --> 00:02:17,690

Click the first one.



49

00:02:18,230 --> 00:02:23,390

The reason I pause there is because I wasn't sure that little blue number to the right of each, each



50

00:02:23,390 --> 00:02:26,570

server they met like, you know, 11, 11, 12.



51

00:02:26,570 --> 00:02:27,680

I'm not really sure what that means.



52

00:02:28,430 --> 00:02:31,250

If anybody knows, please, you know, let me know in the in the comments or the chat.



53

00:02:31,550 --> 00:02:34,970

But anyway, we've got what we need and we could start talking about post-box.



54

00:02:35,570 --> 00:02:38,060

I can't even talk straight because I'm so excited about this.



55

00:02:38,450 --> 00:02:39,320

So look what happens.



56

00:02:40,910 --> 00:02:42,800

You can see it's actually starting up the instance.



57

00:02:42,950 --> 00:02:43,250

Right.



58

00:02:44,480 --> 00:02:46,790

And it's about to get bonkers.



59

00:02:46,790 --> 00:02:49,130

Guys, wait a few seconds and watch lowed.



60

00:02:57,590 --> 00:03:02,360

That is amazing, you can actually see a thumbnail view of pomoc boxier, took just a few seconds to



61

00:03:02,360 --> 00:03:05,270

set up right now and I can do is I can scroll down.



62

00:03:06,140 --> 00:03:06,760

I can either.



63

00:03:06,800 --> 00:03:07,190

This is cool.



64

00:03:07,190 --> 00:03:10,670

So I can actually open up as a stage terminal where I can just open the desktop.



65

00:03:10,970 --> 00:03:17,080

If I click open and desktop open, the new window at the box is starting bam in my browser.



66

00:03:18,050 --> 00:03:20,600

I now have access to everything I need.



67

00:03:20,600 --> 00:03:21,650

Right, so I can go up here.



68

00:03:22,340 --> 00:03:26,450

I can run the Linux version of Paracha, which is pretty badass.



69

00:03:27,140 --> 00:03:29,390

I can launch bash, I can watch the blind text.



70

00:03:29,390 --> 00:03:31,370

Everything you need is here, almost everything.



71

00:03:32,120 --> 00:03:34,220

And I'll tell you why I said almost in a moment.



72

00:03:34,550 --> 00:03:38,090

But I want you to see, you know, here I am, right.



73

00:03:38,090 --> 00:03:39,380

I've got my IP address.



74

00:03:40,610 --> 00:03:47,810

You know, if I do Cyro update DB, I can update the local DB and then I can start searching for stuff.



75

00:03:48,590 --> 00:03:51,020

I can also just start browsing, browsing around.



76

00:03:51,020 --> 00:03:51,980

But I've got bloodhound.



77

00:03:51,980 --> 00:03:57,200

I've got all the tools I could possibly need to do my Pentax work.



78

00:03:57,290 --> 00:03:57,950

I mean, look at this.



79

00:03:59,210 --> 00:04:00,290

I mean, this is crazy.



80

00:04:01,370 --> 00:04:03,440

Some of you guys are probably more familiar with callisthenics.



81

00:04:04,160 --> 00:04:04,670

I am too.



82

00:04:04,670 --> 00:04:05,600

I really like Kalay.



83

00:04:05,960 --> 00:04:12,230

But this is kind of you know, this is an emerging contesting OS that I think many people are starting



84

00:04:12,230 --> 00:04:12,740

to move to.



85

00:04:14,000 --> 00:04:17,570

Just go and close this out and let me show you something cool here.



86

00:04:17,810 --> 00:04:23,750

So if I search so I say locate one piece.



87

00:04:24,920 --> 00:04:29,900

This is one of the privilege escalation tools we're going to use in this course.



88

00:04:29,900 --> 00:04:34,970

If I say locate our up, that did not work.



89

00:04:34,970 --> 00:04:35,630

Let's see.



90

00:04:35,630 --> 00:04:37,530

Locate power up top.



91

00:04:37,550 --> 00:04:40,340

Yes, one zero.



92

00:04:40,340 --> 00:04:42,500

Locate power up that one.



93

00:04:45,470 --> 00:04:46,280

Where is power?



