All right, so let's go back to Jose Potatoe, see what we've got here.
So what we want to do, we have some mandatory arguments, right, Rusty?
Mandatory pre-process call process with token prices.
This user both.
Let's try both program to match.
We want to watch the command prompt.
So Tech P, C, Windows System three him directly.
And then we need the argument to come in line argument to pass through the program.
We do have something we want to pass and this is going to be our escalation command.
Let's add a user
that looks good and then it looks like we need
these are optional, but we need us come.
So report to us on.
OK, looks like we got success on the first try, if we do that, the local net users who got money
and if we do a local group administrators, we're not yet in this group, but we create the account
and that we need to run this command and add ourselves to the administrators group.
Let's do it.
This part here.
That local group administrators and we are now a member of the administration group, so we escalate
our apologies to know what we can do is we can try to use crack map.
Exactly to assume ownership of this account, because what we need to do is disable the firewall and
then enable RTP so we can remote into the box.
So let's see if we can do this.
Let's go and delete this and we can say net share attacker.
This will be the folder that we're going to basically share Windows temp and we want to grant access
to administrators and administrators and we're going to look for full access in the go ahead.
OK, sweet.
So that worked out well.
Let's go ahead and close some of these windows.
It's getting kind of messy here.
Move this one up.
Look, we came pretty close to Web server.
We want to give us some more space.
Went up to the of cracked my legs back down here
and what I want to do
is show you how we can now basically take over this fort.
We can basically elevate our privileges using that access token, the privilege of talking
to a user's body.
And remember, the password that we made
was this.
The domain is tele.
See, now it has a little positive plus sign, that's a good sign.
So the other thing we need is we need to have admin access to the share we created by default.
Windows is going to block access so we can actually enable this.
We type local account talk and filter policy registry UAC.
Let's search for a local count, go through your policy access, yeah, and share this one at.
Yeah, so that's what we can do.
We can basically go here, we can create this in the registry using our access token, right.
So let's go back here to meet this guy up.
He's always come in running a system.
That's what we're able to do this.
H g l m.
OK, what do we want to do?
We want to add this value called local account filter policy and it's a D word value.
Type is Reg D word, and we want to set it to one with one.
OK.
And I believe this should do it.
Let's go back to crack map exactly and see if we can pull out the hashes.
This is Poland, a great sign.
Look at this, Hamas's control easy.
And we've got the administrators have some compassion for this hash and waregem, so let's go and grab
this
copy.
Yes.
And what do we want to do?
We want to log in with a username.
I mean, username and password.
Right in this password can actually be in this hash as long as it has that prefix over.
So we can say thank you domain.
I think it's tally the username.
So we put the domain like that domain forward, slash the main four slash username administrator and
then the password percent should be.
We just need the host, so that is ten, ten, ten, fifty, nine, and then we need the command, which
in this case is just going to be Commander XY.
Let's try workgroup.
Yes, we are now the administrator, but my show is kind of weird, all right, but we have escalator
privileges,
city administrators, school administrator, city desktop.
So we are now the administrator and there's the the basically the proof that we are catching that flag
now, this is pretty cool.
So now in the next picture, we're going to, you know, enable remote desktop and we're going to jump
into this box.
And then in the following picture, we can do a minor breakdown of the attack sequence we used to compromise
the system.
All right.
See you next.