And let's use one piece now of it when piece GitHub.
The first it takes you here, right, and this is pretty awesome, you think, oh, this is cool.
You know, we've got some exes, we got some bats that net 4.5 is required.
If you click into this, you'll see some solution files, which is an executables.
You might be wondering, like, how do you run this?
Now, it turns out you actually have to compile this in visual studio, which means you need to, you
know, download Visual Studio, set it up and you could do that and actually have a Windows host here.
And I can walk you through that process, but it's a lot easier if you get it pre compiled.
And so what we're going to do is we're going to go to a new relatively new collection called the Short
Collection, Sharp Collection GitHub.
This is just a collection of applications that were written in C, sharp and pre built them in all of
the required dot net framework versions.
So, you know, this is really nice because it's an automated system that just, you know, checks for
any new comments against any of the major C sharp repositories.
And it just adds them into this rebo.
So we've got stuff for like, you know, sweet potato, which is the local escalation for Windows boxes.
We've got a seat belt, which is kind of like Power Up and Watson.
And it's also on the same category as one piece.
Right.
This is local when this escalation based on these configurations and then there's like S.T. cards,
which is kind of like Mimecast, but a little bit better with a bunch of other things.
So let's go ahead and find one piece.
But before we do that, we need to know what Donnette version we're at.
Donette version command line.
So I can look at the registry.
And it looks like if we go here, we should be able to find it.
Copy that and we can actually go into the registry like this.
So, you know, I just seeded into each local machine.
That's because Powell has this thing called providers, which allows you to navigate various data structures
just like your local drive.
So this is really, really cool.
And I'm in the machine provider are just backspace, all of us out.
That didn't work.
Maybe it's not there.
Let's try this one.
Nope.
I see Microsoft that works, let's go big, crazy joy Lefrak forward slash net.
So it is just net framework set up.
And there we go, we have version for.
But we probably need to see the NDP.
Yeah, so we're voting for.
And we can get an exact version here, four eight zero three three seven six one.
So we need to know that we're at version four because now if we to short collection, we can grab that
diversion.
Now, we don't know if it's a 64 bit or or 30 bit.
Let's just try a 64 bit application for now.
Copy lake location
AISI zero, get cajoles, shift me.
Enter.
Nice, we've got it now, let's just make sure we got it.
No, that's not right.
So this e-mail document, if we actually bless this, you'll see it actually has a Atima document that's
named as Daddy.
Let's fix that.
Yeah, we want the raw link.
Right.
Click Kovalik location.
That's why it's always good to verify what you download with the file in zero.
We get to be in there.
All right, so.
What happened here?
You know, we're probably at this link, yeah, this Rollingstone still isn't what we need, we need
this download thing here, because if you look at the stats part, you see it actually ends in that
Yuxi.
This one ends in war equals true.
So Vimla, poppy, like location.
Let's remove the other ones.
We've got one piece found one piece, and this is a 30 but executable?
Well, it's a P thirty two.
It's actually 64 bit.
But the point is, it's a dot net assembly.
This is exactly what we need.
And our Web service told us out of this directory, out of the home box control directory, import 80.
So back in our show, we should be able to get this you get which is an alias for invoke Web request.
And this will allow us to download this file 14 10.
Now, before we do this, let's make sure we are in the right director because we run one piece from
a restricted directory.
It might get blocked by AVY.
So we want to make sure we're in the right directory before we try to run this.
Let's go back to Hectors directory.
Let's go back to documents.
All right.
So that we get to 14, 10.
When BP's daddy acce oh, when BP's daddy exi nice, here's one picture here and you can see the HDB
request went through so that we can run it,
see what we get.
All right, when peace is finished, it took about one minute, maybe a little less than that.
So I see a lot of red and that's good for us because it means that usually something we can grab or
exploit or abuse.
So we get one piece, let's start.
So Red indicates special privilege or an object or something as mis configured.
Right.
That's generally what we're looking for now, just to start, you can see that there's no Paracha logging
enabled, right?
So we can use Paracha all day on this box in abusive ways and it will not be logged.
So that's really good to know.
We also notice that there's a history file called console history.
Right.
This is interesting because it's kind of like a bad history by the control AC.
I do.
Let's see if I go to my home directory.
