All right, so we've got this show in the box and we need to sort of assess our situation, we need
to gain our bearings.
We need to sort of figure out, you know, what is the attack surface of this machine?
How can we vertically escalate our privileges?
So there's a couple of things we can do, right.
The first thing I like to do is just confirm my username.
So my username is S.P.C.A. print.
So I'm most likely a printer service running on the Fabric Corp domain.
Well, what permissions do I have?
What groups of my part of that user and then I type svc print.
You can get a list of this right.
So immediately we can see we have a local group membership to print operators in a global group, membership
to domain users and it accounts we have no local administrative privileges on this box.
Right.
So we are not a privileged user.
And if we just like net user, you can see a list of all the users on the machine.
So we're not trying to horizontally escalate our privileges.
In other words, we could do that.
We could try that.
We could, you know, see if there are credentials left on this box.
You know, maybe there's a backup file located inside of this SBC Documents directory, or maybe there's
a spreadsheet that contains credentials, maybe as toxin's potential.
And maybe she's not an administrator, but we can log in as her.
And then, you know, she has access to a SQL Server database, which we can then run XP Comanche against
and then, you know, escalate to another user until we eventually arrive at an administrator.
That's a possible vector.
But an easier approach, a quicker approach is just to see what permissions this particular account
has.
So far.
RadNet is who am I?
Prev.
I get a nice snapshot of the privileges for my particular account on this computer, which, by the
way, is called Fuds.
Right.
So what can I do?
Well, I have the AC machine account privilege.
This means I can add workstations to the domain, what we do right.
I mean, that's not really an exploitable attack vector.
So we're going to move on the next one with Celo driver privilege load and unload device drivers enabled.
OK, so this should have your ears perked up a little bit.
You might not know how to exploit this, but just think about this.
What it's saying.
It's saying that my particular account that I'm running as SBC prince on this particular system I use
can load drivers on the system.
So perhaps I can load a malicious driver, right.
I mean, I can dynamically load device drivers.
So essentially I can execute code in kernel space and that could be our path toward victory.
Right.
So let's go ahead and Google this to see if there's a way to find a path here.
So let's just go ahead and open up the Web browser and we're going to type in silo driver privilege.
Just copy that to a clipboard.
I grab it.
So we're in Google.
We're not seeing them, as you can see, in the upper right corner.
And we're just going to go ahead and type like that.
And immediately we see the privacy escalation autocomplete.
Right.
So Google is telling us it's basically reading our minds.
It knows that this is what we want to do based on the search engine optimization for this phrase.
I'm not signing so that it's not pulling this from my search history.
And let's see, we've got something here, S.E., abusing as helo driver privilege, so this is an excellent
article by the folks at Htar Logic.
I behoove you to read this.
There's a lot of valuable information here.
And so you want to know how this particular exploit works.
You don't just want to execute scripts because then you would be a script kiddie, which is what we're
trying to avoid that designation, essentially.
So let's see what we can do here.
And what I'm doing is I'm just looking for the p.l.c. and you can see here Europos Driver.
So let's go ahead and control.
Click that to Oprah Dupain and say this is a QP file.
So it's a C++ file.
Now, we could there's a couple of options, right.
We could try to build this exploit on our local attacking system.
But it's a Linux box and we're trying to exploit a Windows machine.
So typically, in my experience, it makes more sense.
You have less problems and errors if you just build the exploit on the target of the target machine's
operating system, it's just the easiest path to exploitation.
So we're going to go ahead and set that up.
Let's go ahead and fire up our windows box and see if we can do here.
So let's see what to escape.
Windows 10 as up this puppy.
So here we are in our Windows box.
Let's go ahead and open up chrome dragged this down here like having everything in one place, OK?
You know, everybody's OCD in some way.
That's my OCD.
I like to have all my little icons down there and delete this one from the desktop.
All right, so here we are and Google, and let's just go ahead and type that, S.E., S.E., load driver
privilege.
We've got the Tara logic post.
Skip down to exploitation and let's see if we can find out how to actually run this
control, click this guy and I saw something else here.
