So here we are in Tally, and this is the initial access, I guess you could say, the exploitation
lecture, that we're going to, of course, move into the privilege escalation lecture and then we'll
do some debrief, some Internet response type stuff, and we'll look at how everything maps to the minor
attack framework.
So in the beginning, you know, we need to make sure first that our voices started up.
So let's just confirm that it is.
Let's see, here's my machine here and it's going to refresh this to make sure everything's current.
All right, looks pretty good.
All right, so first thing we need to do is make sure we are connected right now, we have nothing in
this folder, but we're not going to to the VPN duty list.
There's no T-Mac sessions listening either.
So let's set this up now.
We're going to want to make sure that Tmax logging is enabled so that we can sort of have a script or
a narrative and we can basically have all of our commands copied to a file.
And then we can go back and debrief and look at that file, you know, to sort of review our offensive
activities.
And we can learn from that.
Right.
So we should install tiebacks logging.
If we do the team X.com file, we can see that we have the Shell ad saying we're on optimized logging.
But if you look for that, you'll see it doesn't exist.
So we need to grab Tmax logging first.
We need to set that up.
Let's go and do that.
All right, so first thing we should do is install this team plugging plug in manager and we should
add this to our dotcom file.
So let's go ahead and do that.
Let's over them tea mugs, dot com,
and let's just go down and add it.
Let's put it right here, right?
What else do we need?
Well, this is prefect's I to fetch the pocket and source it, so we need to be in session.
The name is VPN and this will be gone and I'll just press control ehi to source and control a what's
the prefix.
And I was the command.
I needed to fetch the pocket and source it now need to call in the repo.
Should the this Campath obviously needs to match what we have in.
The dotcom file, right,
so you can see here, we're saying it's located here, so we want this clone back to match that.
So let's go ahead and do that
right away to go to the front row, which is what works and looks like it did exit this.
What else do we have to reload the team environment?
T-Mac source.
File right control should be a very loaded it.
Very cool.
And let's see if this works now control a OK shift.
Yes, we are now logging our history.
Let's go full screen and let's have fun.
So first, let's go to VPN, Cyro Open VPN.
Let's make sure we connect to Hack in the box.
Means we're connected to 21 immediately.
Let's just save the target to a variable
and you can see they've got this variable saved in this session.
Now we're going to do is in the house, let's make sure it's active and I'm also going to show you how
you can use this to identify the operating system with the host county.
We want to ping four times and we want to ping the target.
So the TTYL basically is documented each up and documented with each hop to the target.
And we have one router between us and the target, and that's why it's recommended from 128, 20 to
27.
Now, if you're between 64 and 128 for TTL, that means you were running a Windows host, most likely
if it's somewhere below 60 for it's most likely a Linux host.
And if it's above 128, between 128 and 255, it's probably infrastructure running a specialized version
of Linux or a proprietary operating system.
So that is something very good to know.
It's going M.F. against this maybe favor.
Both seem the host is already active.
Don't bother picking it.
Make a difference as can you possibly can run run default scripts.
These are safe scripts that won't knock the box over.
Make sure the scans are verbose and that it shows the version number of the identified service.
So we want to get the version information.
We want to output everything in math and map format and we'll call it Tiida and map the open port.
Show me the reason.
If it's not open, I don't want this particular port range TCP ports from zero to six five, four,
three, five.
And then finally, the target
immediately we see Port 80 is open and we see a bunch of other ports, 21.
This is FPP.
We've got some SMB ports.
This is RBC here and these are Legacy RBC Ports, which are typically open in all versions of Windows
and four for five for SMB.
This is exposed.
So this might be a Vector 81.
We have a few other ports here, but I'm not too early on.
But let's see what else we can do.
Discovery
and let's see if we can basically browse that page.
Now, before we do that, we want to make sure that we get everything going through berp.
So let's open up our.
Make sure everything's filtering through.
All right, quick next, let's start berp.
Right, control ship, turn off, intercept proxy, go to options, scroll down, make sure you're intercepting
requests, control shift, target map is ready to receive the Cytori.
So what we're going to do is pop in this URL, how it's being filtered through berp.
And we should start to see things build out.
You can see already it's starting to happen now.
We want to get some idea of what kind of page this is.
You know, we could wait for the page to blow up.
We could wait for everything to show up or we're going to take a look here.
We notice in the response we can see that this application is running.
I asked version 10, which means it's either running on a Windows 10 machine or Windows Server 2016
or Windows Server 2019.
So it's either one of those days running ASP.NET.
And you can see here it's running Microsoft SharePoint Team Services.
So this is most likely a SharePoint server.
Now, there's another way we could do this to to identify what it is we could actually install WAP.
Polisar, which is an awesome tool built with, is also another good one.
Let's just install both of them because we'll need them later in this course.
I don't even know if I spoke out, right?
I did, I did.
It's OK.
Google fixes typos.
All right, so we want the extension for Firefox.
The pipelines were installed by George W w to close it out, let's get built with the.
These are both have been added control w to close it out, and if we go to appetiser and built with
oh, there we go, just take them on it.
