OK, here we are, we have another box to pop.
This one is going to be awesome and I'm going to learn a lot of new tricks along the way, including
like environment variables, exporting those using S&P map.
We're going to use a bunch of different tools and techniques to, you know, actually going to go deep.
A crack map.
Exactly.
So that's going to be fun to get to learn a lot of Basche scripting sort of commands using cut in crap
and unique and sort.
And we're going to use tools like Kerberos and Cool and Hash Cat to generate word lists.
We're going to use Hijrah.
I mean, there's going to be a lot of cool stuff.
LDAP search.
It's going to be awesome.
Let's just go ahead and dig in and get started in our exploitation phase.
So where are we right now?
Here we are.
So let's go and make a directory
and we'll pop in the directory.
Nice.
Here we are.
And I think what I should do is make this box big.
OK, so we are ready to go.
The first thing we need to do is obviously we need to export the target.
This might not be obvious, but if we export it here, the target variable that contains the IP, then
we can access it among all the panes in our session.
So we're going to do that.
First export target is the IP of our target.
And of course, if we just did like Echo Target here, it works, but it also works if we join the session
with VPN go target right now.
Let's go ahead and connect to the VPN
suite
and let's make sure that we can ping the target.
So I can say this.
You don't want to see for
such good.
Good of one 127.
We know it's a Windows box because it's between 64 and 128 and our local IP is 10, 10, 14, nine.
So we should exploit this variable as well conjunctive see if we do export, let's call it almost equal
to that variable.
And the echo just shows up here.
Right.
And if I open a new pane and I do echo alost, we don't get anything.
So why is that?
That's because we actually need to define this session in two months.
Let's go back here and let's do a Tmax, actually.
Yeah, we can do a show in this.
Show us all the environment variables.
But if we do, Tmax set and we can set our host to the IP of our local machine and then we can export
it.
And then we can echo it right now, if we go back to the second plane, we should be able to echo.
I think we may have to close this plane first until X Y actually.
You see Echo Alost.
There we go.
Any pain?
Echo, almost echo target.
Everything's there.
Sweet.
OK, so now we can start some awesome stuff.
What should we do next?
Go ahead and kick off in my obsession.
Let's clear this out.
Zero in my favor both soon.
The house is already active.
Run the fastest scan that we possibly can, run safe ships and make sure we do version numeration.
So the reason why the port is closed, if is closed, only show open ports because probably we probably
don't need reason if we're going to only show open ports.
Actually, what I want to do is I want to pick out open
that what we can see.
The reason why our ports blocked six five, five, three, five and then one output it.
Let's just call it fuse that EMAP and we'll send it to our target immediately.
We can see we've got some ports open.
One thirty five.
This is the usually this RBC along with four, four or five and one thirty nine.
So these are usually like SMB like net bios stuff.
One thirty nine four four five one thirty five.
So the first thing I would do when I see this is I just want to, you know, see if we can connect via,
you know, no authentication.
So control a let's just go here and let's see if we can disconnect it.
Zero SMB map, see what options we have with us and be map.
OK, so there are a lot of options here, I'm going to go back to easy but the screen.
I guess control easy was useless because I'm back where I was before, but anyway, we go up, we can
look at some of the things we can do here.
So if I type forward slash, no username is permitted, no section is assumed and it gets the only option
for now.
So what we could do is to see if we could authenticate using the authentication.
Right.
Let's go back here to see the SMB map.
So we just need to omit the user.
And then I think we need a host, which I believe is tech H.
It is IP host
and that's the target.
See what we get.
All right.
So we didn't get anything here.
No error messages, nothing really meaningful that came back.
What can we do?
Let's try to authenticate using RBC client.
Client.
Let's just switch this around, right?
So clear, the RBC client.
See, your username filled in here, username said the network username, so I don't think it's another
indication flac your password or password.
We could do is we could say to our PC client, which is do like this with your username and we'll say
no password.
Just try to see if we can get anything with no authentication.
No.
If we do this oh, so now we've got something interesting potentially to help us go back to all the
different things that we can type a lot of different commands at our quiet.
And what I'm looking for really is just enumeration.
So let's see if there's any, like, enum commands.
So we've got one Reg enum key.
We've got so many great computer names.
What else can we do.
Not sharing them all enumerate all shares.
What else.
Net sharing the whole net connections.
All right, so let's see
Inamine printers, Inam forms.
A lot of stuff, you know, Domain's know Hamdam users, I mean, this is probably a good start, right?
This numerators domain users so we could take this Joseph C to control the entire access denied.
Great.
So it was worth a shot with our permission.
Right now I do that.
What we should do now is let's just go back to EMAP since it finished.
