OK, so here we are in the box and we're going to compromise our next victim machine, and the first
thing I want to show you is how to search for it so you can just click the machine name up here and
we're going to try to break into access.
We're going to try to access access that so you can see up in the machine results.
I just click it and it will pivot me over to the machines profile so I could see it online.
If I click the IP and copies it to my clipboard and I can always click this little green vertical line
to expand or collapse, the left pavement shows only hack the box fun.
All right, so we've got this box ready to go.
One of the other things I'd like to do before I get started is to reset the machine.
That way, you're starting your hacking journey with a victim that is in a pristine state.
So now that we're ready to go, let's see if we can find I am currently connected to the VPN.
You can see here and I do control a one.
I'm back in the second tap.
If you need help using Tmax or flipping between tabs or even configuring the VPN, just look at the
initial videos in this course.
All right.
So let's get started.
Let's just start with a simple adapter list.
Right.
So if I do see the IPA, show me all the adapters on this box.
Right now, I have one that is a tunnel adapter, one tunnel adapter.
If you notice issues where you can't pin your target, it could be because you have multiple tunnel
adapters.
If you see anything other than just a tunnel zero, like a tunnel one or ton two, that's a tunnel too
much.
So you would do pseudo IP link delete and then the adapter name and then you'd have to reconnect to
the VPN.
But we don't have that case here, so we have to worry about that.
Let's go ahead and start by copying this IP address to a variable.
This is our local IP.
We're going to need it so we can say we can actually export it right to Garibaldi and then we could
just do Echo l'Est and you can see it shows up, right?
Very cool.
So let's just try to ping the target to make sure our response is just essentially check.
Of course, not all the target's going to respond to pain, but if it doesn't, you want to make sure
it's because it's blocked, not because you have some problem with your VPN.
So right now, I'm not responding to Ping, which is not good.
So I'm going to reset the box
and then we wait for this to finish and we should get access to the machine.
Machine will be reset.
Nice.
Now it says it's resetting its way for this to finish.
So it appears that the box is finally reset itself.
Let's go back to the command line and see if we can ping it.
Yeah, that's a great time.
So the first observation one responds to being second observation.
TTL is less than 128, greater than 64, which indicates that we are most likely dealing with a Windows
target.
Let's see if we can validate that hypothesis first, which is going to in Intermap map against the box,
very verbose, which just means print out the results as the results come in.
Don't wait until the end.
Assuming the box is already playable, don't bother picking it.
One default scripts, one version checks run the fastest game possible, showing the reason why any
ports are blocked.
Skimpiest zero two six five five three five.
Right the output to a file named access to a map and scan this particular target
and almost immediately we get back pre results put eighty eight point twenty one is FTP import twenty
three is of course tell that.
I was playing that for a second.
So let's just check out Port Eighty.
Right.
Let's open a new tab here that's called Discover Discovery.
Discovery, NASA spell it and let's just head on over actually open up berp and see if we can filter
everything through berp as we open it up.
So here we go.
And we can make sure intercept is off.
It is.
Let's go back here and we are going to proxy everything through berp.
And this is type in the IP.
See what we get.
All right.
First of all, I don't know what that is.
It looks like some kind of server.
We could Google this to see if Google knows there might be some kind of industrial control system.
Yeah, a lot works.
IP Server, User's Guide.
So we might OK, it's owned by MEGACORP.
So this might be something like icks owned by some large corporation.
What can we do if we flip over to berp?
And I think that's because there's really nothing on this page, right?
Go back to berp.
This is all Google stuff, which is completely out of scope is the latest.
There we go, there's the box, but why isn't it capturing this one?
Eighty, eighty, right, that's the interface you go back here, we're looking at the options.
From three seven zero zero one and it.
Oh, yeah, there is the port 80 80.
That's totally right.
So I'm not sure what's going on here.
Yeah, for some reason it's not showing up here, but that's fine.
We don't even need to spider it that way.
Well, we do want to see is what's going on with that.
