All right, so now there is another way to escalate our privileges, right, because this box isn't
patched, right?
I mean, if we do system info, how do we look at the patches?
You have the list of all
access denied.
OK, so I just don't have right to do this anyway.
If we were to get a list of the installed patches, we might discover that we are not patched against
the zero log in a CVI which came out I think it was in October of twenty twenty and it was absolutely
devastating.
It's basically one click to domain admin.
It's that serious.
That is that bad.
So we just type zero logging in here.
Yeah.
Zero logging on ability.
Let's see.
To make the screen big, because we need to look at this, this is really interesting.
So here's the real risk that logging allows a domain control to authenticate computers and update passwords
in the active directory.
Right.
This feature is particularly vulnerable to this flaw because it allows hackers to impersonate any computer
in the company's network and change the password, even with two factor authentication.
All right.
So that's pretty serious.
And it says using that log on, hackers are able to change the domain controllers password that again,
hackers are able to change the domain controllers password.
Right.
Gaining administrative access and taking control of the network.
This is basically a One-Click enterprise poun.
So it's very serious.
And you can see there was an emergency directive that was issued by DHS and there's some rules in here.
You know, how you can protect your organization.
So let me show you how we can exploit our box with a zero lock on it.
It's going to open up a shell with my show.
There it is.
So if you ever lose your team excession, you get a team else and you can see I have one here.
And then I could just do Tmax attach.
And it brings it back pretty sweet, right?
All right.
So let's go ahead and look for this KVI.
I bet, by the way, I bet it's in my display.
We're not going to mess it up, but if we search, we'll find it.
Really,
no way.
I bet I probably do it.
I'm almost positive it would have been in here.
Anyway, while we wait for that to go, let's just go search the interweb for it, let's see.
Zero.
Log on, GitHub.
Let's see, what do we have here?
A couple of different hits.
Let's try this one.
I'm looking at the data, just trying to find the most current data here.
The others were September 17th, and this one looks a little bit newer.
And really, you just have a python file and then a way to restore the passwords, because by default,
this will reset the domain administrator password to nothing, which is very, very noisy.
And then you can you think what secret stamp is actually telling you, then how you can exploit it?
You run this and that by his name with D.C. and then you run D.C. Think they could stop and they should
get you what you need.
Right.
That's how you can restore the password down here.
Just go ahead and grab this one thing you will notice and says he only works on Python three point six
and you're if you're OS comes installed with a packet such as Kawi.
And we've already confirmed that it does do that, because
if I do this.
Which impacted, sorry, locate, impacted because it's here, right?
Got lots of it.
So this applies to me and applies to you.
So if you're always comes in, start with impacted.
Make sure to remove all existing installations first.
If you still get important errors after this, run it from a virtual environment.
So we're not going to actually remove impact.
We're just going to run it from a virtual environment and see if we can get by deleting a packet, because
I want to completely close my box.
All right.
What do we have two windows up in here.
What's going on?
Why do we have two of these windows open?
I don't know what's going on there.
Anyway, let's go ahead and grab this.
So we'll go up to code copy and we'll create a new tab.
We'll call it zero by on point.
Talk to me today.
Let's go get Klown.
It's getting to that director and see what's in here.
All right, so Kat, read me.
It's probably what we already read on the get out page.
Yeah.
Looks like they renamed it to this, so let's go and rename it to this as well.
We don't have to, but I'm OCD like that.
OK, well, it was already named that.
Wow, long day.
All right, so let's see what we can do first.
Let's go ahead and get the latest version of impact.
Sweet.
And we'll go to opt, you know, get Kohona before we do that until you, you know, they're not there.
All right.
All right, so now we're in a directory and let's go ahead and install the virtual environment.
What is this?
It is held by process four four one one zero Apte and the guy might have done that a little bit too
fast.
Or maybe it's because I'm updating.
Yeah, let me kill this.
I don't really care about search anymore.
Looks like it died anyway.
Controls the clear
controls without try it again to kill that process or for want to know.
OK.
I guess sometimes you just got to keep pressing forward.
I wasn't even sure if that was going to work, but I just tried it anyway.
All right.
So that we can get a pseudo python three and a module.
We want a virtual environment.
OK, we need to give it a name, the environment directory, so let's just name it BMV.
Tonight, you'll see there's a V that rhymes.
Why don't you freestyle with me, yo?
OK, I'm just kidding.
I did sound pretty good in it.
All right.
So now we're going to source this file so we can start a virtual environment.
Now you see outside the N.V. here.
So now we are in the virtual environment and we could just start installing
successfully installing packett.
That's what I like to see.
Right.
All right.
So now we're going to do as we're going to run that file.
So let's see, how can we do this?
We can do a pseudo python, three home pin tester or boxes views the and it's called this oops.
Enter and we're going to put H at the end.
So now we know.
Oh that's what I should have been named.
Zero log on Tester.
So hey I got to do that right.
