All right, so now we are going to compromise this box, we are connected to the BBM control the zero
antisense initialise initialization sequence complete.
And let's just move into the second phase.
I just press control, be one to move over to this tab and you can see the star prefix to the top name.
So let's just start with that map right to zero in map, and I'm going to press the right arrow key
to autocomplete where I typed before.
But let me tell you what this does.
So first, we're in map scans.
They verbose.
I want to see everything printed out as it's discovering I'm open ports.
If you need this off, then you won't necessarily see the ports that are being discovered until after
the scan complete gives you sort of a real time discovery of ports as they're being found.
DASHTY This is the speed.
T5 is the fastest.
So since I've got to hide, then we think this is going to go by pretty quickly.
Pian means don't ping the host, just assume it's active because we know it's active because you know,
we spun it up and we pinged in the previous lecture AC run all different default scripts.
The scripts are sort of like Nessus, it's sort of like a check that you run against the target.
You have to see if it's vulnerable.
There's a default list of safe scripts and that's what SC does.
And then dash the lowercase S and capital B does a version check to make sure that, you know, to see
if you can write the version.
So what I did is I just concatenated both the S.
C and the ASV together as one flag, but it's actually doing two different tasks here, if that makes
any sense.
I hope it does.
And then here I'm just running a full port scan.
The some people tell you to run like dash p dash.
This is great, except it doesn't scampers zero.
Sometimes point zero is open in very rare cases and a lot of people don't know this.
And this is a tip that you learned here.
But that's why I always do dash P zero, dash six five five three five, scanning all TCP ports, including
the zero port.
And then I'm going to put it in map format to this file.
And I also want to see the reason if it's blocked and this is the target host.
Right.
And right now I'm running Pseudolus.
I need to enter my password and then let it run.
Now, while the map is running, you can actually press the spacebar key to to see exactly what's happening.
So you can see here, every time I press spacebar, you can see it's it's making progress, but it's
running kind of slow.
So let me just go ahead and put him at his press control B and then shift quotation mark.
Now, the quotation marks right next to anarchy is the double quote quotation mark.
And when I want to do now is I just want to do a pseudo whoops.
Sorry about that ping.
Right.
Arrow going ping that for time just to make sure I stop it is so that means we're connecting to the
VPN and the host is actually active exit to close.
So we need to let this one go.
Right.
So let's put this right and then I will come back once this scan finishes.
Right.
So the scan finished.
Let's see what we have in this directory.
We have one file.
We can get this.
Let's see the results so we can see port one.
Thirty five is open for eighty five hundred and forty nine.
One fifty four turning based on these versions AAPC.
This is most likely Windows box.
Also the TTL is the TTL is between sixty four and one twenty eight.
It's a Windows machine if it's less than 60 for us most likely when witness box.
I mean if it's above 128 it's usually a device like a network device.
This isn't like cut and dry, but this is typically the case touch.
Just a little bit of insight there.
In case you didn't realize that, that's another way you can fingerprint the host.
So let's go and look at this.
Eighty five hundred for like, what is this.
So in press control, B, C it will be comma.
Name this discovery.
Let's take a look at this box.
So I'm getting in C right.
Arrow was trying to connect to this port.
Now if I just like, you know, type it like help was trying to get some idea of what is running on
this port because in control, the one wasn't able to identify the version.
Right.
It's empty.
And it says something about FTP that we couldn't like Google that.
But before we do that, I just want to see what we can find out without you will be too easy.
I typed help.
Nothing's really happening.
You know, it could just be that the box is slow, which is very common in the real life Pinterest engagement.
Oftentimes you'll have legacy hardware, legacy devices on the network and it can be a pain when you
need to run attacks against them.
And that's why I really like this this test and why I really wanted to present this box to you, because
you're going to see this is very much like a real live engagement.
We're going to take it step by step.
I'm going to show you exactly what to do.
So, you know, we're not getting anything back here.
I must go ahead and just terminate this for you, Jose.
I should see if we could open up a Web browser to it.
So let's go here.
Newtown, HDB.
Ten, ten, ten.
Eleven, eighty.
Five hundred.
Let's see if we get really, really slow.
Now, this is where you will need to have patience because, like I said, a real and real engagement,
you can have issues like this.
And one thing we could do is we could try starting a berp.
I'm actually in incognito camp right now, so I don't have a way of using Foxe proxy to intercept the
request.
So I'm going to do is press controlled w to kill this until to kill this as well.
I'm going to go back to Cali, go to the Web browser so that it's not in a private tab.
