The first thing we want to do is disable the firewall, so let's go ahead and do that, we can use net
as each do that.
All right, so firewall is now off and let's see how we can enable RTP to a command line.
Here we go.
This one works for me.
All right, that's super annoying.
All right, so that was added and now we can do is look at who's on the spot, right?
So we can say net user administrator.
And let's just change your password.
No, we are system so we can do this suite now.
We're going to do is going to create a new
a new tab.
And we're going to use our desktop to do this.
And I want to create a new one down here, new pain so we can build this out.
Let's see, what are our options here?
Username nothing really interesting.
By default, the administrator actually has already rights there in RTP group, so we don't need to
add them to the already P group.
Let's just try to connect to this box.
We already p make it big is the fingerprint of the server that we want to do that?
Well, we know this is fidelity.
This is how we know we're connected to the right server.
The service compromised.
We compromised it.
We know what we're doing there.
So we trust the certificate.
All right, just log in as administrator.
And then you pass what we created.
Very nice.
The first thing I want to do is just confirm the Windows version.
Windber.
We are here.
We are actually out windows, 1719.
So, you know, we heard about Windows 10, Windows 2016.
It's actually 1719, so that's kind of cool.
And of course, if you were playing Xbox to capture the flag, you could just grab it here.
But that's not what we're doing.
First, let's look at the filesystem.
Here's the root.
And here are the source code for the webapp right.
And this is what we gathered through sequel injection.
He has the source, correct here, he uploads the six, somebody tried to upload some of our shows here,
but there's nothing in there.
So it looks like the box creator, which is showing people that might have looked there for Rachelle's.
Bedbugs and a few other things we're going to say, check this out.
Let's close this out.
Let's look at the registry first.
And if you look where we are, misquotes at the top.
We are in the global machine system services and we're going to go down.
The service was compromised, which was this guy.
You can see here the image path has already been overridden, right, doesn't contain a rubber shell
here anymore.
You can see some of the parameters, but this is basically what we saw from Power Shell and this disvalue.
We overwrote the image path.
But the interesting thing is, I guess so we've got to ask.
We can go to the manager.
And if we drill down.
We can get some interesting information here, so he go over to logging.
You can find out where the logs are for good if you log files going here.
There's really not much money, right?
I mean, these these attacks right here, this came from us and.
This is when we were accessing the aband page.
Notice you don't notice any other sequel injection.
That's because the post request paillard body isn't logged by default for year.
So that's why, you know, it's pretty dangerous.
If you make this big, let's see a few other logs in here.
We don't really see anything.
Now, let's try something interesting.
Let us run against this box again.
Jose,
can we do that?
And say, let's do this and let's actually not run such, run their search.
Control over their search for control are every time you press control or it will search the history
for whatever your typing.
And I just want to see if we can get these logs to show up in RTV session.
So, I mean, we're actively scanning look at the timestamps.
Interesting that nothing updated here or did we go took a while.
Well, now you can see this is our dictionary attack against the server, right?
I mean, these are all of the folders that we are requesting.
See the fields right now by default, he post requests.
Body isn't logged by.
I guess you could select the fields by going here.
But, you know, there's no post request body.
Which is kind of annoying.
Now there's different models you can install, I believe, to get this to show up by default does not
show up.
And this is bad because people like to burp.
You'll see them coming our sequel injection, and it will fly right under the radar.
Let's go back to Berp C-code Elfy.
Right.
This is where we extract the database.
This is something you'd want to see if you were a server administrator.
Control space.
Can we send that request?
Let's go back to RTP hillocks, do we see it?
This not against the search products that look for that search products be.
I mean, I'm not seeing the attack string's.
We can even make it a little bit noisier by doing this.
Right.
I'm sure I tagged along with something we can search by now, we can search for this hashtag Ezekial
I.
Hashtag ask you why it's not there yet, but let's see, close the logout, reopen it.
Refresh.
I'm not seeing that anywhere.
It's possible we need to wait a moment, but now that should have definitely popped.
I wonder if I sent this to.
Intruder will show up control, I can tell you that I.
Positions.
Take this out.
That is a position that we want to use.
Let's go to payloads, let's load.
The single injection payload.
Cyclists payloads.
I think maybe it's their.
Schoolie, generic.
All right, let's see if this works, StarTalk.
Very interesting is the free version, so it's going to be kind of slow.
That's OK.
We don't care if it's low, we just want to see if we're getting.
Any of this stuff being logged on the server, because if you see this, you should be concerned, right?
Let's go back to RTP.
And I'm going to do is I'm actually going to stop their search so that we don't kill ourselves with
too many logs.
Jose, let's go back to the already P.S..
It's already 40 megs, and let's see if we can find this.
I mean, these don't look like a tax drinks.
This is a post request you can actually see there's the post request coming from our machine with this
username string.
Going to this destination.
For such products and, you know, a touch of the 151 bites, but it doesn't doesn't really show you
anything.
I mean, this attack is still going on.
Look at this, what if I search for this?
What's something we could search for or one equals one?
0% percent 20.
One does do that or present 21 as a search for this or percent, 20 and then one.
Close this out, and I really want to see this in the logs, and I think we're going to see it.
Nope, not there.
That is
actually actually terrifying.
There we go.
OK, so this is actually our second attack earlier and look.
No bailout, we don't see the sequel injection attack because it's in a post request body, that's only
load's what's in this header field here.
It's not loading what's down here.
There you have it.
I mean, you could Google how to enable this IRS post request blogging.
And I think advanced logging, which you need to turn on, which isn't owned by default, so that's
the box, we just popped it and I hope you enjoyed this one.
There's a lot of stuff in here.
You probably don't want to watch this lecture many times over.
And next lecture, we're going to continue to build out this course with some more material.
There you have it.
And I hope you enjoyed this lecture, right?
Thank you.
Bye.
Oh, by the way, of course, if you have any questions, just, you know, leave a comment or reach
out to me and I can definitely help you.
You know, there's a lot in here, so you can want to watch it multiple times, most likely.
All right.
See you later.
Bye.