I do, cat.
Bash history.
Enter, you see, this is a catalog of all the commands I've been typing, right, this is on Linux.
Well, on Windows is something similar in Paracha, and it's called this console history.
Right.
So this might be interesting.
If we can see what commands the user typed, we might get some clues and what we need to do right to
compromise this box.
It could be clear text credentials that were entered as arguments to specific commands.
So much goodness that can come out of that.
And let's just continue to scroll down.
By the way, lapse is not installed.
So that means if they this is the local administrator password solution.
So, you know, if we had multiple machines that this was a real engagement.
You had multiple machines and they were all using the same local administrator password, then you can
use that to pivot from one machine to the next.
And there are some other things that are not enabled that's going to definitely help us in our exploitation
of this machine.
You can see here we can right.
We can actually create directories on the C drive and there's no way we detect it.
That's awesome.
So we can basically work under the radar.
Right.
And we could go down basically.
I'm just looking for the red.
I have access to the home folder already knew that, let's go down, go down, and this is interesting,
modifiable services.
So I can't modify a service binary, right.
But I can modify registry locations, what it's saying.
So this is interesting.
A service typically runs this the system.
And it's mapped to a binary that exists on the file system somewhere, if it's standard user has right
access to the folder containing the binary, they can possibly replace it with a nefarious process,
restart the service or restart the box.
And then if that executable happens to be interpretor or some other evil binary, then if it shovel's
a shell to the attacker, the shell will reach the attacker with the privileges of the service account
that is running the binary, which means the attacker would have system access to the machine, which
is just like administrator's God mode.
Right.
We don't have that ability, but we can write to the registry.
And that's that's what this election is about.
You can see here Hektor can take ownership of all these keys.
And we're going to confirm this using Access Checker, which is a source internal tool.
But this is very, very interesting.
Right, because if we can modify the image path of a binary in the registry, we might be able to gain
vertical privilege escalation that way.
Let's keep going down here.
Let's see the other hijacking.
Nothing there, nothing there.
Yeah, nothing else is really interesting here.
That I'm seeing.
This bar did exist unattended example, but you can see the password was deleted, sometimes you can
find it in these unattended files, which is just a way for network administrators to automate the deployment
of posts.
And when you automate things, sometimes you need to put passwords so things happen automatically and
remnants of it can be left behind, which you can retrieve from here.
But it's been removed.
There we go.
So let's go ahead and do get whoops get content content on that file that showed us.
So the of history, these are the only commands that are executed, that's quite interesting.
Let's go ahead and look at these commands.
Let's go ahead and get Access Checker by the internals on here so that we can corroborate what we're
seeing in one piece.
I always like to use multiple tools to confirm what I'm seeing here.
We go to CNN's ballot access check.
Copy location.
Go back here.
Zero.
We get control.
Should be all right.
Zero unzip access check.
So now we've got this file in the route of this Web server, which we can now pull from Hacker's Machine.
So let's do that.
IEX, your request for 10 access.
Check this one, a 64 bit version.
Use basic parsing.
What am I doing that's not what we're supposed to do, we're going to get to get it.
And the output is going to be access check 64 taiyaki.
All right, so it looks like.
We have the request here.
We didn't get our prompt back.
All right, so it looks like something broke.
Now, you might say, oh, no, we just lost our shell, right.
The worries right now, I'm glad this happened because I want to show you how easy it is to get it back.
Listen, to put 443 go back to berp.
Patrol space.
We're back here and we're going to talk about everything back, right, he's an ethical sector.
Because fidelity.
Password to to which you get a string credential object is there.
And then before we run, the evil command need to make sure we are listening to port.
Four for three again to get our public show, and we couldn't execute it.
Now we're back in business with Hector.
Dashed out to file copies of the request go through this time.
Sheldon, hang with it.
Here you see it.
And can we run it?
Think I have this going the wrong way.
Yes, we can.
So what do we want to do here?
Well, we just want to verify what we saw in one piece, right, with the registry rights.
So let's see if the registry.
So we run access, check her email account name, and then we have all these flags we can run.
OK, later, registries.
This will show his name is a registry key, so we can then specify a specific registry, key mortgages
protected from One-Piece.
Show only objects that I write access to, I can recurse and suppress the errors that looks like they'll
be good.