You go down a little bit so you can see this basically a bunch of different parts to this.
Right.
So I don't know how to describe this.
So it's actually three parts to this exploit.
It's not just one thing that you compile and click.
So first you have to load a vulnerable.
Microsoft signed Binary in to the registry and that's what this EOP a load driver project does.
OK, and we're going to use Capcom that says because it allows a user and process to execute internal
space.
And that's the vulnerability that we're going to exploit to once you once you have the driver loaded.
I need to exploit it and we can use this tool here to exploit Capcom.
And essentially what we can do is we can go to the source, we can tell it what executable we want to
load with system permissions based on the honorable driver load of a memory.
And this is where we're going to go ahead and use Ngarkat to shovel the shell from the victim to our
next attacker box.
But there's some modifications we need to do to the code and we're going to work.
I'm going to walk it through that step by step.
So we actually also need the Capcom that this file, which if you go back to the tragic thing, it tells
you, you know, the hash for it, but they don't actually give you the file.
And I guess that's because they don't want to make it easy or too convenient for attackers to to take
the next step of compromising the host using this exploit.
But we can actually find stuff which is type like Capcom that says I think it's like Capcom that says
for the security.
Those are the guys that actually publish this.
Yeah.
See for the security Capcom.
Here it is for the security get up.
Here we go, for the security capcom GitHub.
See, it's the driver.
Now, one thing we're going to have to do is disable Windows Defender, because it's going to immediately
catch this dishonorable driving when we try to download it, smart screen is going to kill it.
Windows Defender is going to kill it.
We can't just download it.
It's not quite that simple.
So disable defender.
Many settings that disable all of the stuff.
Real time protection off cloud delivered protection of automatic sample submission.
All right, let's just make this box naked because we need to do our testing here.
All right.
Good to go.
It's going to download.
Saying this file can harm our computer, so even Chrome is trying to stop us.
All right, we're going to go ahead and keep it.
Hopefully it will honor our request.
And then let's go out and download these other files.
What is it?
And we'll download this zip as well, this is the concept for abusing the Cee Lo driver privilege.
All right, so apparently we've got everything I'm going to close out of Chrome.
See if we can find our downloads.
Extract everything.
Extractable.
Delete everything that we don't need and just control clicking all the stuff that we don't care about.
All right, so let's see, we've got this low driver, we've got this master, what is the mode driver?
We have a raw C++ file, so let's go ahead and open a new visual studio project and just dump this in
there.
Visual Studio twenty nineteen and by the way, Visual Studio is free, I'm using the community edition.
Anyone can download it just by Googling Visual Studio and you'll have it there.
There's a section there where you can install it.
So we've got Visual Studio.
Let's go ahead and create a new project.
And what do we want?
We don't want all languages, right?
We just want C++ because it was a dot CPP extension.
We want to console that.
Right.
We just wanted to run in the Windows terminal.
You know, we don't want anything fancy here or platforms.
Nope.
Just windows and of other types.
No, let's just do Kosal.
That's Cricket Council up next.
And let's just name it EOP Load Driver, it's going to put it in this folder right here.
Copy that to the clipboard.
I'm going to place the solution in the project in the same directory.
Just makes it a little bit easier to find things
while that loads.
I'm going to go ahead pop a new explorer process that has the path.
So I'm just thinking ahead.
All right.
Let's go back to the studio that looks good, looks like it's still trying to create the project of
the image running really slowly.
I don't know why you may not notice that through the recording, because I did a lot of editing so that
you don't have to suffer like I have been.
But sometimes that happens, right?
Sometimes your virtual machine just sucks.
You know, I've already tried mopping up the memory and the CPU and for some reason it's still crippling
my it's just running at like 100 percent constantly, which is kind of annoying.
Here we go, everything nice and loaded, EOP low, that CBP source files and we should see the zip
file here.
We do.
Right there it is.
So what do we want to do?
This is obviously not what we want to do.
We don't want to print Hello World.
So let's copy.
And the contents of the driver into their right, so I wonder if I could just drag and drop this and
like this.
OK, OK, so let's just do a little X.
To cut that.