Let's see what we have here.
So we have a few different open ports.
We've got Port 53 and there's some tool called simple DNS plus that's running medially.
The first thing I'm going to do is just go to switchboard.
Oops, wrong window.
Let's go back here.
It's going to go to search Boyte.
Let's check search points.
You know, search and exploit simple DNS plus.
All right.
So we do have one exploit here, but this a denial service.
This is not going to get us a shell or it might, but it's going to take some significant work.
For example, if we did like search Boit minus X sixty fifty nine and you'll see that this is a remote
and our service exploit that.
Really interested in that.
We don't want to knock the box offline.
Right.
We want to gain access to the box.
So let's see what else we have from here.
We do have 453.
So usually the first thing I do when I see Port 43, besides, you're looking search point against the
service that's listening.
There is I just update my local DNS file.
So if I do see them C resolved, I call.
What I can do is I can to put in the new name server over ten, ten, ten one ninety three escape shifts.
Easy because I want to have this name server, I want to have this remote target resolve any names.
Obviously it can do that because it's a name server, so I'm going to let it do that.
And sometimes it will get us access to resources that we wouldn't be able to get access to without this
name resolution.
What else do we notice here?
Well, we see port editors listening, joining ISIS 10.
So this is probably either Windows Server 2016, 2019 or Windows 10.
Any one of those site doesn't have a title, so it looks like it might not be completely configured.
They have Kerberos here.
We have again one thirty five and one thirty nine and then we also have three eighty nine.
So this is Active Directory.
This might be a domain controller.
You notice we also have this name here, Fabrique Corp, that local.
So we should probably add this to our host file.
You them Azzi hosts.
It's going at that.
So we've got that added, what else do we see here?
We see we've got four, four, five, four, six four.
I don't know what that is.
Something to AAPC is five nine three six three six.
Not sure because some more eldership stuff.
Let's see some more web listening ports, some high level ports here look non-standard.
And then we've got just a general check for Conficker.
And here's the operating system with Windows Server twenty sixteen.
That gives us the exact version along with some other things.
We see a fully qualified domain name here so we can add this to our file.
And you see that message signing is enabled and required, which means that we're not able to do any
like assembly relay attacks.
If there were multiple boxes and this was disabled and we might be able to essentially relay our intel
and has to another system.
That's not the case here.
So we don't need to look at this part.
Let's go ahead and add the fuse Fabrica.
That will go to our post file.
And I don't like the capital.
I'm OCD like that.
OK, and what version of Windows is this?
To give us the exact version.
So let's see Windows twenty sixteen standard.
Let's see if we can Google that real quick.
See what the Googles tells us about this version of Windows.
All right, and immediately, the first thing I get is exploit.
That is hilarious.
This is not from my browser history because I'm using a completely new build off of callisthenics.
So it's interesting that that came up and see exploit DB exploit turn blue, eternal blue.
And so this target might be vulnerable to eternal blue and the right.
You may not go for it, but we're going to try to avoid using that display in this particular engagement,
because I want you to really learn how these tools work.
And if you're studying for the LCP, this point is not allowed.
So this is not something we're going to do here.
So MS.
17 zero 10.
We might we might be vulnerable to this.
Right, so that's good to know.
Good to minimize it.
Let's just go ahead and confirm that version and we can confirm it with crack map.
Exactly.
So because, you know, it's always good to validate what you see in one tool with another tool.
And I like using crack crack map, except for this, because it's a really good job of fingerprinting
us among a bunch of other things.
So we go to Google Crack Map SEC.
We'll get the latest release.
Here we go right here, the nice thing about cracking up is that you can actually get the architecture
of your target without any authentication, just using RTC calls.
So that is a huge plus.
So here we have the latest release.
We have the crack map exactly from Boodhoo, which is a Damián Debian variant.
And we also have the exact Beeby which stores the credentials that you gather.
I'm using crack map.
Exactly.
So let's go and grab the computer release.
It's going to copy that link.
And let's go to the second pane.
Name this discovery and see to it.
Just grab that guy up.
Put down.
Zero, zip, see me, OK, and let's go ahead and remove that file down and file.
It's a Python script.
See if I do a head on.
It looks like it's actually in a binary format, though, which is kind of interesting.
There it is.
So we can do pseudo python three cime that should launch the tool.
In some areas, but that's OK.
All right, we've got it up.
Let's go ahead and run the S&P module.
So up arrow to go back at our history and be there when I get the target from the operating system.
That's all.
And again, we get the operating system and we get something new.
We get a name fuse to just fuse by itself.
And we also have the domain fabric ripped out.
So let's just add fuse to our hospital,
fuse escape you.