And then, of course, they need to put the registry can, that's the one we got from One-Piece.
So we'll just put it in.
Yeah, so, again, we're getting pretty much what we saw from one piece with riot control, you know,
R.W. Redway, Hector, Hector can write to this registry can.
Right, you know, to all this.
So this is going to be interesting for us.
So let's go ahead and do some stuff here.
First one I want to do is I want to get all of the registry keys that are relevant to this.
It kill him.
Let's go to system current controls that services.
I think they start at the end to see all the services right?
I just look at all the services on the box.
Here we go.
Let's say that the variable, you name it, services right now, we can just type services and get a
list of all the services.
So these are all services on the box.
Now, you know, I want to make sure I only get services that are running a system and that I can restart,
right, because that's what we're going to need.
We want the service to run a system so we can escalate.
We need to be able to restart it so that we can, you know, execute or exploit.
So what can we do to do that?
Well, let's go and start looking through some of these fields.
Here we go.
Let's like the object name field contains the account that the service is running at.
The service name is P.S. Child name.
So child name search is a service running our system and it started as four.
So we need to get a list of all the service start numbers.
Let's do that real quick.
Service start type values, that was better.
Here we go.
So we want Manuell, this service does not start automatically, it must be mainly started by the user.
So what type equals three, four, start?
Let's build this query out, we can take services.
And we can pipe it to where object, this is kind of like a filter, and in this block we can say we
want to get the services returned that meet this criteria.
The object name is equal to local system, right?
By the way, this little crazy thing right here, this just means take the current object passed along
the pipeline is the pipe.
This is called the pipeline.
We're passing the results of this object into this object.
And this actually literally says this object, the current object.
Take this property from the current object, which is object name, which contains, you know, the
account, destroying the object and only return the services that object running its local system.
Right.
So all these should say.
Local system for the name, for example, would like a select object object name, yeah, Eco-System,
right.
And these all of the services, but we also want to make sure that the star type is Manuell.
So in here, we can put again the current object start is equal to three, right?
And that's what this is for here to start.
So these are all the services running as system that have a manual start so we can actually set this
to like possible I say is hackable
right now.
We can say is hackable.
The list of all those.
Now, this gets interesting, how do we determine our permissions, how can we determine I mean, we
can write to these services, right?
But we need to make sure that we pick a service that we can actually restart.
Yeah, there's a difference between writing to the registry and restarting a service.
Those are two different permissions.
So the way to find that out is by using a built in Windows command called the ESTIE show.
So if we go here.
Here it is.
The services security descriptor using the security descriptor definition language.
This will tell us the permissions on the service.
So let me show you something.
He says, you can do something like this, right?
Let's try this for the SD show, expect a service here.
This one w a you serve.
Did that work because it's trying to convert this into a command light, so let's run it like this,
it's one command with the S.E.C. and then try it that way.
There we go.
It's all we have is this really, really complicated looking security, descriptive definition, language
and what this means, this is a discussion discretionary access list, OK?
And this means that it is an except it's a it's an accepted access control list.
Each of these values and here are pairs, so this is one pair.
This is another pair.
This is another pair, another pair.
They're all pairs and they all mean something.
And it's stuck at the end.
Means something to this means authenticating users.
This is both an administrator and this system counts.
I know this.
Just Google it, right?
If you go to like Steidl, stop, start, restart permissions.
Try this one.
Yeah, so this is the one.
So, again, you can look at the progression that shows you this and you can read up on the spot you
see here, Arpey inservice start.
That's what we want.
As are the other ones, like a dedicated users system.
So we want everything that has his Arpey because we want to make sure we have permission to start the
service.
Right.
So we want this every service that has AP and is for authenticate users because we are an authenticated
user, we are not about an administrator and we are not running a system.
So how can we do that?
Well, let's see.
Let's look at this is hackable thing again.
What do we call it is hackable, right?
If you look at the child name,
all the services
that are running a system and that we can that are such a manual, if we could create a loop to get
to all these services right, then we can look to see.
We can basically pass that service name to that SC show command and then do some projects to see if
have an people flag there, which means that we also have permission to restart it.
So basically we're saying I want to find all services running a system that has a manual and that I
can restart.
