OK, so we've got access as the user account for the IRS, you can see these are the files inside of
the local webapp.
What can we do?
We need to get Hektor.
And we can see Hector is actually a member of this remote management users group.
So the next thing we need to do is figure out what is this remote management user's group?
We're going to do it up, Google.
And let's see, it's a remote management user's power.
So remote, he writes about your meeting is basically SSA for Windows.
So this user may have the ability to move laterally to other accounts, which is a good thing to know.
So let's just go back here and let's think about this.
We want to gain access as this particular user and we actually have creds.
If Hector's creds, we looks like Hector's Kretz right this right here.
So we might be able to use these creds to log in as Hector.
Right.
All right.
So how do we do that?
Well, first, we probably should get power show installed on a local box.
If you go to power, Shell, GitHub, actually partial Linux talk almanac's, you'll see this long post.
And if you take this stuff right here, you just click copy it.
A copy of the clipboard.
Let's clear this.
Toisa, torture the printer and it will try to install Power Shell and actually launch it.
There we go.
P.S. version table,
we now have power show one our local box.
Isn't that sweet?
Yeah, a partial version seven is actually cross platform.
It's not just a Windows tool anymore.
I don't know if you knew that.
A lot of people don't.
But I would.
Version six actually is when they moved over to the dot net core framework, which is different than
dot net because dot net cars, cross platform and version seven is the latest iteration that has almost
all the functionality of the previous versions and more more command, lots more modules, more everything
more awesome.
All right.
So control lazy.
What are we gonna do here?
What we're going to play.
All right.
So how do we do this?
Well, let's create some variables.
First user name equals Hektor.
User name gets.
We have Hektor Sweet Password.
What is the password?
We need to convert the password to a secure string.
So how do we do that of it is zero.
That's zero.
Where in Paracha get help and we can do like Shakya String.
Yes.
So we have a command team from shitkicker string and two chicken string we want to do to secure string.
Right.
Convert to secure string details.
And I said tapped autocomplete that in fact if I backspace this out and I said tab here, trust me,
all of the options I have and if I just did parameters like this and then I hit start, you know, just
show me all the parameters.
So now I know which parameters I need to pass to this tool to convert everything to a secure stream.
Right.
That's what this does.
It's going to convert the clear text password into a secure string so we can use it.
And we have it as plain text, which specifies a plain text trying to convert it to a chicken string.
So we probably want that and then force, which confirms that you understand the implications of using
the as plain text.
All right.
So let's just do this and let's go up.
Oh, by the way, one of the things you should do is you should actually do update help.
So you get the latest help files for backup.
And if you don't do this, you'll actually have incomplete help files and would be very difficult and
frustrating when you're trying to figure out what's happening.
So control a bracket in terms of what this does here, convert encrypted static strings and strings.
It can also convert plaintext strings to shake your strings.
Right.
So that is precisely what we want to do.
So let's go back to where we were before
and we want to use as plain text.
Right.
So let's go over here and let's type let's say password equals convert to secure string and put the
string in there.
So control and shift the, quote, cat creds.
Cat Kretz.
Let's grab this password here.
Control shifts, sea control should be put that in single quotes, control, shift, a coat of paint,
hold down control right out to go to the end and tell me what to do as plain text and force no error
messages.
So with your password, we've got that nice and probably also going to do the hostname.
So we'll save the hostname
as a variable fidelity.
All right.
So now we've got a secure street.
Let's go ahead and build our credential objects so we can make use of the string and execute commands
as Hector on this local box.
So I ask you to get out of here and let's.
Do you get help actually get help.
P.S. Get let's see.
This is the credential and you can see there's a get credential command.
So if I do get help, get a credential parameter star.
You can see it belongs to this class system, the automation system, that management automation has
put a job that's called new object and will name it
credential was a new object system, dot management, dot automation, dot press credentials.
And what we're going to do is we're going to put username and password.
That's because I put an S there should just be a credential, a nice credential.
And we say we've got this object.
Now, the last thing we need to do is invoked the invoke the command on the local box.
So again, get help.
Invoke command.
That did a little bit too much, let's just do your vocal command.
Yes.
So what this does is it will run a command, run the command that a local or remote computer and returns
all output from those commands.
So we're going to actually run in full command from the perspective of the victim machine, and therefore
it will return the results on the local machine, the vector machine, to ask the attacker, OK, that
makes sense.
Parameter star.
Let's see what parameters we have here.
We've got a lot.
We really need a few.
So allow redirections milpa application name argument list.
No, no, no.
OK, computer name.
Let's put that in there so we can say invoke command, computer name is hostname.
Get that from here.
Right.
Let's put this parameter in.
What else do we need?
A page down.
Credential specifies a user account that has permission to perform this action.
The default is the current user.
So let's go ahead and put this in credential credential, credential the variable forever that holds
our credential object and then script block and specifies the command to run and close the command,
the curly braces.
All right.
This is exactly what we want because we descript block.
Yes, we can now put a command in here and we're commanded that.
We want to put it here.
Well, what about a command Hektor?
What command do you think we would want to run as an attacker, as Hektor?
Think about this for a second.
We want to get in your shell.
Right.
So if we were the effects of a Web request to a two point four, four, three, again, we will download
our show, but we'll download it in the security context of this credentialed user, which is Hektor,
which means we should have a show as Hector.
All right, let's try it.
So we'll say IEX, I invoke recall, invoke expression and then request 14 10
volt power.
Shall TCP use basic parsing?
And before we do that, we need to make sure that we're listening on board for four three, because
remember, this is going to try to connect back and forth for three.
So control a shift robocalling zero hour wrap.
And by the way, the reason I'm using oil wrap, if you do are is a tool that gives us the UpDown functionality.
So if you throw at cash or I'll wrap.
Zero at search, I'll wrap.
See, borderline feature come in line rapper, this means when we get our show back in the witness box,
we'll have the up down arrows.
If we don't pass that Katara wrap will lose that.
And it gets really frustrating when you try to navigate on the box so we don't throw our whole rap in
that cat.
No, don't resolve those names.
Make it verbose.
Listen to import 443.
All right.
And then let's do it because it works.
All right.
It looks like we forgot that.
It actually tells you exactly what we forgot.
Missing closing parentheses right at the opening parentheses here.
We missed the closing one here.
So let's just put it in.
Sweet.
You know, Hector, as you can see from Hector here and from here.
So now that we are Hector, we need to find a way to move vertically.
So we did horizontal escalation, proposed escalation, and we're going to move into the vertical escalation.
Remember how we did the horizontal escalation?
We found clear text credentials inside the database.
Of course, the conditions for there were they were hashed, but we were able to obtain those credentials
by exploiting a publicly facing Web application, which is this Fidelity application.
There was a single injection inside of one of the parameters, actually multiple parameters, but in
this case, inside their search, their catalog database.
And we were able to exfil the MySQL, that user's table, which contained those hashes and of the hashes.
It might make it a little bit difficult to crack.
They they salted either.
So I just want to get you up to speed on what we did and what we're doing.
And this is typically what you would do when you're typing up a report for a pen test.
All right.
So in the next lecture, we are going to escalate from Hector to a system that was either.