There we go.
I just trust you to undo that fuse here.
Was good escape, she easy.
So now we know what version we're working with.
That's pretty high chance that we're working with Windows Server 2016 standard because of what we're
we're seeing here, 64 bit version.
Right.
So that is pretty cool.
Now, let's go ahead and see what's important right now, because we learned from our recon that Port
80 is open and this usually has the largest attack surface.
Again, you know what we're seeing here?
It looks like this doesn't actually have anything configured here.
So this this page might be vulnerable.
Looks like it might be a freshly set up Web page without much security in place.
So I'm going to type views and I'm immediately redirected there.
Before we dig into this, we need to make sure berp is open so we can spider this post passably in the
background.
This is part of my workflow.
What I'm doing recon or I'm looking at lists, whether it's a bug bounty.
Hack the box.
Pentax to work through a team engagement doesn't matter what it is.
You want to have berp logging your requests in the background.
Then you can just go back through that log and you'll have a record pretty much of your assessment,
which is a really, really nice.
So let's go out and start burb.
OK, Joseph P. intercept of good options, make sure we are requesting a civil response and go to the
site map back here, put on some approximately berp and we know that we are, because if you go back
to proxy options, you see that purpose listening on Port AT&T when localhost.
So any traffic that we send to that port will be sent to berp, and that's exactly what this plugin
is doing, a good options here.
You'll see it's actually sending the traffic to 127 zero zero one and it is sending it to port 80.
Right close.
So we're good.
So what do we have here?
Some kind of printer site?
It looks like it might be old, judging by the copyright, maybe.
Could you search Searsport for papercut print logger just to see if we have anything in the background
to create a new tab?
Exploit search white paper cut search cloyed print logger.
No, that's always good to do that.
You never know.
You might just get a quick easy when this page definitely looks old and we can learn here.
Looks like this is a print logger free print logging program, which is probably open source, I'm guessing
because of the freeness and it says live print ones are listed below an additional CSP is Excel logs
are available here, so the software will only track printers locally attached to the system.
So this is good.
There's probably something interesting in here.
Let's go to about just mousing over these links to see where they go.
Are these are going back to the papercut and website.
So that's not really interesting to me.
If go back to print logs and I press control you, I can do a search for all the comments on the page
just to see if there's anything in the comments that might sort of cawsey the application to leak sensitive
information.
Information disclosure is a thing and we want to make sure that we check that vector first.
All right.
So we've got a couple of things here.
Let's just look at the data.
Right.
I want to look at it this way.
Probably is going to download all these.
So it was just one of them.
So we're back.
You see, everything's been downloaded.
There's only five or six here.
And I think that's because one of these is actually the same.
These two are the same.
The it's the same.
So let's go ahead and extract these and take a look at what we're working with here.
Locate actually should be no doubt whatsoever.
There's a zero move download, start out CSP.
We can do this folder.
You got it right.
Now, what do we want to do?
You can get them.
That's kind of hard to work with.
You know, we need some way to get into this application and get into this box.
And the authentication doesn't work.
We've already tried that.
We search, search VoIP, you know, against the DNS application, against this papercut thing.
We're not saying anything, but I think any credentials here, there's not even a login for.
And so we need to pass these these data fields to see if there's anything in here that can help us be
able to wordlist.
Because if we click on the HTML here and you can see it's actually showing, OK, this is the pointer
name, here's a client.
So we've got some of those names.
We've got some usernames.
Right.
So this is the information we're going to want to build into our word lists so we can start trying to
gain gain access into this environment.
OK, so let's go ahead and go back to this and it's clean this up a little bit.
First, one thing I'm noticing is there are usernames here, right?
So let's just pass this out.
Let's pass these names out and build a user user list.
So what we can do the opera, let's just grep.
And we don't want the means.
Don't return this.
I mean, case insensitive and the carrot.
Where is it?
This means I don't want any lines that have.
Let's start with.
You know, you noticed that went away before papercut was showing up in a line that's not right, an
easier way to do this is probably just to say I want all the lines that actually have 20, 20 that start
with 20, 20, because those are the lines that contain our usernames, right.
To say grep space minus I, 20, 20.
Now we've got all the lines returned.
Now we need to clean this up a little bit so we can just cut in the delimiter.
I think we can use a comma.
Right.
So the limiter we set to be limited to a comma and the field that we want, this would be field number
one and this is field number two.
So we want Phil to go and see what that looks like.
All right.
We've got a couple of duplicates in here, but we're getting better so we can actually see that to sort.
And you should give us uniques.
There we go.
So let's go ahead and I'll put that to users that LSP.
OK, permission denied.