You can see I've got my Foxley proxy thing set up and what I'm going to do is I'm going to click on
Berp
Proxy by traffic through back to the way I have a set up.
If you just go to Google and you search for proxy proxy
as that proxy proxy.
Right.
Grab that.
I then you just install it manually installed, that's why I said remove.
Once you install it, you click it, you go to options and then you can click, add to the color, name
it something like my bourbon and put the the port which is one twenty seven zero zero one.
Sorry, that's the IP and the port is eighty eighty.
You click save.
I've already done that.
Which is why you see this if I click on edit.
I'm going to be saying so here now what I can do.
It's pretty straightforward, so I'm going to close this out and I'm going to go back to berp.
All right.
So Fiorillo and the settings are like too large or too small, one of the ways to fix it is to go to
use user options display.
You can change this.
I'm going to scale this down to like 15.
Let's get this down to 15 quick, OK?
And then close it out.
Yep, click burp again, complete, I fixed it.
There we go.
That's better next Starbright.
That's a lot better.
So again, I got a proxy options.
I want to make sure that I'm intercepting responses as well as several response.
Make sure that an intercept is disabled.
And then I go to Target.
You know, look here.
And the reason I took the intercept off is because when it intercepts the request, it actually stops
the flow of the Web traffic.
And I want to do that.
I just want all the traffic to flow through to its target tab so it automatically map out passively
on passably map map of the target.
They'll see what I'm talking about the moment set off.
Let's go back here.
Let's go to our domain 10 to 15.
We got to the burb now.
I should be going through our center again, go back to check on target tab.
Sometimes it takes a moment to filter.
And so you just have to be patient.
Sweet, sweet.
Now, we have a result here.
Looks like it's just an index, a directory index.
So this, of course, if this were a real engagement, this will be a finding where you don't want to
have this exposed to the outside.
Right.
Click Sorry, I hit alt tab.
It brings me here and you can see now the site map is starting to build itself out.
Right.
So go ahead and I'll type back, explore some things.
Let's go to see if I eat documents.
It's like just dogs.
I don't care about dogs, but it sounds interesting.
And again, this is really slow.
You know.
You know, if this were a real life engagement, you know, that's often something that you will encounter.
And attackers don't care if it's ever slow, if the server has sensitive data that they would like to
expose or link to Internet or possibly bribe the target organization by saying, we've got your data
sort of like ransomware, they don't care.
They have unlimited resources and unlimited time.
So this is this is very real world.
So just try to be patient.
I know it's annoying, right?
It's finally loaded and we can see a bunch of different files here.
Wizards' You know, it has nothing to do with it's with magical hats and stacks of this most likely
has to do with setup wizards, his installation script, images, administrators.
I'm against this now.
This would also be a finding.
So, you know, you wouldn't want to hit this with real life.
You would hit the Windows key screenshot right now.
You'd want to take a screenshot of this, maybe select a region, click, OK, and then just pretty
much copy this to a clipboard or whatever and then paste it into some document that you were you would
send to the client.
But it's going to click on administrative because that looks very interesting.
I know we can do as well as this thing loads.
Oh, by the way, you did notice now that the site is starting to get built out, built out as we continue
to browse different parts of the application.
While we wait for that, let's go back to the Web app and you can see it loading something here.
So this is interesting.
We're at some important was a couple of things we can do here.
Since the application is so slow, brute forcing this path is probably not going to be a good idea if
we could try like admin admin to try to get in that way.
If we press control you, we can scroll through.
And I'd like to do control f less than sign greater than Bing Bing to look at all the comments, OK,
because sometimes comments will give you credentials, you know, leak, stuff like that.
The source code.
I see any of that here.
Let's go ahead and do a search for like your password.
OK, so there's a couple of things here.
Now, this is kind of interesting.
It's login form.
Looks like when you submit the request, it sends a post request, which is normal, but it takes the
value of this filled S.F. admin password, which if I let's see here, if I duplicate this tab is out,
that is essentially just the password filled.
And what it's doing is it is actually taking that value, running it through a QA Qaa one algorithm
that is taking a seat at seeding it with a salt value and then running into an H makeable, which is
sort of like a shot some, but it also includes a key to that.
It's the the client can actually authenticate the authenticity of the device that it's authenticating
against.
So, you know, all this stuff is happening inside.
It's happening on the client in the browser.
It's not on the server.
So this might be something we can manipulate later if we do a search for salt.
You can see there's a hidden form field that includes the value of its value.
Might change every time, but it doesn't matter because we might be able to use this to our advantage.