So built with is now showing Microsoft SharePoint and saying it's 50 percent sure about their Web server
software as a service.
Microsoft SharePoint.
It can also identify a SharePoint by this icon here.
Also, if you take control, you look at the source of the Web application, you'll see it, says SharePoint.
Now that we know with a high degree of certainty we're working with SharePoint, we can start enumerating
things related to SharePoint in maps can finished and you'll notice it actually says SharePoint services
in the certificate.
So we have high, high, high degree of degree of certainty that this is the SharePoint server that's
going to look at what EMAP returned support 21 HTTP joining the Microsoft FTP that says the system is
Windows and T, which it's probably a false positive since their point doesn't run on Windows ninety
four.
There's a favor can so you could say it didn't say SharePoint in the source or in the Chicopee response.
You could pivot off the hash in Google to see where Marzotto to see what other web pages are using that
feedback on and then potentially identify the browser technology that way.
Alternatively you could download the A con and then go to look for it.
This is the feedback on here, right.
I can go right click actually have acted out of favor.
I think I would have to go control you.
They were gone.
Yeah.
Down this way and then I'd go like right.
Click and see the image and then I would go to Google Images and do a Google image search.
So Google is it Google dot com images or is it images.
Dot Google dot com?
I'm not sure yet.
I think I think this is it.
Yeah.
I think if you click this camera right, you can upload an image and then you could actually up of the
image.
So for example, if I went here and I said file save image ads, I would put it in the right folder.
Let's call it Simcock, it's called Khaleda Icko.
Not seeing it for some reason.
Maybe they can just drag and drop it in here.
Try dragging an empty chair, OK, we can do that.
Did I not save it?
Felde That is really weird.
OK, I have no idea why that's fine,
but let's not go into too deeply anyway.
You get the idea, you upload the image here and then you would find out what other pages are using
it.
So here you could of course, you would click sign and you could put a sign in that way.
We don't have any credentials.
So this is not going to help us much.
Let's cancel this.
For one, unauthorized, of course, let's go back and let's see what we can do here.
So we already knew about Port 80, Port 81, that's a new one.
Ever heard of that one yet?
These are all the assembly ports.
Interestingly enough, the operating system thinks it's running Windows Server 2008, R2 or 2012.
It doesn't actually know based on the S&P.
And then here we can see it running Microsoft SQL Server 2016 with the exact version number.
So we could search such support for this version number to see if we can identify if there's any exploits
available for this particular application.
And we also can see down here the host name of the target, and also we have a product version.
Again, this is something that we could key on to see if there's any public vulnerabilities in exploited
or exploit.
I don't know if you guys have heard of that.
One is quite split our US.
Exploits.
Yeah, I think it's called Exploit US.
Me just take a real quick it's goit us dotcom.
Yeah, this is it.
So this is an alternative to the Web.
Not quite as many
exploits as the exploited, but it's it's still pretty good.
This is also a site that I strongly recommend when you're looking for public exploits and liabilities
and things like that.
See, we get some experts down here and you can search for them, of course.
All right.
So let's close up
anything else, a couple of other ports from that five, fifteen, five, six, seven.
So I don't know what these are.
This hostname going to come in handy.
We should probably put this in our host file.
We'll do that in a second few other ports.
I'm not really too worried about these high level ports right now.
And if we get stuck that we can circle back around to see if there's something that increased the attack
surface of the target through one of these ports.
OK, so what we can do is go back to Discovery
and we can go bust here, which we don't have seats red.
So we can do zero Afghans, dog or buster and all the installs.
We can start looking for common SharePoint girls.
Right.
So now I can go here.
I could just Google like common SharePoint
while I cannot spell girls.
I mean, there, get a few here, so this might be interesting, right, so content realist's, we could
try that out, like basically just, you know, copy this and see if we can just, like, append it
here.
He would have to slash something loads.
OK, good.
So we actually did get something, the other thing we could do is we could just Google for like SharePoint
Pindar's report.
Sometimes these things leak to the Internet and you can get everything you need from there.
Or at least we have a good, you know, a good starting point.
It's like this is a PDF and this might give us something to work with.
Yeah, it's a sample SharePoint scan report.
So this is a fictitious website, SharePoint Target dot com of SharePoint information of these targets.
So these might be interesting by these.
I'm referring to these these path right here.
See what else we have in here.
So this right here, and Tiger could use this information to make specific attacks against this airport
installation and might be useful.
Got these catalogs
for catalog pages could contain confidential information, which could be useful to attackers.
We might want to check this one out.
Other pages here, the nice thing about this Pentax report is that it actually includes, like the description
of the risk and then the recommendations that you're not just hunting in the blind or hunting blind
for all this information.
Right.
So I like the idea of, you know, looking for public interest reports on the target that you're testing
to see if you can find, you know, a point of entry point.
Right.
Click a duplicate this tab.
We can probably go to the path that was included inside that report.
And see if there's anything that's kind of interesting.
Not exactly what I expected.
Anyway, let's go back here and let's go first back to our host while, as we said, we were going to
update that sido them as he hosts
Tenten ten fifty nine tally.