So we're trying to redirect the output from Standard out, which is usually a one.
C, this is standard in this standard out.
This is standard error.
We're trying to redirect standard out from the terminal to a file with this redirection operator is
saying permission denied and we could try to get permission denied.
We could change the route that would fix it.
But to go back up, you'll notice that part of the problem is this directory fuse is owned by route.
We need to make it owned by we need to make this owned by Tester, which is who I am.
Right.
I don't have permission to overwrite to to basically write to this directory.
It's the only route you can read and execute, read and execute and only route can write, which is
what we need.
We need the right permissions.
So let's go take that change ownership, change it to pen tester finestra group and then we'll just
make sure it's changed ownership on the effused folder.
And now you can see we now own this folder.
Let's go back and diffuse typically when I command and it looks like a completed it.
Did you just that list and we've got a user list just like that, that is pretty sweet.
So what I want to do right now is I just want to test these users.
We can do that using a tool called Curb.
So I'm going to go ahead, install it.
This is a great tool just to check, you know, gets an active directory environment just to make sure
that, you know, these names actually exist.
We just want to validate what we're seeing from the CSP file.
All right.
So we should be able to type curve route.
That's not what I wanted.
Curb Groot.
Why didn't it work?
Zero curb or something didn't happen.
Right.
So saying the script cover was installed here.
This is not in our path.
So adding the directory to the path so we could do that much is make sure it's actually there.
I'm not sure why do did this.
Let's just go to that path screen.
It is there.
So what I'll do let's just do echo path.
She's going to move this to our user local pen folder here, so these, you know, move it to that folder
now for you, which Khirbet Shung is there.
Now, we should just be able to type corporate because now it's in the path.
This path basically means, hey, the terminal basically says, hey, I've got this command.
I don't know what corporate is corporate.
So I'm going to first check all these folders that's been I'm going to check a user, Espin.
I'm going to check this Espin myself.
I want to check user local bean.
I'm going to check user bean and then just bean and then user local games and a game to see if there's
a binary or executable.
And there if it's not there, I can't run it and then I'll return an error.
That's what we were seeing earlier right here.
DSH is like the shell thing.
I don't even know what that is.
But once he moved it into a directory that was inside this path, it runs just fine.
So I hope that makes sense.
So now we should be able to run it.
And we did see here, it looks like it's a version of it's implemented in impact, which is really cool.
Let's go ahead and start this thing up.
So let's just go see Dr. Bruton and you want to check the user's list and see we're looking here used
user's file with users per line.
That's what we have.
So users list when the wrong directory lets go to the right directory,
then we can say it's, you know, curb root
users, users that list and let's put the domain in as well.
You'll see there is an option for that.
Since we have the domain, it makes sense to play, then it should increase our chances of getting positive
results at Tricorp local.
Let's see, can we have Python two this
time to spell out Curb Purt?
It's weird to consider how it works, so I don't know why I worked with that took out zero, but it
did.
That is a mystery to me.
I really don't understand that.
But anyway, we now can see that we've got valid user accounts for all these.
So, Administrator, behold Martin S. Thompson tillable.
So this is why now we know we're working with valid accounts.
We've got, you know, these users, we know they work which need passwords.
So there's a couple of different things we could do.
Right.
We could try to brute force these accounts using like the RockYou password list, or we could file much
a CPU's try to crack it.
But in this case, I think it makes more sense to build a custom word list.
Right.
We've already got those CSP files and we can scrape the Web page and pull them, put an additional key
words and phrases, and then we can add some sort of variety using hash tag and build an ultimate word
list that is perfectly tailored to our target and thus increase the probability of us getting into the
system, into this network.
OK, so let us go back and look at what we have with these Kafar.
These are CSP files.
All right, so we've got this.
Let's work on a password list that's going to grab only the ones that start with 20/20.
And we're going to do some.
Bachchu, let's cut this up.
Let's say everywhere there is a single tick.
We want to get possible passwords.
So using a using a comma as a delimiter, we can do one two.
So I think we should use usernames and passwords.
So we want this bill to filter and what else we don't care about that for know probably something interesting
here.
Five,
maybe we can build this out or this from that six.
Maybe even this seven.
Eight and nine, so maybe five, nine, five through nine.
OK, that's interesting, good.
So we got some we got some text, but we need to clean up a little more so we can actually use this
tool, which is the translator, delete characters and we can use this to rearrange or transform some
of the characters in our stream.
Go back up here.
I can say TIAR Tactix and I just want to get rid of all the double quotes.
Right.
I don't care to use that in my passwords, so I'll clean those out the TR space minus D single take
quote a single tick that's going to continue to build out this word list.