94

00:04:46,380 --> 00:04:52,220

I know power up is installed in this box because I just looked at it a moment ago, I think it's actually



95

00:04:52,220 --> 00:04:55,750

in power show mafia.



96

00:04:56,570 --> 00:04:58,650

OK, Mafia.



97

00:05:03,380 --> 00:05:04,100

Interesting.



98

00:05:05,330 --> 00:05:11,510

So one thing we could do to find the things that are missing is we can just go to, you know, Firefox's.



99

00:05:11,510 --> 00:05:14,420

We can open up a browser just like a, you know, just like at your own machine.



100

00:05:15,230 --> 00:05:23,090

And we can just go and start looking for stuff so I can go to, like, you know, Google dot com and



101

00:05:23,090 --> 00:05:25,100

I can search for power up.



102

00:05:27,860 --> 00:05:32,240

I need to specify GitHub or I'm going to get a bunch of stuff that I don't really care about.



103

00:05:33,200 --> 00:05:34,700

And of course, I want the latest version.



104

00:05:34,700 --> 00:05:40,060

So I go to power up here and it's in this PowerPoint.



105

00:05:40,070 --> 00:05:44,630

That's what this PowerPoint pseudo located power exploits.



106

00:05:45,750 --> 00:05:46,340

There we go.



107

00:05:46,580 --> 00:05:55,280

And now if I wrap this up, I don't see it, but where is it?



108

00:05:55,700 --> 00:05:56,290

Privacy.



109

00:05:58,550 --> 00:05:59,730

Oh, that's why.



110

00:06:01,370 --> 00:06:10,350

So what do you have to do is do a case insensitive search and it works.



111

00:06:10,350 --> 00:06:11,300

That's what the dashi does.



112

00:06:11,510 --> 00:06:14,120

And it was literally looking for a lowercase P, and that's why I didn't find it.



113

00:06:14,610 --> 00:06:17,570

I've got power up here and if guys don't believe me, I can just.



114

00:06:17,810 --> 00:06:18,410

Right click that.



115

00:06:18,410 --> 00:06:22,940

Got a copy cat paste that puppy in there and you can see there it is.



116

00:06:22,940 --> 00:06:24,530

There's a script right there that's power up.



117

00:06:24,980 --> 00:06:26,990

So we have almost everything we need.



118

00:06:27,230 --> 00:06:31,070

The only two scripts we need now are Watson and Seppelt.



119

00:06:31,730 --> 00:06:38,210

So these scripts aren't actually included because you have to compile it from source.



120

00:06:38,660 --> 00:06:42,260

So if I go Google, Watson, GitHub.



121

00:06:44,910 --> 00:06:54,210

Yes, Watson, see, what you actually get is a SLN and this is a solution file and this is made for



122

00:06:54,210 --> 00:06:58,620

Visual Studio, so when we get to this portion of the course, I'll show you how you can compile this



123

00:06:58,620 --> 00:07:01,290

from source and the same for seatbelt.



124

00:07:08,730 --> 00:07:09,340

As a solution.



125

00:07:09,560 --> 00:07:12,390

So we're going to go from source and generally it's a good idea to do that.



126

00:07:13,050 --> 00:07:16,320

You know, you can try to look for like a prerelease.



127

00:07:16,320 --> 00:07:22,500

There's no releases published for seatbelt and there's none for and it might be one for Watson.



128

00:07:23,280 --> 00:07:23,880

Looks like there is.



129

00:07:23,880 --> 00:07:27,540

You can download it, but usually you want to compile it yourself that way, you know, you're not compiling



130

00:07:27,540 --> 00:07:30,330

malware because you can actually look at the code yourself.



131

00:07:31,000 --> 00:07:33,060

That's really all I want to show you in this lesson, guys.



132

00:07:33,810 --> 00:07:40,710

You know, in the next lecture, we are actually going to get into our first our first purpose, escalation.



133

00:07:41,400 --> 00:07:46,410

So I'm going to show you how you can start up your VM and we're going to start escalating our privileges



134

00:07:46,410 --> 00:07:51,420

using clear text credentials, which sounds kind of lame and may not be the most exciting, but it happens



135

00:07:51,420 --> 00:07:52,650

all the time in real life.



136

00:07:52,650 --> 00:07:53,580

Pinto's engagements.



137

00:07:54,030 --> 00:07:56,130

So I will see you guys in the next lecture.