So let's copy this image location.
You get to put down.
You know, we get.
We have a jpeg, it is a jpeg, according to File Strings XXXIV tool against it, and we can see that
it was created in twenty eighteen.
It's an image jpeg and they're not really saying anything interesting in here.
We can look at the source.
Nothing too interesting here either.
Could look for stuff like robots that text, but instead of manually doing that we could just fire up,
go back to yourself or do research.
Let's see if we can locate their search.
You might already have it.
Yeah, we do.
All right.
So
because these pseudo opt, their search, their search and get a list of some things that we can something
that we can run on this box.
OK, so we're going to run search and let's see how we're going to formulate this command.
By the way, you can get their search easily from GitHub if you just go to Google and you type their
search.
It's like the first link and get up there, search.
You know, it's kind of like robust air.
I like a little bit better.
You just grab this, calling the repository and you'll be able to use this webapp scanner, which you
can use for first browsing.
And a lot of people are using stuff for faster Ufuk, which is very popular these days.
But you can also use their search.
I'm kind of old school, right?
All right.
So what are we going to do?
Any of the URL?
So
there we go.
Extension's well, this is probably a Windows box based on the T.L., which means it's probably running
like a dot net or Iosava, which means Aspey will be a common extension.
So let's go ahead and look for those.
We can say extension's equals ASPEY, SBX and maybe these TMO.
What else we need to wordlist.
We'll just use the built in wordlist for now thread's.
We don't want to give it too many threads because then the application might crash, but we don't want
to give it too little because then it will take too long.
So let's start with.
Fifty, that seems good.
Anything else in here, I can use random user agents to bypass any controls that might be blocking based
on the search user agent screen so we can put that in
anything else?
And the report will to a simple report, simple report, access to their search,
trying to close the top.
See what we get can't connect.
We still connect to the VPN.
Capping it anymore, though.
So something happened.
It's still up.
Still not showing him berp.
And Berp EMAP is taking a while to.
Take it out of here for a second.
OK, so I guess I was promising everything Grubert, which doesn't doesn't make any sense.
And I guess it was passing all the traffic there were all right, so now we've got Deresiewicz running
and we'll get this right.
And let's go back to our recon results.
Still running, but for 21 was also detected.
So while we're waiting for the scan to finish, let's look at part 21, Apprendi tab.
I'll call this discovery to try to FTP to the page because that's the protocol for it.
FTP.
So the FTP service is listening and we can try to log in.
Anonymous, it says anonymous access is allowed.
That's pretty cool.
So it doesn't matter what password we type and we're logged in the IRR.
Look around, we got two directories.
Both were created in twenty eighteen.
So let's see if we can get into those.
So we have a backup file and that IMDB file, which is like six megabytes
and we have an access control zip file which is about 11 K so we could try to pull this down with M
get what I like to flip that around to a W and you w get instead just a little bit more flexibility
that we all get from what you get.
Wow.
I said get a laugh at a joke and get it.
Get that joke.
Okay, that's really bad.
All right.
So let's control Zellous and let's see if we can get
grap FTB.
All right.
So there are some FTP options here.
And can we mirror the page to mirror the FTP site as if it were a page.
We can.
So let's try to use get here, see w get a mirror ftp anonymous username password.
It doesn't matter blah blah blah because it's anonymous login which is enabled and see if we can connect.
All right, so what happened, connection timed out.
Wait, it looks like it actually logged in, but it couldn't initiate a passive transfer, whatever
that means.
Let's see if we can get the help for that.
You know, what about research passive so we can possibly use this command to disable the passive transfer
mode since it can't initiate passive transfers.
Bam, bingo.
Now we have the results here.
We can rename this folder to FTP and then enter that folder.
See, we have folders there.
We can also run against it to see the file contents of each folder without actually looking into it.
And if you don't have a tree, you can just do zero
zero Apte install tree y, right.
How do I know that?
Because I did zero at the search tree.
Of course you can spell things correctly.