Control and tweet, Jova paste.
All right, so we've got our three lines of code in here.
And we can see, you know, what this is doing, this looks like this was written by Oscar Meyer and
what we have.
So it's good to just, you know, just to give the code a quick glance.
I mean, not that we don't trust our logic, but we just want to make sure that we're not going to introduce
any kind of security holes into our our system.
That's unexpected at the outside of our knowledge.
So everything in here looks really good and even tells you how you can run this tool.
Right.
So you can type the driver name and then you need to give it a register so we can create this we can
call this VONNE or whatever you want your name.
And they were just going to basically give it the fully the full path to the driver, which is actually
called Capcom Cap Composites.
So compilers, we don't want to compile it in debug, we want to compile it for release and we're running
up against a 64 bit system.
So we're going to go ahead and say x 64 and then we're going to build it.
Build solution, hopefully we don't get any errors, or if we do get errors, hopefully we know how
to fix it and usually we can fix them pretty easily just by Googling around or thinking things through.
You can see the build process happening right here.
It felt in our open source, postdebate eFax such directory.
So, you know, this is the only file included with quotes and not brackets.
So I bet this tool is looking for this file in the local directory, which is a president.
It will compile.
The question is, do we need this?
And I don't know if we do, but just comment it out.
It's going to put forward in front of it and see if we can rebuild it without it.
I think this is like a generic C++ file.
We might not need it.
All right, build one succeeded, zero failed.
I love to see that.
OK, so where are we?
We are in this folder right here, Skrappy's Path.
Right, quick copy.
And here we go, you see the timestamp matches just a minute ago, so I'm going to right click this,
I'm going to copy it and I put this in the download folder.
All right.
So now let's look at this exploit Capcom Master.
All right.
So we have a Visual Studio Solutions file.
It's going to open that.
So you should only open products from a trustworthy source.
Would you like to open this project?
I would.
I'm glad the visual studio warns me that.
That's nice of them.
The project is loaded and ready to use.
All right, you might say, well, where's the project if it doesn't load for you?
We can always load it in the solutions explorer on the right side of the screen, quick little flip
the arrow, go down to source files and then double click the value on notice.
Here you see the steady, steady state ethics file is here.
So that's probably why the other one didn't compile because it was simply missing that file.
All right, here we go.
Exploit Capcom.
Go and scroll down here and see if there's anything we need to modify.
So I'm just reading through the comments, right.
Representing way out of in buffer for the vulnerable elektro.
We don't really need to know the details of how this works, but we need to know what's here.
Now, here it says Capcom does this exploit and the secret file failed.
So it's kind of see how to get into this condition.
We don't need to worry about that yet.
Only if it fails, then we need to look there.
OK, this is what I'm interested in, Launch Shall Watch launches a command show, and you can see here
it's just going to launch seemed to be a system.
We don't want to do that.
Right.
We want it to kick back reversal to us.
So let's see how this is what's happening here, this string.
It's being saved, too, it looks like a character array called command line, which is then being used
or passes create process function.
So let's see if we can Google create process.
I'm seeing great process as the first hit on the Microsoft Web page, so let's go and click there.
That's probably the documentation that will give us the syntax of how to use this function.
Yeah, this is what we want.
See the syntax.
And you can see here, it's like we're passing it with a nine, nine parameters, ten, ten.
The first thing we pass in is the application name.
And let's see, it actually tells us what that is.
OK, so in this case, the application is completely and we probably won't see indeed to launch Netscape
so we can upload Ngarkat to the victim and then have and execute it and see if we can figure out how
to do that.
Second parameter is a command line.
So the application comes first, then comes the command line command line to be executed.
All right.
So here you see they're actually passing ACMD as the application and the command line.
That's going to change that.
So we're going to do another teacher argument.
It's going to be the argument we're going to use, we're going to pass to see immediately I'm going
to say, Fortunati, why am I doing that?
Because let me show you real quick, if I open up the command line.
I type who am I, it tells me my username and my workstation hostname, right?
But if I type seemed like folks I see, who am I?
Does the same thing and what's happening here?