Let me show you what I mean so I can say for each just call the variable when each iteration service
in is hackable DOPs child name, whatever they do here.
Well, I want to print out that EDL command and I served in a variable called S DL.
We're going to say C and D for which I see a C SD show service.
Right, we're passing the service on each iteration to this command is going to be taking this variable
and then we just run a little if condition against it.
We'll see, like if FTL is a match for some projects, we'll fill it in in a moment.
Then we can just basically say put out that service.
Right.
So what are we ready for that rejects?
Let's go back up here.
And let's grab that SDD output that we did earlier, so I actually can't go back far enough to get Tuckerman's,
what I'm going to do, we'll grab this right.
So we're going here.
You will click copy.
And they're going to go to her and they show you how we can build right to select this.
This is a great site for building projects, I'm going to go and delete everything out of here, delete
everything out there.
OK, so here's the thing.
We just want to get.
We want to search for Arpit right in any number of characters until we get to see my call instead of
calling, I call in.
So we did something like Arpit.
These characters all look like they're either the capitalized.
So we can say character class either capitalized so we can say any number of characters, either Z as
of the star does.
The question mark makes it optional.
And then what we want to do is we want to look for the three semicolons and, you know, that's what
we want to match right here, see how match this one.
I didn't match anything else because remember, this is not an administrator.
It's a system.
You don't care about those.
Really care about this, so this works, let's grab it.
All right, let's pause here and see what happens if we have any typos.
Yes, that's what we want to say, to say that as a variable control a warning, this can start.
These are the services we can start, so let's just start with this one, since we were looking at that
one earlier.
Let's do you get item property?
And actually, let's see what we can type of this, let's go back into power, shall a local box get
help, get item property damage parameters.
Star.
So really, what we only need is just, I believe, just the path, yeah.
Specified the path to the item.
So it's not the path to this item.
So HLM System, Current Control Set Services, WUSA, you serve.
All right, let's make this big picture.
Here we go.
You know, it's the image path here.
So our goal is to replace this image path with an arbitrary command.
And then restart the service, since we have restored rights to the service.
So let's try it.
Let's go back here, set out on property and let's see what parameters we can do it set out in property,
get help set item, property, parameter start, see?
Name specify the name of the property.
OK, we want that went that we want where we want.
Let's make it big until I see your mother's image path.
That's what we want to set so we can say image path and I believe there was a value.
Let's go back to path.
Type value specifies the value of the property up Detroit.
Right.
Control easy and thus do value and set it to food.
Right.
Just to test that, we can actually write.
To this path and to get item property.
Bam, making right now, the interesting thing here is that you can actually discover in this host that
there's a job that runs that continually overwrites this image path.
So we only have a few seconds to.
Essentially, co-star in that cat payload on our local box downloaded the vector machine into a wireless
directory which bypasses ad blocker, and then you execute the binary because if you wait too long in
really just a matter of seconds, then this is this value is going to be overwritten with the original
with the original image path and our show will die.
We're also going to discover after the show we're gonna have to quickly create another show from that
from that shell and a new process so that we can have persistance in the box.
And I'll show you what I mean in a second.
So let's go ahead and do this first.
Let's make sure that this is still here.
Still set of.
All right.
So let's go ahead and move into our wireless directory.
Let's see Windows system.
Thirty two CPU drivers color.
So if you Google this directory
and we go to let's leave this page at Blocher bypass within.
What type of my GitHub?
List of generic methods for bypassing Blocher.
Here we go.
Now, what is App Lucker?
The application white listing App Locker has been with us for a while.
Yeah, so Habchi, you control which apps?
Can be run on the on the operating system.
So it's really good, of course, when you want to, like, basically say these are only the approved
apps, anything other than this won't be able to run.
This works because these directives are typically permitted by bloggers.
If you can get something bad to run out of these directories, then you can potentially bypass outworker
and float under the radar.
So as we're going to try to do here, first, we need to get Ngarkat posted on our local box.
So let's do that exodus locate in Sidiki.
We found it.
Let's see here.
Got this one.
All right, so we've got Ngarkat posted here.
That's sweet.
So let's go back here to Lazy and let's run it again.
And we are going to actually save it as I explore why I explore, because
that is the process name for Internet Explorer
I cannot type.