Right.
And then when I did that I was able to see that there is a package here that displays the intent of
directory tree in color tree.
All right.
So we can take a look at these.
Let's just go and check on our skin from their search.
You can see I didn't really find anything interesting.
Only one 200 response for index.
That e-mail, which we already know about.
We could try using a bigger word list like Cycliste, but honestly, that's not really going to help.
I don't think at this point, let's say we've already got some files we pulled down from the FTB server.
Let's sharpen our attention on those.
So let's go into this backup's directory and see what we have here and have a backup.
That DBE.
What is that?
It's a Microsoft access database.
OK, what can we do with it?
Can we like you?
It it's a binary file.
All right.
So we probably can't.
Yeah.
We can't read this subnet.
Quit on that because I don't read binary.
I'm not quite that good yet.
Let's just see if we have any tools with the name IMDB in name because I type MSF tak you see all the
commands in Micheli instance that are related to MSF Misplay Framework Database Management Framework,
AITC Hunter Freemarket Venom.
Great stuff.
I do IMDB tag.
I see all the tools that are related to IMDB, which I already have my box and one of them looks interesting.
IMDB Seigle.
So let's see if we can query the IMDB database, which is the access database as a single database.
First, let me close this.
And let me close this, too.
OK, so let's go over to Mexico and I don't know how to run this one tech age and it says we just give
it the file
and let's try, like, list tables.
Bam, we've got some.
Now, if you didn't know that you could use that command, you could just Google around for it or you
could look at the man page.
But we already see some of the tables in here and this looks really strange.
Finger vein.
I have no idea what that means, but I'm going to copy to my clipboard control, see, and then I'm
just going to sort of glance through these tables to see if any of them look like they might have credentials.
Area admin looks like it might have credentials, any off base tables, especially off user, because
there's probably probations or something in there related to authentication.
They guilt's admin there might have something interesting in there.
By the way, I noticed the jingle jangle the Web framework, and that might be the particular framework
being used in this industrial control system.
And if it's so, there might be a vulnerability that we might be able to exploit with such searchingly.
I don't know if I should sit there and just looking through, you know, what we have here.
And that's really all I see that look interesting at the moment.
So let's quit this and see what other EMB things we have with NDB tables.
What can we do with that?
It's probably just going to list all the tables.
Right, so IMDB files and tables.
Right.
So if I do this backup file.
Yeah.
Just print it out.
Print it all out.
What else can I do in export.
Yes I want to export some stuff so maybe export file and then the table.
We want to export software to maybe export the file and the table which have my clipboard.
I can see all the column headers for the table.
Now there's no data in the columns, but I now have a way to export each table so it's possible I can
create a loop to basically execute this command and then pass it to pass each table name to IMDB export
saved as a file and then we can grep through everything to see if we can find something interesting.
Right.
So let's try that approach.
So let's do like let's say for AI and IMDB tables back up.
I basically update's with each iteration through this list.
So the first time through, you know, at some point I was going to be server log.
That's going to be shift, it's going to be TBP, it's going to keep updating.
And what I want to do is I want to just go at it to make sure my loop is working correctly.
And it is easy.
It is printed out everything.
One Pearline, one table Pearline.
That's good.
Although it has these as well.
That might cause a problem.
Maybe we can get those out of there.
Let's keep going and let's try to do now instead of just echoing it.
Let's run that IMDB export come in on the current table.
Very nice.
So now we have everything being exported, so let's just write this to a file.
So how can we do this, we can just
write it to a file.
Like, so permission denied.
That's cool.
You know, it looks like it's having an issue here.
I think if you look at the permissions on this folder, yeah, it's focused on BIRUTE.
So if we change the ownership to me and then go into that folder and then run the command without zero,
of course.
In my work, and now we're getting a different result.
That's because the folder is owned by Rupert Varney is not.
And that's why I couldn't write to a folder owned by Rupert and I didn't have permission.
So I just changed the ownership so that it belongs to me.