He seemed to accept folks like Questionmark for Tallassee carries out the command specified by the string
and then terminates.
Right.
So we want seemed to carry out Ngarkat and the terminate.
We want to send us the shell and then die so we can say and see Daddy.
And what's the syntax for Neko Case?
We didn't know.
Can go back to our Kalay box, split the screen for us to use pseudo locate.
Ngarkat indicates crazy.
Got here.
You know, copy this to our current directory structure.
We have it.
We do.
And if we do, we can't do this.
But if we do this, we say C minus H.
This is the latest version of that cat, which is similar to the Windows P version.
This is the Windows version in the Linux version.
But we want to do we want to see Ngarkat Mean what the victim to connect back to us.
I say Ngarkat options.
What options do we want?
We want to send a shuttle program to exec after Canek.
Dangerous, right?
That's what we want.
We want it to send Dashi seemed to back to us.
How do we specify us pickle's here hostname.
Which would be our tacker IP.
Right.
Ten, ten, ten for twelve.
And then a port that we're listening on.
We can listen on Port nine thousand one to its code and put that into our code to the ten fourteen twelve
nine thousand one and we'll send back immediately.
Then what we'll do is when we pass we'll pass this to, we create process function right here.
So we'll say argument like so and then these other variables.
No point, no point.
Faults create new console.
No no pointer, no pointer start info processing.
Oh we can leave this as a default.
The reason I know that's because I've already read through this.
Right.
And I can see that all this other information now it's fine if we leave everything else the way it is.
So it's going closer to chrome.
That looks good.
Change this to really sixty four.
That's good.
And let's just build this puppy.
I really can't wait to get off this one.
Box Windows box.
It's so slow.
I've got an error message.
Syntex looks like we forgot a semicolon and I can see that right here.
That should do the trick.
Notice how a semicolon exists here.
You need to also have one here.
Build, build solution.
Right.
So it's exceeded.
That is good news.
Let's go ahead and grab this file and copy it and put it in our download folder.
We're going to send everything over to our attacker machine.
The S&P is the easiest way I found it.
Just move stuff around.
All right, sweet.
So now let's go to our Kelly Box and let's set up a file share.
Clear, it's in this folder suite and let's see what can we do?
Let's go ahead and do zero impact server.
Assembly server.
Yes.
All right.
So what we can do is we see the impact S&P server will use SMB to support because Windows 10 like this,
if you don't have it sometimes it doesn't connect because it considers it a vulnerability assessment
team, is it?
I support it from the file share.
And you also need to put a username and password.
So username or to say vonne password and then what we need next as a share name and a share path to
your name.
It's called Exploits Path Current Directory
and something happened.
I think it's because I put two back takes instead of one to text.
So let's go ahead control.
Right, right to left, right, control.
Left, right.
This gets me through the primaries when we're at a time.
I think a shortcut now.
Of course, we need our IP address.
Krepp it is there Ethernet adapter.
So Tintern are one entity 168, 38, 128.
Let's see if we can connect to this.
Twenty one, sixty eight thirty eight, one twenty eight exploits should prompt me for credentials.
Hopefully it does yeah.
Make sure I put the password in correctly, right?
Remember my credentials.
OK, we should see the route.
We should just see NCDC and we do.
So Skrappy's files, drag them over.
All right.
And let's go back to our Tucker box and make sure that we got everything we needed.
Yep.
All right, so this this is interesting, this is a in alternate data stream, A.D.s that included inside
of files are downloaded from the Internet, and that's how your Web browser and Windows defender knows
that a file might not be safe.
And that's part of the reason why we got hit as part of the reason why Chrome actually
why Chrome complained when we tried to download this.
For example, if I go cat capcom, that's this I identifier.
If I can see here, it's actually showing you that it came from this location and 083 means the Internet.
This is also a data stream that got passed out.
So that is actually really, really cool that we can see that.
But let's not get too bogged down here.
Let's upload all these things to our computer target.
Now, where do we want to upload it?
Let's go to the root directory, because it really depends on it's really important to learn where to
upload things.
Right.
There's a test folder.