So let's just keep this in the back of our heads that the client is running these Mac and shot samples
against the used the password field that that could be to our we could use that to our advantage a little
bit later.
So let's go back here.
And if I right.
Click and I press Q inspect the element, I can see it is named Claman.
That's my great estimate.
So what we can do now is we can first take off, we can Google like, you know,
default Adobe passwords.
Right.
Google default default Adobe cold fusion password if we get any hits.
You know, I'm not really seeing anything here.
Another thing we could do is if we could just here's something here.
This is cold fusion hackey look like this.
This might give you something interesting.
Let's see.
Logging in.
This is kind of this form felt that we had, right, and it's telling us that we might be able to log
in and log into this device without even knowing the password.
So let's keep this in the back of our heads and let's look at what version we're running.
We're running cold fusion version eight.
First thing I would do is just search search boy, to see if there's any known exploits against this
version of cold fusion, which is ACTTAB.
Let's go out and press control B, C, and then we can name is control big pharma, exploit this new
search plate, dash each and see what we can do here.
And you can see there's an update option.
So a pseudo search like you should always update it.
First update
in search for an update, finished up twice to see what we can do here.
Let's just do a search for it's cold fusion.
All right.
So we get a couple of hits as they search point cold fusion, eight point ninety eight point of Vergence.
Right.
Let's just do it.
So the first thing I see is crosshatch scripting, not really relevant here because this requires the
victim to interact with the target website.
So there is, in fact, the box and I actually have that that ability.
There's no real user interacting with it except for us, the attacker.
So let's look at this directory traversal.
The second thing is Python script.
So what I can do is I can select this and select right.
Click copy selection, search for it, search court documents to examine and control, shift to to paste
in and erase that tappy part.
And now we can see something really cool and seeing this get requests to give us access to this password
file.
And this might be able to it says Madobe confusion, unspecified directory traversal vulnerability's
might be able to get us access to the the device or of the application as an administrator.
This Python script, where does it basically said is that request to the host on the port?
It sends the post request and then it just keeps looping until it gets all the data back from the device
and then that's pretty much it.
So the important part is this part here.
I'm going to right click copy bank address tab.
You go back here and control.
Let's substitute server for 10, 10, 10, 11 eighty five hundred because that's our device.
Let's see what we get this report back on.
Interesting, and now that it returned about 30 seconds later, it's showing us something is this passport
and we have some kind of hash since the admin user can be modified, this is probably the administrator
password and it looks like it's Hashd when we can figure that out.
If we select it right, click on a copy of tab back to this queue to get out.
Let's just do hash by the ID and let's just piece it in there.
Control should be.
You can see that this is a shot one hash.
Another way to do that is to do I think dash in control should be grap to work out a number of characters.
You can see it's 40 characters and that is actually that corresponds with the hash.
So now we have to administer the hash and you might think, oh sweet, let's just log in with it.
Unfortunately it's not that easy.
You can't just walk in with this hash, but we could do is we could Google it to see if someone's already
cracked it.
So if I go here to Google and let's go and take her off, turn her back to Google, pasting the hash
there and you can see the password is happy day, right?
So Controllability calls that.
Let's just try happy day.
And if we.
Right.
Click Priscu.
I want to show you that's actually what we typed in here.
We see the type says password.
That's why the password is being masked by changes to text.
Now, I can see the password right across the south and I'm going to click submit.
Let's see if we get it.
No, I don't know why I just changed the password back to a hash, could be that that's what's being
sent over the wire.
So if I right.
Click sorry, I just timed out.
Let's go and try it again.
If all tab back to burp and I go seem to be history and look at the post request, you could see here
that it's trying to send this right if you.
Right.
Click this and go to copy and see if you can figure out what this is.
I'm not going to find it because remember the client said the client on the client side is taking that
hash.
It's taking the passwords, running through a hash, and then it's using a random thought and combining
that with the Mac value, which is then being sent.
So you're not going to see this this value correspond to anything on the Internet.
So that's like the page is still having a difficult time loading.
Let's just make sure that our virtual machine is still active.
What tab ping right.
Arrow to the IP dachsie count four times and still there you actually see through the terminal background
that the login page is actually displayed.
So time, happy day, enter, don't say see if this gets the same notice.
I disabled the proxy through because I didn't want to slow anything down unnecessarily because it's
already pretty slow.
Interestingly enough, we could probably see what's being sent if we go to a developer.
Tools, let's see network.
You go here, you look at.
Sometimes you can actually see the head, a request that's being sent, and I just want to see if it
was actually hashing that password happy day and sending it with the eight back salt.
But it looks like the applications are running a little bit too slow for that to happen right now.