Yeah, Windows Internet Explorer by Microsoft, right?
So we're also trying to bypass, you know, any static strings that might be in place by masquerading
as a benign application to that.
Now we have to explore, but this is really not Ngarkat, right?
So now we've got the cap.
Let's go back.
You can notice if we try to run this again.
Now it shows that it's been overwritten, right, so we only had a few seconds to get this done, so
we need to overwrite this again, but this time we need to overwrite it with our next payload.
So this is what we're going to do to set up a property.
Instead of this, we're going to put in this.
Joseph P..
Copy control should be.
And what are we going to do here?
Well.
We want to connect back to our machine for forgery and we want to shovel power out to us right then
when we say get out and property, when the service restarts, it should cause that cat to connect back
to us and point for further and send us a powerful shell back over here.
Zero oil wrap for three.
And let's see if we can do this.
Start service could be the you serve.
And nothing happened, and if you notice.
Everything I read back, right, and control is that we need to do this from that local machine directory,
so we go back here.
Let's go back up.
Let's go back into this directory.
Right, so we want to do this again
and then get the item property, see, now it looks good and we want to do the start the service.
Croisette, do we have a show?
Still no show.
Now, why is there no show?
Toisa, let's see.
They get the name of the binary, right?
I explore that he.
Oh, let's see, I explored at that age, yes, this is Ngarkat, because I run Helpern and you can
see that's what it is.
Hmm, interesting.
Why isn't it working?
This man really does have to play with stuff.
Ten, ten, 14, ten, four, four, three.
Power shell.
There's Paracel.
Still no service being started.
Misspell the name.
No, it's the right name.
It's starting from the wrong directory.
You still said.
You know, we're running again, so let's just see if we can manually.
Do this, so I'm going to try to just run this.
Isn't that cat back to me?
Without the service starts, I'm just troubleshooting it to figure out why this isn't working, because
it should work.
So that did work.
Of course, I'm still Hector, right?
But.
So this means we can actually run Netcare from that folder.
So that's OK.
Our syntax is OK.
What is wrong here?
It's like this got rewritten again.
Now, I can see PowerShares there.
Right, so this actually looks good.
You just have to restart service.
Oh, it's looking for the service name.
Now we've got a shout, you know, I don't know why it worked that time, it didn't work before, but
this just shows you why you need to do this now.
You will notice we are systems.
You might think, oh, great, we did it, we escalate the system, we did, but the show is going to
die in a few seconds because it's going to be overridden very, very quickly.
By the default image path for the way you serve application, so we don't really have a lot of time,
what we can do is it is time to watch this, see its dad.
So this is what we have to do to get this to work, set up for four, three listener control and then
shift to a quote.
And I'm also going to set up in Volpi fifty three dinars because that's also a part that's usually allowed
outbound in the target organization.
And so now we've got four hundred and fifty three listening what we need to do.
Is basically where we need to quickly just do a couple of things right.
We need to quickly run this again, right?
Get on property.
And it makes us a little bit bigger.
We're going to have to replace this image path and then quickly from a show, starting a show to connect
back to the show.
So that when.
This shell dies, will live in this process, which is a different process, which is a different shell.
OK, hope that makes sense.
In order for this to happen, we need to rebuild it.
So I'm going to go ahead and open up text at it and I'm just going to rebuild it so we can just copy
and paste this thing.
This.
Right, so we want to have this on a clipboard ready to go see.
All right.
So now we want to do it's going to be very fast when we do this.
Let's go back here.
Get out in property, we see their image path is wrong, set the path to our next listener, confirm
that it's correct.
It is now we will quickly start the service.
W you a you serve.
The show Josephite.
And now we've got to show a system so now when this shall appear to us.
It won't matter because we'll live in this process down here.
You can actually see that happen if you wait a moment.
It's pretty cool.
Right now, you can see the shells that.
The showstopper is Hector, but our system shows that this one isn't that right?
We live on Shamas lived on.
So that's great.
We've gotten to system.
Now, what are we going to do?
Well, next lecture, I'm going to you.
We're actually going to already be into the box and we're going to take a look around the file system,
the registry settings, the isover and the logs, so we can look at, you know, the artifacts that
were left behind through our stack.
Right.
I will see you in the next lecture.