Remember where we got that from?
We got that from our EMAP output.
Right here.
All right, so we've got a target and we're just going to that 12 and.
We now should have combustor, we do so what we can do now is start a cooperative session so we can
go bust here.
So go Globemaster in a command.
What we want to be I want a list of directories.
We're basically doing forced browsing.
And so now we've got Globemaster GUIORA.
We need some flags here, the flags here, the options.
What do we want?
Well, I'd say we should expect the full URLs.
We should include the length of the body in the output.
What else?
You were out,
and if I do a thing against Talli, you should resolve and it does because of what we have in our host
file to resolving that name to the IP.
So I can do your EDP tally
is registering.
We'll keep that the same for now.
If we went up against any blacklisting, are there any defenses that the target's using?
We can try to bypass it by changing our user agent trying to match a benign browser like Chrome threads.
Let's keep it low right now.
We're going to run this in the background.
We don't want to knock over the server with our skin and the a word list now of getting output going.
I'll put this into Talledega.
Go, buster.
And the word list is interesting.
What are we going to use?
Well, we can do a search for anything with SharePoint in the name.
So we get a few files, some Ruby files and Mexica files.
We only want textiles.
So what we could do is we could use to find starting root cases instead of search for anything with
SharePoint.
Any type of file said all the errors to the BitBucket.
Now, we've got some files that are wordless clearly, but we don't know which one to pick.
And so the way I think about this logically is you probably want the one that has the most unique minds
related to SharePoint in it.
So let's go ahead and use the exact command to run the C command against each of these files.
And then we can get an idea of how many lines are in each file and then which one we should use for
our our skin.
I'm going right here, 17 08, this looks very promising, so let's grab this
and we can let that go.
Now, while this runs, Democrats running to the starting gate, it is running for the go play with
this.
So I'm going to go and put in the host name because usually I get better results when using his name.
And I click these two right here because we see one item for each documents inside pages.
So it's probably something of interest here.
We can take our birdbaths loads and we say we have tally with the hostname here.
A bunch of different folders are being built out.
That's pretty cool.
All right, what's even cooler is we have something called F.T. Piddles, let's go and grab that.
We don't have anything to open it with, so we're going to probably have to install LibreOffice or let's
say that I'm sure downloads looks like it did.
And let's copy it to his current folder to shift to, quote, zero move downloads to his current folder.
Let's just make sure that it is a document should be a zip archive.
And it is not Doc X Files are actually zip files.
This is the legacy document file format, four word documents.
So when you leave office, which we don't have to read so I can do the apt install Libra to complete
while there's a lot we just want LibreOffice Tech Y to answer yes to all the defaults.
And let's let that do its thing while we wait.
All right, so we'll let that run and then we have a finance team web page because of the Internet Explorer
logo and again, sometimes you'll discover that these Web applications are slow.
That's because these are VMS running, in fact, the box and you're connected through a virtual private
network.
You know, even if you've got like Gigha Blast or some fiber optic connection going to your network,
you might still be a little bit frustrated.
But this is like real life.
You know, a lot of times the web that you're targeting, if it's a pen test or a red team operation,
will be slow and buggy.
And so don't let that discourage you.
So we've got something here interesting from the finance team migration update.
Something related lead to a migration.
Right.
Hi, Hyla.
Welcome to your new team page, as always.
There's still a few finishing touches to make sure that we have a potential user name that we can potentially
root for us.
Maybe we could be forced to sign in here.
I don't know, using Hydra.
I mean, it's a good idea, right?
Let's keep reading.
Please upload the design mockups to the Internet folder as index that e-mail using the FTP user account.
And we've got an FPP account I aim to regularly review.
I aim to review regularly.
We'll also add the fund in client account pages in due course thinks they're in.
So now we know this application is listening on point twenty one, which is HTTP.
So this account is most likely going to come in handy, so let's go ahead and create a file.
It's called like threads of text
and what we're going to do is put in control of the user name.
We don't have a password yet.
We can put where we retreated from, which is this page.
All right, let's go back to go back there and see what's going on, LibreOffice is still running.
Looks like Globalstar finished
the violence here.
Thirty four thousand kilobytes.
So script for some interesting things, right?
You know, we could search for like documents so we can do like pseudo grap color equals always.
Chauvelin no thinketh insensitive.
We want to search for and we can use regular expressions.
We don't need to do that.
That we could just say,
I don't know, doc,
and we could put the final tab complete.
OK, so there's some other potentially interesting endpoints here.
You see, you've got to understand this code here.
In fact, if we only want to see the hundreds, if we could just go up again and we could say, like
Diondre, you know, we only get this one right.
So you can always change grep together with this pipe.
Now, I don't know if that has performance implications.
I'm sure it does.
But we're not writing a performance sensitive scripts.
We are simply hacking this box right now.
So performance is not an issue.
So let's wait for this to finish and then let's see what we get back.
We need to wait for a labor office to install so we can view that document on this one right here.
FTP details looks juicy to LibreOffice is done.
See here so we can go to the beginning.