It's also clean up any spaces.
Right.
I don't care about these spaces to clean them out.
And what else can we do.
We can start putting stuff on the lines now.
So if we look for everything that's a dot like the extensions dot, I can break it here or turn that
into a new line so it goes into another line.
Right.
So transform this dot into a new line.
See PDF.
Now, that new line right here broke it right there.
All right.
What else do we want to do?
We want to take everywhere.
There's a comma, but then a new line.
Right.
So these comments right here.
Let's put these on your lines.
Sweet start.
No good.
We also want to take every place.
There is a dash like this with that new line
everywhere.
There is a
underscore.
It's got a new line
looking good.
Now it's sort unique.
And we can write that to a file called Passwords.
The so it's looking good.
Do a workout on that.
Twenty five words so far.
It's not that big, but we're starting.
Right.
We're starting we're starting to build this out that we can use a tool called Cool
to get even more data.
So if we.
Tikku.
It's going to ask us for stuff, so let's go and give it the help argument
and let's see what can we do here is build out what we're going to do.
All right,
so we're going to see Cyro cool, and first thing we need to do, I think, is the depth, the depth
despite her two of the default, how, Nesto do we need to get this page is very simple.
We don't have a bunch of links nested, but I'm just going to sort of depth to five just in case there's
some hidden links that we didn't discover.
What else can we do in here?
And a one word length.
Right, Agent?
We could change this thing if we wanted to with numbers except words with numbers in as well as just
letters.
Yes, because passwords can have numbers.
So we want that with numbers.
And then we want to put in the webpage right now.
This one is got the homepage, start calling from there, Jocie Shaffi put that in.
And we're going to do is we're going to put this double redirections so that we don't overwrite passwords
that list, but we append what we find here to passwords that list really important.
We just put one greater than you don't overwrite it.
But now you go back up and we can show you clear that we double count minus L and Python passwords that
list.
We should have more.
Yeah, we have 205 and you can see there's a lot more in here now, right.
Well, this line looks kind of weird.
I don't know why I put the banner inside.
I guess I typed everything.
I could just get rid of that real quick, see if it starts with cool.
This should be a pipe
and put that back and put this in a new file called Passwords to that list.
OK, so I had to do that because I don't like those little things inside of my work list that are going
to just bother me so as to remove our passwords that illest sweet.
And then we can change those back passwords that list.
OK, just make sure that we actually did that is still there.
So I don't know.
Let's just leave it there.
Doesn't matter.
All right.
So we've got this for our list and we're going to top it off with Hashad.
So hash tag is not just about cracking passwords.
You can use it to build awesome password lists.
And we're going to do that by adding some additional text into
into our passwords list.
So we're going to put some seasons into this file and you're going to see why in a second summer
this spring and finally winter.
So we do tell passwords that list.
You see we've got these in here now, right.
So what we can do is we can actually transform this so that we're actually add permutations to all the
passwords in here.
And we'll also include this because a lot of times you'll find passwords like, you know, fall 20,
21 or winter 20, 22 includes, you know, the season and the year.
And so by adding this to our file, we're adding or basically increasing the fidelity and efficacy of
our brute forcing efforts.
So let's go ahead and launch hash cat
with help.
Sure.
OK.
All right.
So what can we do here?
Well, we want to first at force.
We just want to ignore any of the warnings, you know, normal Pinterest.
I wouldn't do this, but since this is a lab environment and we're using them, we're probably gonna
get some areas where we can safely ignore them and just continue to proceed them.
We want to do is one of these the rules?
So if I go back, for example, you can see it in a couple of times, tic tac rules, TAC file, the
file that we need to specify.
Multiple, multiple rules apply to each word from the word lists and you can see the best 60 for us.
You can put the path and then best 64 that rule.
So let's do that.
So we're going to say rules file, right?
And then we're going to set this to user share.
I believe it's hash cat is hash cat, I think is actually in rules C cultic hash cat tattoff
rules and I c best.
Yes, right.
And then we're going to say and we want to send it to standard out.
So if we go down to the bottom, should be listed
as I just said.
All right.
I stood out to that crack a hash instead.
Candidates only.
Right.
That's what we want to do.
We don't actually want to crack anything.
We're printing it out.
And where do we want to do what?
We want to send this to a new file called like passwords to that team.
And we're could close this one.
And right now, I could have just did it to password's that I lost, but sometimes if you oh, I just
realized we didn't actually specify the passwords file.
This is the file.
We're going to run this against the passwords that passwords I lost.
Zero kill minus nine.
What is this?
Four four one one one six six
good.
So, yeah, and the reason why I put this second passwords out, because I don't want to clobber the
original one.