I see if we can upload it there, but we might not have execution privileges on all these these folders.
I'm kind of more inclined to use this universal print driver folder because we are a printer service
account.
So we should have rights to write to this folder here.
So let's start there and let's modify if it doesn't work.
OK, so we've got CD, data, CD, HP, Universal Print Driver are OK suite that we can upload uploaded
Capcom that says.
Upload EOP load driver Niyazi, and she's pulling all this from the local directory, this home folder
boxes views because I ran it even when I ran out of this folder.
So it knows just to look in this folder for any argument I pass to the upload command and this is a
win.
R.M. Even when our feature this upload command and I'm using.
All right, so we exploit Gap Condry exceed.
And then, of course, they want to upload our beloved.
Speaking of that cat, we need to make sure we set up our handler for Narcan versus make sure we have
our files here.
We do.
That looks good.
Puts it up our neck.
Cat handler, what are we going to do when he's arnol rapper to catch it?
Now, what is RL rap?
You see, I don't have it installed right here because that's why it's red.
I'll tell you what it is.
CIDRAP Search R Rap.
All right.
Cee Lo Apte C what does it show.
Try to hit Cee Lo's space app.
Space tab.
That's how I got that list of everything I needed.
You see what this does, right?
It's a red line editor and it's a featured command line rapper.
Input history is remembered across invocations.
Right?
This is what we want when we're connecting the reverse show back from Windows to Linux box because it
gives us the UpDown functionality that we love to use in a window show.
Trust me, without it, your life will suck with it.
It won't.
So just make sure you use it so you know, I'll wrap the Winslett.
We didn't see the Apte install or wrap tech y to say yes to defaults.
CEDO, rl wrap and C minus because of names.
Be both.
Listen on PT..
Nine thousand and one.
Let's go back here and first we need to alert the driver so we'll say not backslash.
This is how you execute executables inpower show because we are in power show.
See this is a power show, command environment variables including the power show and you can see we're
in person 5.1.
That's what this means over here.
We're in partial, right.
So we can say Easthope load driver just to get a list of how we should use it.
Right from our logic.
So we give it the name registry, a registry value, and then the full path to the driver.
So if we do Easthope load driver, not Yuxi and we can say system current control set Conforte.
And then I'm going to follow the instructions exactly how it says here.
Right.
Even though how come that says is my local folder.
I'm not just going to put a cap combat's this like this.
Actually if we do that it won't work.
I've tried it.
I mean you have to put it exactly as it's written inside the XPoint.
That's right.
It's really important to really, you know, to read the instructions, you know, before you you run
these exploits.
The that's what the convenience artfulness.
And what am I doing here?
I want to put the second backslash.
That's and then it's going to be Kaukab that says, let's see if this works when error zero.
That's good.
And I've got no zeros here.
So it's probably loaded.
And what we can do now is assuming that it is we can try to run this exploit Capcom and if all goes
well, then we should get a reverse shell back to our system.
Right.
You remember back here, what we did is we just told we're telling it to, you know, go to Windows
System to command at XY and run this command NCDC.
It's going to know where NCDC is because we are currently executing this exploit from a directory that
contains that binary.
That's our IP ten, ten, fourteen, twelve, nine thousand one.
We're listening on that and send back ACMD Shell, which should be running our system and see what listening
important nine thousand one here.
Right.
So hopefully that makes sense.
Let's go ahead and give it.
Go see what happens when the truth.
Bam, we did get a show back.
But is it running a system and it is so there we go, we just escalate our privileges system, control
easy to system into the system and look at all the privileges now that we have in the box.
This box is now ours.
In the next lecture, we're actually going to use another technique to break into the system.
I mean, sorry to escalate our privileges and we're going to use a new zero log on.
It's relatively new by the time you go through this video.
It may not be so new, but it was really interesting because it's basically one click the domain admin
and I want to see if we can give it a go on this machine.
And then, of course, we'll go through the Internet response process.
We'll look at the logs, we'll see what we could have, what we could have detected from an incident
response perspective, and then we'll map everything to the minor attack framework.
All right.
I'll see you guys in the next lecture by.