Cyro LibreOffice, let's open this document and we're going to put the ampersand at the end, which
background's the process of that control returns to the show.
We left that off and it would hang the shell and only give us control back when we closed the document.
So that's why I like that.
Combining the processes, you could actually see the pit of the process.
I see right there the.
Right, so we've got to leave her office open tip of the day, don't care about that.
The cement bottom right corner.
All right, what do we have?
Whose name we knew about Ali Workgroup we did not know about.
So let's go and add that to our host file,
Etsy hosts.
We can do a tally that should be this gives us possibly a fully qualified domain that we can use later.
We've got what looks like a password.
Please create your own user folder upon logging in.
OK, so it looks like we also have write access to this FTP server, so maybe we can use this as a mechanism
for uploading malware to the box and we should put this course inside of our credential file
and immediately we should try this out.
Let's go back to Rickon FTB Tally, PGP user.
Let's see what that password is.
Joseph F.C. Josh of the Inter yeah, yeah, yeah, we've got some good stuff in here, so I think we
should download everything.
You know, there's probably a lot of stuff in here and it's going to be hard to just CD either.
Everything.
I don't really know, you know, where to go.
So it's got to be a lot easier to get to actually mirror.
The entire episode is actually a tool called I think it's like Kerl FTP or something like that.
Yeah, crockpots, Kearl FTP, that's what it's called.
You could use this to essentially treat your FTP server like a like a webpage and basically download
everything from it.
But I like using what you get because it's a lot easier to remember my opinion.
So we could like CBW, get tech tech, help me close this time.
And I think the spot on a little bit smaller so we can build up our command, get what we want to do,
what we want to look for, like crap mirror so we can mirror the page.
Of course, we're going to need an option of putting in a password.
So if we do search for user in the help case sensitive search, that's what the dashi does.
We can see that we can do Tic-Tac user equals the user name.
And it's probably something for passwords.
Yes.
Tic-Tac password, so we could do get in there, user equals FTP, user password equals total, so you'd
see that this double code is breaking the shell because it's actually breaking the shell, interpreting
this double quote, instead of treating it literally so we could try to escape it by putting a backslash
there.
But what I like to do is I just like to put in quotes.
Hopefully the single quote won't be treated as a literal part of the password string itself.
And then lastly, we just need the endpoint
to make sure this works.
Looks like it's working control.
Easy to go big.
Everything is being downloaded right now.
So this is a good sign that we'll wait for this to finish and then we will jump back in, right.
Looks like we have finished its go ahead, kill this top pain.
Let's see what it's called.
The Zero move tally listening that FTB and FTP.
What we have we've got these all these folders.
You know, the easy way to browse through this is to use trade so we don't have it or we can install
it at pseudo apte
search tree, see what it is.
There is something called tree.
Treat this as an indented directory, tree and color.
That's basically what it does, and this is what you install without Athene's Daltry, it's going to
have to install tree duck wire to say yes to all the defaults.
It's grab this
thread so now we can do tree 40 that each.
This actually gives us the the file sizes you tech help.
We can see that we can actually specify the depth
level descender only level directories deep.
Right.
Because if we do a tree like this, in this case, it's not too bad.
But if you have a lot of folders and files that are nested, it can take a really, really long time.
Right.
So let's see what we have.
And we've got 27 directories and 230 files.
And the one is sticking up to me right away is in Tim's folder under a folder called Files.
There is keyboards which if you didn't know Keypads is a password manager.
For example, if I go to brb, take this off
declasse, just Google.
It keeps a password safe, free, open source password manager primarily for Windows, but it's also
supported on the Linux operating system through the use of motto.
I don't want my no, I don't know why the heck they named it that, considering that motto is a disease
anyway.
So we've got we can get keep us.
And this is what we should do now, we could very quickly to scroll up, see what else we have, a bunch
of FTP files, log files.
If we do try again with the tech age to put it in human readable format for the class sizes, we can
scroll up and take a look at how big these files it's they're all the same.
Twenty eight k got a binder in here, Firefox maybe that the target environment is using Firefox, this
particular version so we could look for it exploits against that version.
A few other 94 KB files in this folder
is file.
We could try to open that.
There might be some sensitive information in there, maybe some credentials, but a PDF.
I see a new folder that doesn't go anywhere, so we don't need to go in there and that's about it.
So I think where we should go right now, the data is telling us we should go to Tim files and then
look at this, Tim, that cutbacks.
I wonder what that is.
C C users.
Tim files this file.
Tim, we can keep our database manager.
Right.
This is actually the database itself.
So first we need to install keypad keyboards because I don't think we have it yet.
We don't have it right now.
Zero apt search.
Keep us.
We can now keep house to keep house X,
see, I don't think it really matters which when we get there, get kibbitz X, it sounds cool.
And then let's move this file to
the root right here.
Yeah, this right here.
Oh, you know what happened, so, yeah, so basically what I tried to do, so KDDI Bengalla, it tries
to refer to the last part of the last command and I was then trying to copy into that.
But there's no folder called till date forward slash boxes for slash tally for Slashdot.