All right.
We're basically saying read this file as input and then return this newfound output.
But these names are the same then.
And depending on when it reads and when it outputs, you might actually have it output the results,
overwriting the input and thus clobber your file and get nothing.
So it's always good just to try to avoid doing that.
And I do that by renaming things and we have a new one so we can do like we count one as well.
And we can do start at enlistee, let's see cat passwords
or something that actually show us which files so we can't do it manually.
It's OK.
Passwords, not nasty.
So the old one had 209 and the new one has sixteen thousand.
Right.
So if you take a look at it,
I mean there's a lot of stuff in here.
Look at all the stuff we got, you know, we had a small list and now we have this awesome worthless
that's like custom tuned to our environment, greatly enhancing our our ability to actually get this
password.
So this is really, really, really good.
And we're going to go ahead and run this.
Go ahead and first remove the old passwords, list the file and then move it chasing me one to the old
one, the old name.
All right.
So we've got both of them here, passwords that list and users that list.
All right.
So let's go ahead and start cracking.
Right.
These Hydra for this name, Hydra and Hydra has a complicated syntax.
It's one of the reasons why I used to stay away from it.
But it's very, very powerful.
And one of the things we want to do is we want to, you know, crack these, but we need to make sure
we specify the correct syntax for SMB.
Right.
So you can see that there is a module or a service called SMB Support Services SMB.
And one of the ways you can do that is if you look at the service module usage details, you can get
more information about how to use it so we can type like pseudo Hydra,
Hydra, SMB dequeue.
And now it tells us right.
Help for the module SMB module be different value set to test both local and domain accounts using a
simple password with entailing dialect.
I'm not really sure what that means.
The important thing that we really care about is this because we're using a domain.
So we probably want to hit like a syntax that looks similar to this so we can do a pseudo hydra hydra
and we want to specify the SMB service.
How do we do that?
Go back up here and see here, I think service colon whack whack server.
So service, call them whack whack and then the server which would be targeted and we have a list of
users.
So how do we input a list of users and see if it tells us tackle file that looks like that might be
what we want.
Yes.
Take a login or technical login with a login name or load several logins from a file.
We want to do this load several log on a file.
So Technofile.
So we want to do, as you say, technol users and we want to do something similar for the passwords.
I'm guessing it's TAPI.
Let's scroll up and see.
Yes.
Tech capital P file load several parts of your file.
So we want to do Hoopes entities in.
All right.
So we've got both in place and we want to make sure we put this little piece in right here so we can
put in other domain and make sure we get maximum, maximum coverage here.
Fabrique Corp,
Fabric Corp, Fabric Corp, Fabric Corp, Cat Azzi hosts Varicorp.
That local Quassey exit control of the.
That looks good and I think we can present this one.
It started at 13, 18 months in a VM, so it could take a while, but it's OK.
Right, so we're back it took about 15 minutes on this VM team, my specs are on this thing, but took
a bit of time to crack this.
So, you know, if you had a be firebox, I'm not forgetting the ram on here to two processors.
It's not really too beefy, but we eventually got something you can see here.
It's saying Account B, halt passwords and the password is valid, but the password is expired and must
be changed it on the next log on.
So this is interesting.
Can we log in with this account?
That's the question, because it's expired.
Now, if this were an interactive session, you know, Windows is probably just going to prompt us to
change your password automatically.
But, you know, because we're doing this, holding the command line from Linux, we might get a different
result.
So let's see what we can do here.
Let's go and say that let's go back to Discovery
and let's before we play with that password, let's see if we can use LDAP Search to get more information
about the environment.
OK, I can't contact the Observer.
Let's just run help and that a bunch of different options here.
But what I'm really interested in first is how do I specify the target?
Usually it's like a dash h.
Yeah.
H host and observer.
So we'll set the target as the old observer and we'll set the scope to base.
What else can we do.
We can also just use simple authentication.
All right, so let's go and do this stuff.
We go through that search and each is target base simplification.
So we got some results back and I'm not even using at this point.
It's just purely unauthenticated.
There's nothing really when we got this fabric corp that look cool.
See that as part of the sub schema sub entry.
But we don't really have much more than that.
If we could see this fabric corp, that logo in here, which we already knew about, nothing really
else.
So anyway, I just want to check that to see if we can find something interesting from that.
So let's let's go out and see if we can use the S&P client to connect.
OK, so if we do see the S&P client.
We get some options, right?
User equals behold, and I knew it was Tic-Tac easier because if you look in the options, you'll see
that it's right here.
Tic-Tac user equals and the username.
Right.
And then we want to make sure that we specify what do we want to do, what we want to list, the list
of the shares on this target so we can use the I believe it's tagged out for this.