Here we go.
You seem to get requests and sent you we have actually a post request.
So it could just be that I didn't I opened up the developer tools after the post request is already
set.
It doesn't really matter
if it is the post, there's no question here.
Looks like.
Yeah, so anyway, we have logged into the application, which is good.
I was just checking here to see if there's a way to look for post requests, because I wanted to see
if we could if we could see the password that was being sent that was being actually hashed.
But it's OK.
We don't need that because it's out.
And let's go to stuff here.
So we're logged in.
What are we going to do?
Well, this application is really slow, right?
So we want to be very careful with it.
You know, we could click through security in the different pages.
Like administrator is probably a place to reset your password from, judging by the name of the resource
admin password.
So we've got a couple things here.
Server settings.
Let's hear mappings.
What does that kidnapping's?
I just control clicked it.
All right, so mappings loaded and it's a couple of different things here, interestingly enough, I
might be able to browse the server.
Doesn't look like we're able to do that.
Because you have Java enabled, there's some buttons over here, if I press control minus, you can
see I can zoom out and see what that was, control zero to go back to normal.
Let's go back and see that there are a couple of mappings here.
This looks like this is the directory that the directory for the website.
So that's going to probably play a role later.
So this is, of course, not good.
You don't want to have this exposed to the world.
If we go back to administrator and see some other stuff in here, we go down to scheduled tasks.
This might be a way for us to get something executed, you know, on a server.
That's what we want.
We want code execution.
We're trying to get a show.
We're trying to to breach this this Web server.
It's a compromise.
And so our initial access technique might be to, you know, upload some malicious file here.
So this set of tests.
See what we can do here, St. Louis special task and why we thought.
Let's see if there's another method of getting code execution on this box if we do search.
Boy, to stick up a little bit of confusion, wait and see what we have.
We know there are some uploads like this arbitrary file upload.
It's what else?
Crosshatch scripting, process scripting.
I've got this one here, upload and executes.
There's probably a way of uploading something and getting code execution.
What can we do?
We could look at a script even though we're not going to we're going to try to avoid using at this point.
We can still look at it.
So we see that this is one six seven eight eight six point twenty six one six, seven, eight.
And let's go ahead and scroll down a little bit.
You can see the look at the X part for generating a random file with a duct tape extension to this might
mean we might be able to use MSRA venom to generate our own shell so that we can bypass the display
and get around that.
But it's the GSP file.
And what is it doing here?
Let's see.
Setting some headers.
So it's X, that's Java Dash archive, and then it's creating the file in the path that includes that
random filename, that text.
And that looks like it's actually trying to upload it to this particular folder.
Hurtful things could just be the root of the device and it just doesn't stand up, and then you can
see here, this is when it tries to execute the shell.
You know, whenever you upload a web shell, you need to find a way of executing it, which means you
need to find a way to browse into the file path of that of that resource.
You upload it.
So here you can see this is how it's getting there.
Right.
And then page, you do forward slash page.
This is where it's coming from.
All right, and again, you know, if you notice that everything is just dying and nothing is working,
you know, it's just reset the VM, which is what I think I will do in this case because it's just not
functional.
All right, so we got into the schedule tasks which could create one's own name upon start date at time
and really care about that euro, oh, we want to use it to download our show.
So the plan here is we're going to actually create a shell and have it connect back to us.
Let me tell you what I mean.
It's what we can do is we can put in the IP address of the attackers machine here and essentially get
some communication.
So if we put the same we put in, you know, the attackers IP here attacker, well, that's really sloppy.
And then we have like Shell that GSP.
Right.
So we can have this web application which is here.
Let's call this cold fusion.
Confusion can reach out to our box the attacker and download this GSP app and save it so we can basically
say save, I put to a file, I can save it here, which is the webroot of the application.
And then once it saves that, they can execute it in memory and return the shell back to our attacker
box.
So that's basically what we're doing here.
We're just going to go ahead and generate the shell and then host it on our attacker box and then execute
it.
So let's get our attacker IP, our attacker IP with the IP, a cabinet time in zero.
We see we're at 10, 10, 15, 20 to 10, 10, 14, 22 Shalgam GSP.
And then the final path will say the output to a file paste in the path of our mappings where we want
to upload it.
All right, very cool.
That looks good.
Now, of course, we're going to have to actually create this file.
So let's submit this now while we wait for this to connect.
Let's go ahead and generate this payload
control B, C until the comma.
And we call it exploit Dev so we can use it myself then to create our payload after studying for the
OCP.
You can also use them as I have been on the test.