This folder exists without the dot right there, just the home to write off any working directory.
This refers to the day this character here and then this is a folder that exists, but his dad doesn't.
So then when I did see the dollar being trying to go to this last part of the last command, which doesn't
exist.
So I bet if I didn't include that, it would have taken me into that folder, which is what I wanted.
So that's just a little bashful for people that like to know about pretty cool commands and stuff that
you can do about anyway.
And we should have copied it up.
So it's go to boxes tally and we have it there and we should have keypads now keep at X.
We're just going to point it to this directory here.
So database open database
boxes tally so we can get open.
Nice, except we don't have a password unable to open the database Ronke or database files corrupt.
So what are we going to do on to brute force this that would take forever or we could look at
some scripts from to John.
Right.
So John is a password cracker and includes all these scripts that you can use to convert different things
to a format that John can use so that he can crack it.
So we can look to see if there is a like a key pass.
DeJohn there is.
I just typed key parts and they are completed.
So that is definitely a file and we can put in the database name and part 1.0 scap what I want to do
that
I didn't need to consider.
OK, here we have the hash format so now we can crack this in John or we can use hash tag which is my
favorite.
I like using hash tags so we still control AC a comma.
Let's do brute force.
Brute force technically is not brute force a dictionary attack.
Let's be lexically correct and then let's do it until a olszewski to log everything we're doing here.
We have hash cat.
We do.
We have version six one on one.
Now let's go ahead and grab for example hashes show an example hash for each hash mo.
That's what we want.
So we want to go up and let's see what he's able hashes.
We get we get way too many.
So let's do a grab for like key pass and we see a hash and we see a type, but we don't get the mode.
Notice, if you look at the format up here, you have a hash before that you have a type in the before
that you have a mode.
So we want to go before by maybe one.
Right.
So we can do to be four before go before one line.
And now we have the mode, so technically we have what we need, we just need to put this hash in a
file.
Let's put the pain.
Let's get off them hash text.
Which of the does not look right.
And that's what I said.
Look, that's what it should look like.
It starts with Tim, I'm sure.
Why I didn't grab everything.
Let's go back then.
I control.
Should be.
There we go.
Now that just reminds me.
This starts with Tim, the user we want to crack, but the format Hashmat wants does not.
It starts with dollar.
Keeps dollar.
So this is a little bit different.
This is dollar keeps dollar here, so we probably need to truncate or sort of remove this temporary
fix or perhaps get to crack it
price tag twice to get to the beginning of the document shift.
Easy to save.
It's now a conditional cash card.
The mode is 13, 400 control of the hashes.
And then we need the word list.
I'm not sure we have
now.
We have the compressed form of the list.
But this is not a very it's not it's going to be it's very resource intensive to crack something like
this.
And then what I want to do is I just want to run against this to show you the size.
Fifty one megabyte.
Right.
Compressed.
So we need the rocky text uncompressed, which will give us better performance.
And of course you know where I'm going.
I'm going to Google up.
That's throwing the word.
They we go and make this is it says native Cattail, I'm pretty sure this is what I want.
File should be like a hundred and thirty six megabytes or something like that.
One hundred thirty three.
So we'll save it.
Right, downloading, let's go ahead and get ready to pull it over, zero move downloads, cued our
text, put it right here.
So we put that down to finish.
OK, you.
Seek to complete the works, to complete works, at least, and what does it say?
Has that takes your mind once or something's wrong with this format, so it has to take.
Yeah, I didn't copy of it correctly.
You see here it looks like this.
It starts with keep US dollar here.
It's showing something completely different.
So let's go back to what we're doing.
Where are we here.
Yes.
About this again.
Right from you know, right from that dollar sign to the end.
Right.
Click copy control eight three to switch over to them.
Has that text at least the line I Josephite put it back.
It looks good.
Escape easy.
Up, up, up front.
Yes, that's what we want.
So to exit this one.
What hash can't do its thing.
Very, very awesome.
So you can see how QCAT finished used rocket attacks to check this many passwords, which looks like
it is fourteen million lines
and it looks like it took between fourteen 38 and fourteen thirty six.
So it's like about two minutes to run again.
I'm actually running this in a virtual machine, so if I show you the specs on this guy you open this
pain up.
Right, click settings, you can see what I'm working with.
I don't have a special tracking rig, you know, with the multiple Invidia, you know, G Force, CPU's
and all that stuff.
Got four gigabytes of memory to CPU's and 40 gigabyte hard drive as far as the advanced features go.
You know, I'm not using Zaytoun medications for help or being able to hosts, which improves my performance
a little bit.
This is my workstation 16.
So your mileage may vary, but that's pretty much what I found.
So you might be wondering, where's the password?
It's actually right here.
At the end of the string, by the way, you could also find it if you, for example, to see to this
and you want to find it again without really cracking, you could just type show and we show it.
Now, one other thing we could do is if you want to know where this was inside of the file, you could
do like grep minus AI in
regex.
So it starts with simple Monteil and ends with that.
So this word is on the line by itself and we want to search and rescue and we can see it actually came
up with a bunch of different lines.
