OK, so here we are on the box and now we're going to do some incident response.
Let's take a look at what was going on behind the scenes here.
So let's first see if the firewall was enabled.
And let's see, it looks like it is on for the public setting and for the private
where else and everywhere.
So it's on.
I'm seeing that it is on.
So let's go ahead and turn it off since we are running as a system.
Right.
So we can do that by just doing this.
Actually, that can go up.
Oops, I can't go up.
I don't have Earl wrap here.
Maybe you should have done that first.
A type of I just had this little flower ATV firewall set, all profiles, state of play.
That's how you do it.
Yes.
OK, now let's go ahead and enable remote desktop
inside the terminal server, and we're going to set the value to deny connections
and the registered word instead of Arrow.
What did I just do wrong?
Something started right here at Kinnane.
That's because that is a valid claim, each key local machine.
Unfortunately, you have to type the whole thing out again, but maybe, you know, by doing this,
you remember, the more you do things, the more comfortable, more comfortable you become.
I'm doing it right.
I did a part nice.
So let's create a new user
and let's add this user to administrators.
And we've got Vonne on the box
and we are a member of administrators, so we should be able to already put screen.
Let's see.
I just name this remote.
Free RTP.
I think that's the one I usually use.
So kind of worked.
It's the easiest target still.
OK.
Take out the password to a question mark, might be screwing stuff up.
Let's put the password in quotes.
Look at this, this is the index and you notice the slash is not there, so we probably have to put
this in quotes.
Now, what's the problem?
And God's sake, Gil, what the heck is this thing talking about?
Oh, I see the problem this.
Target is specified using this B C to go up here.
Sir Hosny, again, we weren't following directions.
That'll get you got a read, right?
Entertaining those like this box is running called the Corver in the Windows that I see a gooey.
It's kind of interesting.
Which is interesting because normally the Corporation of Windows has a Windows Server, has a smaller
tax office, but we were still able to exploit it regardless of that fact.
Let's see how we can get it going back.
I think it's called natto, I'm pretty sure it's now I don't need to check that, but you say insta
goofy windows Nano.
I don't even know if it's going to work.
Let's try this.
Can paystub and of course not, that would be too awesome store windows to feature a server, a
server.
We shall we start.
Get Windows features like, OK, so these are the features.
S&P one is the tables, that's a problem for the vulnerabilities there, what else?
Our sites there, remote server administration tools, but I don't see you need the gooey stuff there.
Let's keep going up.
It was usually in the top.
All right, turning the desktop experience, I'm not seeing and still.
I are turning to the death experience.
How do we enable it?
This option is no longer available.
We need to reinstall.
We might not be able to do it.
Yeah, this is it, right?
So when does feature circle, we shall try that, do we try that?
So we shall we start?
Nope, your future is not valid.
All right, so we can't do that.
I guess, you know, if you really if you really wanted to work on this from Internet response perspective,
what you would do is look for new accounts right now, user I, a new account here.
And you would also want to look for suspicious binaries.
Because you go in here,
I forgot I have autocomplete, you'll see that cats in here, you see all these exploits are sitting
on a box.
That is a dead giveaway that you've got something going on and you can have all these files in here.
Let's see if I like this to format table
or slides.
There we go.
So you can see all these binaries, all the hashes, and you can have something like, you know, maybe
Kolvenbach or Abaca or, you know, Windows Defender application card running that basically says,
hey, only a certain set of binaries are allowed to run application white listing.
So you can say, all right, you know, you have your set of approved binaries.
And if you have any binary that doesn't match that set, meaning any of these, it would automatically
fail to run.
And so we would not be able to escalate our privileges via the the Cee Lo driver, a vector also when
it came to the zero log.
And all you have to do for that is Patch.
Let's see, let's see what patches we actually had installed.
Let's see.
I think it affects.
Yes, and we've only got a few hot fixes installed, basically not, and that's why we were able to
exploit this box, was there a lot more?
All right, so that's it.
And it's actually we're going to MicroTech framework.