I can never find where I want to go in here, you know.
So what I can do here is I can say I think I can do this.
I could buy list does not work that way.
OK, so that wouldn't be too easy.
There it is.
Tactic list equals host tactic list equals.
This is the host and let's see if we enter his password again.
Says password must change.
Right.
If we try putting in an invalid password like bla bla bla bla bla bla bla, we get a lot in there so
we know we have the right password.
Right?
It is.
This is actually echo.
This export
password equals this because we need it.
Echo password.
Yeah.
So how do we change a password.
We need to change it somehow now we can see if there's any tools, SMB that let us do this, I just
typed S&P in tab to see what what tools we have.
Oh, look at that S&P password.
Maybe this does it.
I bet it does, man.
Oops.
Want caps man.
SMB password.
Let's just look at the man paid for it but look at that users SFB password.
That's exactly what we want.
OK, so let's go ahead and rock this rocket, this rocket, this rocket.
We can say like zero python three.
No sorry.
We can say zero zero SMB password user is beholds.
And what else do we need.
The remote machine.
Right.
Our machine tech.
Our probably target or password controls.
The password I'm going to name it password.
That's one, two three passwords changed.
Very cool.
Now what can we do.
Well we can try to spread so we can do zero python, three semi SMB target, SMB target and we can do
this user which is beholds actually what we want it.
Oh yeah.
Let's, let's spray this password, the one that we cracked across all the uses in our environment.
So users list and let's just do this and we'll they continue on success.
So all I did was I just took this password, the original one that we cracked and I sprayed it across
all the users in this list.
So I just tried this password against every single one of these users being SMB.
And I got this purple dash password must change for behold, the password must change for tillable.
Now, interestingly enough, I wasn't expecting it for behove because I just changed his password.
So it looks like it might have reset back to the original.
And if it did, that would be kind of interesting.
We need to find out why that happened.
So let's go ahead and reset the password again.
Oops, I did that wrong by that.
So here's the password on a clipboard and I'm going to type in any one
and we get an error message.
I tried the old one again, which was this.
And for the new one, I just did this.
But I got this error message and says the password was rejected
because some password update rules were violated.
All right.
So there's probably like a password policy on this target that basically says you can't.
It's probably remembering the passwords that I've used and it's not letting me use passwords that I've
set within a certain threshold.
So I probably need to change it to something else.
That's what I'm going to do, is I'm just going to say, OK, password, and then I'm going to change
password.
One, two, three, four, password dash.
One, two, three, four.
That worked.
OK, sweet.
Now I'm going to see the RBC client.
Let's see if we can
authenticate as behold and password.
That's what you do for Inamed users.
Yes, that is huge.
OK, let's see if we can query the display info.
We can.
So we're getting all these users.
We have more user accounts now.
We have more information and we do like the printers, the privileges.
So we've got some accounts.
What privileges as a personal privilege.
Maybe there's an account that has that which would be allowed to escalate our privileges.
There might be some others in here, too.
But since we are looking at a printer, let's see if we can do like Emam printers, because remember
on this page, this is a printer, right?
So it makes sense to enumerate what we can from the printers.
And by the way, I'm getting this from this help file, right?
If I do control a bracket, you know, I'm just going to hear pressing in to go through the file every
time I press.
And it just shows me the next match.
And basically I just went through here and I just, you know, I'm just enumerating the stuff that I
thought would be interesting for the particular engagement.
You can see here the matched versions come out.
So enum drivers and printers and the printers.
Right.
Can also any drivers if I want to,
which really isn't that interesting to me, but I do want to see the printers again.
And so let's see, we've got this printer name, which we already knew M.F. TI does.
Mufti's are one.
I knew that, I believe from this page.
Yeah, it's a pretty name I would out.
So we've got the IP, so this is the share, right.
And we see it's near it's going to Doc's passwords candidates.
OK, so we've got clear text creds.
So we just grab some more cards and we have that username list.
So that's what we want to do to the school.
Let's go back here.
Let's grab these users.
OK, so we got some more users and we want to make sure that we grab them.
So it's good.
I just presti control a left bracket to get into this mode where I can search through the terminal using
up down our keys and then I'm going to go above the line.
I want to copy it, spacebar down and enter in the receipt of them, go to users to I just you know,
it's to control a right bracket to put them in their escape ships.
Easy cat users to good.
So let's just go ahead and clean this up a little bit.
We can use OK, let's use the Fort Bragg as a or the last bracket as a filter separator and then we
can just select
the second field.
Right.
This will be the first field to be the second field and see this works.
Whatever.
Oh, I put another curly brace here.