But the one that we found was right here on line twenty four thousand six hundred eighty eight.
So that's kind of cool.
All right, so now what do we do with this?
Well, we've got a credit score and put it in our credential file,
keep our vault has cracked the hash cat.
Right.
That's we want.
And now let's go over to keep asking.
We still have it running.
I don't think we do.
Let's go ahead and launch it live in the dark theme.
That is, I'm a huge fan of dark themes.
It doesn't cost them right.
Click the eyeball to make sure we get it in the correctly.
We do OK.
And bam, we're inside now.
Nothing in the personal directory.
We can keep browsing through these directories and see what we find them.
We've got something here.
Finance, do you see?
And we've got a grid.
And if you look at this, it says tally aked share.
This is probably SMB share so we can make note of that zero Democrats.
Gee, I support that wrong.
There we go.
Keep us involved
inside.
Keep as well.
It should be.
And it was finance
credit for
aked share.
That's good, right.
All right.
So we're going to do we're going to try to go here.
Let's see if we are pragmatic.
Zach, we don't see the App Store credit map, exactly how that work, never actually trying to install
it that way.
So in case you're wondering what crack map is, try saying that ten times fast.
And it's sort of like a Swiss Army knife Penn testing tool for Engagement's.
You can do a bunch of different things, a bunch of network based attacks.
You know, there's a lot of there's a lot of work to put into this, particularly by by Bleeder, who
is pretty awesome.
And but, you know, we can look at this tool, we can use it.
And we're just basically trying to see what we can do with these S&P shares.
Right.
Can we can we log in to the target using the credentials that we discovered in the past, keep passed,
password pulled.
This tool is legit.
All right.
So let's just make sure, by the way, wherever you see black, how a Black Hills, you know, it's
legit enough said.
And I don't work for Black Hills, which is really that good.
OK, so let's go ahead and see what's going on here.
They're still in stalling, so wait for this to finish and then we'll jump back in.
All right.
So this is done.
Let's see if we can run a crack map.
Exactly.
We can.
This is a beast of a tool, so we don't want to get too deep in there, but we do want to run some useful
command.
So it's run like that help, which I just ran.
So I just repeat it myself.
Great.
Now, there used to be an SMB command here, which I don't see what sort of app to search to me.
I don't know if this is what I think it is.
If you see here, see me check or edit configuration data with config model, this is not what we wanted.
That is hilarious.
So let's go to their website and let's see the correct way to install this.
Casey, we could use a doctor and we could use payback's which says it's also pretty easy, so let's
just go and do this.
This method.
Buybacks ensure our path.
And then lastly, buybacks and stop cracking that exact.
OK, it was not created because insurer PIP is not available to me to install that pseudo app store
Python three and.
I forgot how much of a beast crack my executives to install.
Oh, right, so SEEMY is now available and correct.
Exactly.
I love the emoticons down here supercool.
I wonder how they're doing that.
So we should be able to run and we don't want to do originally rename this, by the way, to see me.
So you don't see any.
Because we have the other command still there to do this, you know, crack a map.
Exactly.
That works.
All right.
That's what I want.
OK, so what we want to do now is run SMB right to what we could do is go back to its previous command
and just change this to crack a map.
Exactly.
See if this gets us what we want.
It does.
So it's running and we can see we've got ready access to the accounting share.
Now what do we want to do here?
Well, we want to read it.
How can we do that?
We can use and be map to do that.
We could.
Do you have exactly as well.
But I like showing off as many tools, tools as possible so that you can really learn how to run an
engagement and how to work.
So zero SMB map have it do it to see what our options are.
We can say tech you finance tech p write your password.
Oops, we don't have a password on our clipboard anymore.
Joseph C..
Control of the counting and then I believe we just need the host, which is this tech age.
Kelly.
So, again, we see now what we can do is we can actually read it, which I believe we go into the help,
we should see that somewhere here.
Yeah.
What's the contents of the directory?
So we can do take our act if you want to list the contents of this directory.
And you can see a bunch of, again, followers now, you know, I don't want to have to browse through
these folders like this instead, I think it's better if we just mount this entire share locally on
our box and then we can copy everything down.
And my first point of attack is going to be go to this folder migration, because if you remember when
we went and we were exploring the SharePoint site, it's called Migration Update, and that's where
we found these credentials, this laptop user account.
So I think that should be our plan of attack for at least starting things off.
So how are we going to do this new directory to make Directory SMB see the SMB zero mount type service
options?
User name equals finance.
Password equals this.
And what we want to do, we want to mount.
Ten, ten, ten, ten, ten, fifty, nine linked in this current folder.
See that works.
And you see it is bad.
You should see notice that it doesn't have a slash separating the nine and the A.
That's because this forward slashers escaped me.
So we need to escape each flash so that we get a flash here, that makes sense, for example.
But it's last year now I get to here, but I don't get the other flash right.
We need to flash.
So that means I need to put two more slashes to escape Eagle.
It sounds crazy, but that's because Lennix right.
You have to escape the slashers.
So now there's nothing here.
But if we go up there, we go back in.
