That's creator Xochitl.
You know, in the south that.
Until the Border Patrol has a down there a couple times.
What we want is this is going all the way, so it's you know, I said.
Equals 10, 10 to 15, 20 words because for three.
Let's just go away.
And the reason we're doing this is because nothing else which might work.
So this is always the last resort entrepreneur.
A team got particular.
And it's for the next three to six, and he could have.
Created specifically for 64 bit system.
So if we go here.
Control, you do you know, in the.
List of.
We want to do X.
It's the architecture that is is compatible with.
That's just park.
You know, it's like now it wants the.
Actual output.
So we can do with less than a.
And we see windows there.
So let's try that.
Platform windows.
Incompatible with the payload salvado.
In the.
We want to also search for 64 and windows.
So we're just filtering I say, OK, I all the people only lead to interpreter that I'm 64 in that name
and only related to Windows, and she pulled the reverse in order to correct reverse.
Know, Kate, let's see, what do we have?
The first Tsipi, this one.
And let's get out of this one right here.
This one, the staged was more likely to get caught by.
This one doesn't say it's staged.
So let's try this one right here.
Copy about a couple of times, control left a few times.
Space space control should be.
Right, that's pretty good.
Sweet.
We got it.
That looks like it'll probably work until the Zella's amount.
We're not doing that right now.
We need to serve this to the user.
We can certainly tell it to download it.
A, control.
B, it's going to Turkcell.
Do we have a show?
Looks like we lost it.
That's OK.
Let's go back and rerun the task.
And I'm just going to refresh this to make sure it's like it's still here.
That's good.
So let's go back here and execute the one request against.
Our show was triggered a reversal on the top paying.
We didn't get anything, let's try.
All right, at the top of.
Let's see if we can be certain to get this.
So we look at the living off the land binaries here, I can certainly tell to actually.
So this is abusing the legitimate functionality of a legitimate windows binary for nefarious purposes.
That's what living off the land of binaries refer to this project right here.
Elbaz living off the land, binaries and scripts.
That's what it stands for.
Let's do it.
Certain zones, but you cannot you do so until.
Absoluteness has split.
Let's make sure we can put the right path on.
That is the right path.
Controlled editor calls it time control set the.
I believe that is the right syntax and then we just need what it's going to take us.
Let's say that I was like.
So here he pulled it down from a Web server, successfully saved it.
There are things you could pull a here.
Now we need to set up our together so control.
Scooter Libby.
And this is going to catch them a show once we pop the box around the homestretch, guys.
So at last night's.
Set stage show options.
Said, I'll post zero our says system, that's what we created in the show.
This is what we used to write here.
So you go back to that.
Control should be so Hobsons.
And it will change the exact function to threads that a process.
That way, if the user happens to close the application, it won't just destroy the process, it'll
just kill the threat inside of the process, which helps for persistance purposes.
So let's go ahead on this.
I got the handle set up on the correct IP port.
Let's close this out.
You need this money anymore.
The three.
Control the five got to show.
See you running in 64 architecture and 64 bit version of Interpretor you can backgrounders.
And so now we the session so we can bring our post exploitation models against it.
Research suggests.
Experts suggest there is no for.
He's for options.
Listen to the idea here, here, which is one.
And then just like.
And simply comes back with.
Right, so we got a few options here.
Which one do we use?
These are newer exploits, so 16 of the year.
And it might be vulnerable to these because look a little bit tinea.
These two might also work, although something is deprecated.
What's going to try this guy right here?
If this doesn't work, we can go down the list, kind of like we did before.
Should be placed into.
Snow options.
Our host is set to meet the doctors, not tell 070 to change that.
And it should be said that van.
Especially to one.
I see sessions that show.
It's one that we should have everything at once, it does work on 28 excellent targets to achieve.
Again.
Exploit this puppy for four four four four, assuming that the firewall allows this out.
Because the truth are we system.
We are excessively asking to escalate our privileges on this box, and I think it was pretty difficult,
but we got through it and we made it home.
Next thing I like to do is I like to be able to go into the box and then we will finalize it.
I forget which exact command we used to do this, but get going.
We can use this to, first of all.
Anybody, RTP and then actually connected remotely so to get lead E to anybody.
Sorry, but typically.
And right to that post the hole through the firewall and we can create our account, we can get.
You should be able to do this, since we are a system great until D.C., until they come up our desktop.
Let's do X free desktop.
It's free, I think, what it's called.
Yeah, that's it.
So I can see the usage options here.
I believe there is something for auto recycling Web sites.
Now, as you can see, this smart sizing, what it's going to do is it's going to scale the remote desktop
window to publicize.
So we should have everything we need to connect.
That's right, zero extra.
These are Bonnie.
See Justice Sandra.
And smart and see if that works.
We trusted the birth certificate.
Yes, I do.
This is Arctic.
I'm super OCD, so I've got to make this try to preserve the aspect ratio as much as possible.
So here we are.
Here's a severely compromised looks like it was the Athens time zone.
And we could see everything dead.
It's the directory that we walked out of.
And you could easily just drag them over now and look what happens, you'll see actually why some of
the stuff didn't work.
Example, if I direct this over.
Saying that it's not compatible.
We clicked hematuria disappears really fast so we could just try to figure out what's going on there.
And you can see here it's telling us the appropriate usage, we didn't see this, you know, when we
did this from the show on our Tucker machine, but this is shown here on this interactive window, which
I like kind of interesting.
Something did happen.
I saw this window back here on Flicker.
Look at the last modified time.
Of course, the problem is we're already system, so let's it this.
Users, user accounts and let's look at.
That's right, because I'm not a member of the.
High school.
And then the minister said, I can't add him to the desktop U.S..
Groups.
And as he told us, this is Thomas.
Yes, we need to put him in remote desktop.
There it comes from a desktop users.
There we go.
And let's try it again as Thomas.
Sweet is a U.S. flag for the top of the flag portion of this.
Still like this.
Described in that part.
It was a drive and it's just the opening running of the stuff.
You see, you know, it just hangs.
So, I mean, I just want to say there's another way we can get there through this path and it doesn't
look like it actually works.
Right.
So that's it for this this is privileged escalation technique, if you actually want to look at my dad
to see what we did in minor.
It's the enterprise is what we used and we gave initial access.
Not through a drive by compromise, but a combination of exploiting a public facing application because
of the display vulnerabilities while the underlying operating system was patched.
So that actually escalated our privileges, but we gained initial access through.
And we use the administrators hash to get into the operating system or into the web, and then we're
able to escalate our privileges once we do that.
You can see there's a bunch of different things here, this list out there, but.
This is basically how we were able to compromise the application to the recommended mitigation would
be the patch if the if the server were patched and weren't running.
Remember, version of it will be a cold fusion, then make this task significantly harder.
And also, I you know, any viruses running.
We can check that liquid.
So any any grass.
Even stalled.
Because pottage is completely naked.
Yeah, there's like nothing here.
So it's like somebody just installed it and threw it on the Internet, so yeah, antivirus ideas and
maybe having like a saw a security orchestration and automated response tool would also help.
But there's nothing on this box.
That's also what that company is letting led to it being compromised.
All right.
So that's it.
In the next lecture, we will talk about problems, escalation, and we will continue to move forward
on our next system.
All right.
So you go by.