I got to rename it.
Just got to do a bit.
Got to do it.
I'm going to rename that to
what it says here.
Joseph C. Joe should be all right.
OK, so what we're gonna do is we're going to put in a D.C. name and anticipate this stuff we already
gleaned from our recon phase, right.
So we know that the D.C. name, the domain controller name is Fuse and we already know the IP right
to target
content and 193.
So I do this should go bombs away and notice.
This is completely unauthenticated, right?
I don't have any credentials.
I'm just a user on the domain where I'm just a user.
And in the same subnet as this machine.
I'm not on the domain, I'm on my windows.
Sorry, I'm on my Calli Linux attack machine.
I'm not on the domain.
I'm just joining.
I'm just a part of the subnet.
And I was able to execute this attack flawlessly.
Target vulnerable, changing account, password to empty string exploit complete nice.
So now what can we do?
So if we go back here, I think this is where some people probably get stuck.
As you see this and it says D.C. sync with secret, stop using just and no passport.
What a secret stop.
Where is that?
Well, can you locate it so you could stump and you find.
That's right.
So this means we should be able to do a D.C. thing with this.
Right.
Let's dump all the secrets of the hashes
and we can see remember it said Justices' Extract Only the stardate, which is the database for the
Active Directory domain controller.
All the juicy stuff is in there.
Normally this file is locked and you can't access it while the system is running.
It's encrypted and everything.
But because of this exploit, we're able to get quite effortlessly.
You're going to see that right now.
So just D.C. and then I think the instructions said use no pass because remember, we reset the password
to nothing.
Right?
That's what the expert did right here.
Changing account password to empty string.
Right.
OK, and then what else do we need?
We need to put in the
the account information.
So if we screw up a little bit, you'll see this.
All right.
So let's see if we can make sense of this.
Sealed and packet secrets dump, just no pass.
Let's look at this.
How do we get the syntax right?
Well, this makes all the difference, guys, because you can run this over and over and you wonder,
you know, why aren't you getting a shower?
Why is nothing working?
You really have to pay attention to syntax.
So we do all this stuff.
These are all positional arguments.
These are all optional actually because of these brackets.
But we already put that stuff in, right?
No pass.
And DC saying target is not what we need to expand on.
And this is what target is.
This is what it means.
So we need to put in is the domain right.
To use the domain of Photoshop and then the account.
We don't have a username.
We well, else we don't have a password.
But we what we are trying to do is log in using the computer account.
So the computer account is just a dollar sign like this.
So we can do this and we can put the outside, basically we're doing this, we're saying we're taking
this Presswood part, we're removing it and we're seeing the domain.
His views for the user username is a dollar which represents the computer, the computer account name.
And then we're skipping the password part and we're going directly to that.
And now we're right here.
Target, name or address?
Well, we know that's going to be right.
Let's give it a whirl.
Something did not work out, right?
Kneeing or service not known.
OK, well, let's just try flipping this slash the other way, because that's usually the way I see
it.
And Windows environments.
OK, it's possible that the the owners of this just type out their usage because as you just saw, I
flip that slash from afar slash or back slash and it worked, which I thought was kind of funny.
OK, so now we've got hashas and boy do we have hashas.
OK, I'm actually going to close this top one.
Let's not close it because it's still in the virtual environment.
We might need this virtual environment.
Go down here and see what we got.
We got the administrator look at that.
And all we need is this last part range here, the tail end part of the hash copy.
And now we have a couple of different things we can do.
We can either use Plesac or even when our M to pass the hash and log in.
So let's do it.
Igoe winner in first.
Let's go back to exploitation.
Let's go ahead and exit.
If you do see no evil, when R.M. H,
you'll see there's an option for hash.
So can you see the evil when our
target administrator.
How do I know it's administrator.
Because back here is administrator.
Right, OK.
And then the hash is the following and that should be, it should get us into the administrator.
Look at that.
Oh my gosh.
That is absolutely insane.
Look at all the privileges I have.
That's how you can do it with evil when R.M. you can also do it.
OK, let's do it side by side.
All right.
OK, yes, exactly.
It looks like we have it right there.
So I can see the Python three
and all we need to do really is just put in the hashes, right, to see exactly tag ashes to ashes in
this format, the elimination, the empty hash, and then again, the target.
So here we'll just put on the administrator at and then the IP.
All right.
So let's go back and grab that administrator hash right here
and let's do this hashes and notice the format until it matches format is elim hash and hash.
So let's just put the hash twice.
And the username.
Look at that now, our system, so they've got a system and when even when our team got us administrator,
either way, it's a win for us, right?
This box is completely pound.
And that, my friend, is why you should patch, OK, so in the next lecture, we're going to go into
the incident response point of this.
We're going to show you the logs, you know, how you can detect it and other ways that you can protect
yourself against this attack, these privacy.
Right.
I'll see you in the next lecture.
Thanks.
Bye.