We have everything.
Obviously a great place for tree.
Are you sure it's going to take a really long time?
Right, Jose?
The stuff that we could set the level to to.
Right level descent, only two levels deep.
So that's a little bit more manageable.
But we already know that we want to start in the migration folder, so let's go into their.
Where am I?
What am I doing?
CD boxes tally.
All right, see me.
All right.
Oh, my gosh.
My question is a little bit slow, that's the problem, there's some lag here to try to get out to.
Right.
Some backup folders and some binary integration.
Let's start back up.
See what's in here.
I don't know.
I mean, we could go deeper into that.
Could do like a tree three three levels deep.
And I'm seeing some things looks like some configuration files, there may be credentials in here,
it could take forever to search through all 70 directories.
So let's go back out let's back up pun intended of the back of directory and.
I'm intrigued and then we've got binaries that's going there.
This is a lot of stuff.
We do we need to exclude the kept files.
Is there a way to do that would treat.
I know the way you do A grep C zero, grep minus color equals always
exclude
anything that ends.
And I can't want to recurse and we just want to search for everything.
Second, I don't even know.
All right, so it's trying to get a little deeper without giving us all the crazy noise.
So we're seeing some executables, we've got Putti and we've got this are pretty set up.
Maybe that's a report set up to Testor.
I don't know what that is.
And maybe we should look into that.
So let's go into S&P warned.
Migration.
Wow, this is really slow.
City boundaries don't make a type of I don't make a typo and create a new folder.
All right, so let's grab this zero copy test to see let's put this in
boxes tally.
What I want to do is do this, given that Dodd said, I want to come back and say this works this time.
It did put it you see it put the command in the last command so we can go there and then let's see if
we can look inside.
Final test today, actually executable.
Let's stop this for now because it's slowing down our box
and let's take a look at this.
So we want to do we could use radar against it.
And this might be a step in the right direction.
This could be overkill because, you know, a lot of times you don't actually need to use a reverse
engineering tool like radar to just find strings.
But sometimes you can find strings in a file that are very helpful.
That's why I wanted to show this.
I was looking through here and again, you know, I'm just looking through here and then immediately
I see what looks like crystals, right?
You can see this.
Now, you don't need to actually disassemble all the code like I just did using radar.
You could take an easier approach.
I'll show you that a second frequenters.
And if we discriminate strings against Testor.
You know, we could search through it that way.
Let's make sure that the winds are at least 10 characters long.
There we go, right, you see it there, that way I'm another way you could have done this as if you
did like zero grap
color equals always kissing sensitive shoreline numbers.
Let's see, treat binaries like text.
That's what he e regular expression you could do, like pass
KRED or keep you looking for any of these strings would pass past, would create or keep inside of actually
the only possibility if would have passed inside of Testor.
And you would immediately find it this way because a couple of different ways to find it.
I just wanted to show you those ways that you could use radar.
We use strings or you could use grep with the TAC A to treat winery's like text.
Very cool, right.
So let's go ahead and open up our file
put
in
and we're going to want that
user idea of s.A and a database or Godb.
I'm going to delete all that related with the credit.
We might need the database later, but I want to keep this simple.
It's how are we going to connect?
Now, there's a couple of things we can do.
We could we could use d'hiver,
which is a visual database, sort of management utility, kind of like SQL Server Management Studio.
Right.
I can open this up, let it work, and we could try to connect that way.
We could also use this tool.
Debrah Universal, database manager.
Right.
So this is the tool that we we could use if we want to manage the DB and you're going to see it's going
to actually pop open and window is going to say, how do you want to connect?
Is it my skill?
Is it Microsoft SQL Server as opposed to just, you know, Oracle?
You know, you basically pick your connector and then you download the driver and then let you in.
Right.
So we can click close on here after we click SQL Server.
Right.
We click next.
And then we just put in our host, put in our credentials.
SQL Server authentication is what we're using and then you can click Test connection to make sure it
works.
Here, it's saying, you know, we need this, my name's SQL Server Driver, so we can download that
in the log and failed.
I probably just didn't copy the right thing.
Let me make sure I have the right credential.
I bet that's the entire string.
Yeah, entire string on my clipboard.
So I just grab this.
Oh, the password.
Well, now back to my column and I'll show you the sequel sequel Shell in a moment.
That's the other way we can get in quick closing.
That didn't let me close it for some reason.
Let's just put the password in connection.
And says we're connected, you got to finish explaining to the tip of the day and which comes after
this message.
So do we want to create a simple database?
We don't tip of the day quite close on that.
Then we can click close, I believe, on the screen back here like this big.
And what we can do now is we can actually go to the sequel ed or whatever, sequel ed and then type
in command and control in order to execute them.
If you right.
Click execute jointer.
Right.
So for example, I could do like S.P..
What does it configure,
show advanced options.
I believe that's it.
I'm trying to see if we have XP command, which is a way of
controlling their way of executing commands on the database.
So if I then did.
EXPE commensal jointer.
All right, and then if I didn't, I did XP command show.
It's going to work.
It is.
So you can see we correctly configured it and we are running out of the user tally.