So this can also help you.
So we're going to do sort of this example, right.
Let's go to NSF with a payload.
We need to see a list of all the payloads so that we can know which ones to use.
If you remember the we discovered that it's attached to his payload from the Métis plate XPoint.
So, you know, if we go back to three here.
You can see here that they're actually trading this GSP page, right?
So she was to exert that control the four and we know that's what we want.
So let's go ahead and do Sido.
And that's something that.
And list Kayode.
And let's go ahead and grab GSP,
so we want to do a reverse shell.
This means the target for the victim machine to connect back to us, the attacker.
So this is all we're going to do this on purpose.
Let's go to press control you to end it, control the shift, questionmark.
They can try to split the pain of the control.
B, holding that control and pressing the down arrow to make the bottom bit smaller than what we can
do is we can do MSF then and here we can build our Creary here in the of the payload
that we can just paste the same copy to the back.
And I just.
Right.
Clicked it all the way to the right area because I already started typing this before.
So the format we're going to want to use is raw.
How did I know that our press control be up arrow to go back here to the top, pick that up ever again,
to go back to the help file and see that there's a format?
Right.
And if we did pseudo MSF, then this format,
you can see there's several options.
Right.
How do you control B and then the left bracket, which is usually to the right of Latapy, I can actually
use the Upper Keys and page up to go back through my history.
So you can see these are different format values.
This jar's is everything else.
And we're just going to use raw because it is the easiest to work with.
Right.
All right.
Here, it's a cute exit out of that.
Then we have out I go back to the helpful you can see it out is the resulting name.
You have the name our shell that he has JFP, because that's what we put in the schedule task in this.
It seems to be our actual IP address.
So control by questionmark and actually split it vertically.
So control the percent Ippei grip.
And now we can see that we are at 10, 10, 14, 20 to exit Tintern 14 twenty two.
And that looks good.
We can use this port and get us what we need.
Let's go ahead and run it through.
This should generate the payload for us, which will be up at.
And everything you can tell that GSP, you can see this is our Michelle Sweet.
So now we've got our task created finally here and we've got a couple of things.
We can delete it.
We don't want to do that.
We can edit it.
We don't want to do that.
The compositing want to run it before we run.
Remember what we have to do.
We need to host a Web server on our local box so that his application can download it from our machine.
What's it downloaded?
It will essentially execute the file.
And then by following the code inside the file, it will initiate a connection to us on the part that
we designated, which is actually part four for three.
All right.
So let's go ahead and start that up.
So we're going to use our wrap to attach the shell.
So we started a pseudo RL wrap and then in months in the LP forward three has to be a great place for
us to catch a show that you could just do pseudo in C space minus in the LP for four three as well.
The reason I use our Erap is because for Windows, if you pass net cat or rap, you actually get the
describe this, but you basically compress the up and down Iraqis and go back through history.
This means don't resolve names as the end means the means for both l means listen and support.
We want to listen on this part.
OK, so we're just waiting for connection on any interfaces on this on this port though.
Now that's going to be for our show control be present.
We need to also host our web server so that we can serve up the file that we created, write the Shell
GSP so we can do pseudo Python three Bashkim SCDP seven point eighty.
Right.
So now we are listening on all interfaces, operating rights and how we should be good to go.
Let's just go ahead and run it and let's see what happens.
We should get a Shubat.
It's going to take a while.
Remember, according to the exploit just running, this isn't going to give us a shell, right?
We're going to have to actually execute the shell.
So if we go back to control B three to exploit, let's go back up to it again.
You can see that we're going to have to find it, which it looks like it's here.
Right.
We might have to navigate there
and see is saying there's an error here.
The resource doesn't exist.
Let's see if we did everything right before.
That all looks good.
Let's go ahead and go back to edit skittled test to make sure everything is set up correctly.
OK.
So you can see this if you click this in here, you click.
I see, Michelle, there's loads, you know, that that path is right, actually, to go back now to
the emergency request that came in, they came in from you.
All right.
So we know that the website is actually hosting it correctly, that.
Amy Pond.
That GSP save up to file.
Oh, you know what, I put the past behind them and put the file in.
Yeah, I think that was the problem.
So this quick cement.
Runit.
Then we have our show, so we selected and now we should get a reverse show back.
In this window.
Showbizzy.
You can see this is our username.
And we are not a member of the administrators.
All right, so that's what we have for the compromise piece in the next lecture, we're going to talk
about the post exploitation.
I'm going to show you how you can use Col exploits to escalate your privileges from a unprivileged user
to an administrator.
All right.
See the.