There we go.
And then on top of that last part goes, do it again, right bracket.
It's probably a better way to do this, but this is working for us, so we're good.
And then this time we're going to do the first field.
Right.
You see what I'm doing right now?
The first field will be this one, because this is the separator.
I specified here right now we've got we need of course, we're going to do sort my shoe and then what
we can do is we can add that to users that list.
And then I think, I don't know, actually users that I list, he might be some duplicates in there.
There are.
We can just we can see we can decide this.
Right.
We can see tillable.
That's Thompson, Pimlott.
And behold, I mean, it's basically everything in these top lines are duplicates, right?
So we don't need those toplines.
So Cyro, them users to use that one is there's one which is just users will say the w w w w w let's
clean this up.
I'm just pressing w escape.
She was easy to remove users to that list, cat users.
And we've got what we need right now.
We can run Kurbanov against this again, make sure all these counts are still valid up.
So we've got some more.
But these are actually blocked disabled.
Interesting.
These accounts are blocked or disabled, but we've got some new ones and we've got this as faceprint
account.
So we've got this SBC scan account and we have a password over here.
So let's not forget about that over here.
Until Ezzy say this password said Prothese included.
No, this privacy opens here and then ends there.
So this is the password right here.
Torrisi OK, sweetie, let's go back.
I just still working.
That's OK.
We don't really need that.
We want to now add another password so we can say export password to equals this.
So let's see if we have both.
That didn't work, right?
I think it's because the shell is actually interpreting some of these characters.
So we can't do that.
You know, the easy way to do it is to do I go in without any lines and put this into a file called
Let's see, Cretz.
That text got creds, didn't work still.
So let's make sure that we put a single tick over this cat creds.
That looks weird.
Let's just go ahead and move this file, start over, because I think we are screwed some things up.
There we go.
We've got it.
Let's go here.
Almost a CME.
Sorry, Python, Python three me and we will run map and we'll say, all right.
And we're going to do it against the target, get their needs are listed.
And this time I'm going to spray this password and continue on success.
This just means I don't want to stop on the front of our password.
Keep going and look at that.
We've got to here for SBC print.
And as we see scan, looks like this printer printer password.
These looks like service accounts, by the way.
And these passwords are probably static and we might be able to get a shell as this particular account.
But you notice it doesn't actually have a yellow pwned thing.
So this means we can't get a shell this way because we don't have local admin access with these particular
creds on this machine fuse.
But we can try to use when our ran, because if you remember when we did this assembly was not the only
protocol when our name is also one on own and when whatever we can own it using when our employees go
up, take this guy out, see if we get.
Pond pound, so now we've got local admin access via Wynnum with this service account, so I bet we
can log in with it so we can use something called evil in our home, which we don't have.
It's OK.
We can use that to get a shot in the box and basically gain a foothold.
Let's do that.
Let's take the suburb, do a Google around for evil when R.M..
Let's see.
That's the only one for Mac players.
It's written in Ruby, so we can probably install this using a gym.
I don't even need to look at this.
I just do zero gym install.
You'll win our M.
I bet that's the stuff that's happening.
While we wait for that, let's see how you install it.
Look at this.
Well, that is awesome.
Reminds me of one of the froggies or Punter's from America Online, like back in the 90s.
That is an awesome picture.
So funny how to install this thing, Jim.
And still, even when I am great and then just launch it, it's pretty straightforward.
The second installed a pseudo evil that sward pseudo evil when R.M. and a target and see what it's saying.
Target tech.
I target tech.
You name tech PD passwords.
This is a post exploitation tor you use this after you've already achieved the credential access part
of your kill chain.
And so we're not going to use this to exploit, we're just going to use this after we exploit the box,
which is what we're doing here, see what happens.
Bam, you're now logged in
as this user like a browser that if our system so you need to do now is see what are our privileges
like to do this?
It's one of the first things that you want to gain a foothold in the Windows box.
What am I privileges?
What can I do?
And I've got a few.
I can add workstations to a domain.
You don't really care about that.
That's going to help me escalate my privileges.
I can load and unload device drivers.
So that's enabled.
That's generally a bad idea.
Why can we do that?
Let's go ahead and make a screen back.
All right.
So, yeah, we can load drivers.
So what we're doing, the next lesson is we'll go ahead and exploit this and you'll see that there's
a couple of steps that we need to do in order to achieve privacy on this box.
And then we're actually going to try to prevent another way using the relatively recent zero log on
as CD.
So it's going to be really cool.
You're going to get this box two ways and we're going to really have a lot of fun.
So next lecture, we are going to take advantage of this vulnerability.
All right.
So I'll see in the next lecture.