And we could even do like cribs for slash cribs to see what our permissions are.
I did something wrong.
I put this in the quote.
And of course, I'm telling you, I think is just prev.
Yeah, that's it.
So because you are perhaps so we're going to take a look at this in a moment, because this one is really
interesting to see and personal privilege.
This is my favorite privilege, escalation of actually through a juicy potato.
There's a bunch of different potatoes.
So there's potato Yuxi.
There is rotten potato, rock, potato, potato, lonely potato, sweet potato and potato.
And all these potatoes are basically a way of tricking a a privileged.
Basically what you're doing is you're men and you're setting up your process as a man in the middle
of the local system to capture a TLM hashes from a privileged process so that you can generate a token
that has integrity system rights, and you can abuse the C impersonate privilege to assume those rights
and escalate your privileges.
I know that sounds crazy.
Don't worry if it doesn't really make a lot of sense right now, I think it will a little bit later
on.
So right now I just want to show you this tool, the sequence and shell eggs at this top pane, rename
its bottom pane sequel, Shell.
And let's go ahead and get this working second sequel Shell.
What do we want to do?
We want the username, which is s.A.
And I just got that from here, the password.
I put that in and then of course we want the database, which I believe is just a capital D.
No, it's our capital D.
Yeah, the server.
So we need to do this again.
And then you have the type go at the end of each command, really do speak, configure XP command show.
Oops, forgot to type reconfigure.
Let's see if it works anyway, month.
It does.
OK, so there's a couple different things we could do, right?
We could try to use Paracha and get a reversal that way.
I like to use living off the land binaries.
We've already shown Parachilna previous lecture, so let's try to use Circuital.
Right.
This is the way that we can download content onto a compromised endpoint.
And I think it's a great thing to know.
Got to laugh out loud.
Bass actually stands for a living off the land binaries and scripts and we can look for certain till
I can show you how you can download content onto an endpoint by using a Microsoft signed binary in a
way that it was never intended to be used for typesetting till here pops up.
It's one of my favorites t one of the functions is download.
Scroll down, you'll see the site you can download, copy that.
What we can do is we can say exponential
toxify, take this out and what we're going to actually end up downloading is a juicy potato.
I'm getting ready for that.
We're going to host it on our local machine.
And that should work.
Now, let's go ahead and make sure that is our IP address.
It's 14, 18,
and then let's go ahead and grab Jaycee potatoe.
This is it now looks like there's a lovely potato, too, didn't even know about that, lots of potatoes
if you like potatoes, man, and this is going to be a fun privilege escalation vector for you.
All right.
I think we just need to grab this.
I think the binaries already pre pre compiled.
Fresh potatoes, let's go and grab this one right click copy link, location
zero you get to of the
final G.C..
Right.
That is to be executable and that's going to be downloaded before we do, we need to make sure we set
up a Web server.
Looks like this show might have timed out, so let's go in started up again.
It's.
I see Speaker Menschel, my God, that works.
So what we need is a better show and let's just delete this and get that cat on the box.
But could you certainly tell it to download it to a machine and then we can get a real shot that way.
That way we'll get our foothold to see, locate and see that
that's the one we want.
See copy
to this current folder.
All right.
And then we can run in this in.
To download Ngarkat.
Forgot the single quotes.
It's like we took too long to speak, that's how disabled itself is to move really fast when you're
doing this.
The audience cathartically.
It's not there, so we probably need to download it into like a temp folder.
Let's put it into Windows temp.
And then let's see if we can find it that way.
So that's what I found.
Plus, if we can still run it.
He definitely downloaded.
Scoot over.
I'll wrap wrap.
OK, Scooter Affleck and Star RL, wrap
this up, give us UpDown functionality once we get our Windows show.
Scutaro wrap and see a naked minus in the always off names that were both listed on Port four for three,
and then we go up here, we'll say four for three.
Let's make sure that that is our IP
10, 10, 14, 18, as you can see right there.
That's right.
And we'll see how this works.
Now, what we need to do is take this out.
Not passing this Syriatel, we're just running that gap.
And there we go.
Guarascio Daizy am I?
We are, sir.
So let's go to C Drive.
You can see the account directory when we saw the share print, we can see the FTP directory, which
we already saw earlier.
We can see the web server directory.
All right, kiwifruit.
And there's a bunch of stuff in here.
What we're interested in right now
is elevating our privileges, obviously.
But in order to do that, we need to get that Rodden that you see potato to work.
Because if we do well, I prefer to see we have the AC impersonate tokin.
Right.
So if we go back to the FTP
because you see potatoe right.
And if we run this, do you see potatoe?
You should give us the usage commands.
Right.
So the next lecture, we're actually going to talk about using this tool to elevate our privileges from
a standard user if we do not use our Sara.
You can see she is just a user local group membership, and that's really it.
There's no administrator rights putting net users can see there is an administrator user that local
administrators
because it is going.
Let me see that the group for administrators only have one account in their administrators and we are
Zera User, which is a member of the users group.
The next lecture we will elevate using GC potatoe.
I will see you then.