Right now, I can read, write and execute, so we are good to go there.
Let's go back into the folder and we have our files to intrigue.
Instead, we see all of them.
So let's do some magic to see what we can find in here.
Let's just do like a recursive grep search case.
Insensitive.
That's what the eye means.
The end means.
Show me the file that you find matches in and let's just look for, like, any occurrence of the phrase
pass.
Already we've got a couple.
So there's a table called authorizer.
It has a password column.
You should definitely check that out is a table called machines that contains the common password.
Not too interested in that.
There's also a user info table that contains a password column.
So it's looking the author user's first.
Bingo, we've got cards and we also have an advocate to all these cards is all good.
So it's going to come clean this up.
I think we can let's pipe this to OK and let's see a field separator.
We can use a quote
and then we can print.
The
second.
Third, let's see, this is the first field, this is the second field, third field and the fourth
Gilbert, the second or fourth fields to four going to work.
There we go.
I control should be.
Let's go and put these in
escape of these.
I think we're done with that folder.
Let's go into the engineer folder
and we have what looks like a zip file.
Let's see,
it looks like it might be a zip file, even more trying to unzip it.
We can use the nacelle option to list the files first.
And you can see there's a file on here.
So this is probably like a nail file.
Maybe there's something in here that is interesting and let's just unzip it zero and zip.
Unsupported compression method.
All right, so it skipped didn't actually unzip it.
Now we could Google what that means or we could try to use another tool like seven zip to get what we
need out of it.
Let's see here.
If we do our little list, the contents of the archive, then we can also show the technical information
for L for the list.
Right.
Just trying to get some metadata about this file seven zip el SRT Access Control.
So all the stuff we already knew, one thing we didn't know was this a stupid.
So it's file is probably encrypted.
Right.
So if I go unzip already did that, I do seven zip code.
We try to extract it.
OK, saying permission denied because they're trying to write the contents of the file to this drive,
but it can't because it doesn't have permission.
So let's just do sudo.
All right, so what's the password, which we don't really have right now, so we have two approaches,
we could try to crack it so we could try to convert this zip file to a hash and then, you know, use
the word list to try to crack the edit file.
Or we could try to use one of the credentials that we have already pillaged and use that to get in.
So let's see if we can first convert it to a hash with zip to John.
All right.
Very cool.
But this file in here and let's convert it to access control dot hash I mentioned tonight, even though
I'm zero because I bet it's folder's on my route and it is.
All right.
So zero change ownership
engineer the engineer.
OK, let's run this again.
And if we can get that for how we just convert it to a hash, we see it there.
So now we can use John to crack this, but we don't have a word list yet.
So we could use RockYou, we could just try to use the word list from the raw strings of that backup
file.
So we did like zero strings.
You know, we're going to get a lot of data back from that, let's just output that well, let's sort
it and all we want uniques.
Good.
And then let's write that to a file called Wordlist Dialyzed.
All right.
So now we have that.
How big is that?
It's six hundred three lines that.
You bet.
So it could do like zero.
John, give it the hash of the zip file and then a word list
and see if we get anything juicy back and look at that and actually cracked it.
Pretty sweet.
So says we can use tech tax show to display all the cracked passwords reliably.
We take this off, we do show.
We can see it right here.
So now we have the password to this file.
Right.
So let's go ahead and grab this.
Joseph C..
Let's clear this out, all right, and that file, I believe, is empty because it tried to extract
it, but since we don't have the password, it didn't actually really extract it.
So let's try to extract this now, now that we have a password.
Saying, would you like to replace the existing file with zero bytes?
Yes, enter the password until Shalvey and everything's OK.
I like that.
And now we look at the size.
It is substantially larger than zero cabi.
So now we can try to actually read this file once you start by seeing what kind of file it as it looks
like as an outlook file.
He's usually are.
And it is.
It's an outlook e-mail file.
We could just try to read it straight up, but I think we're going to run into problems.
Yeah, to binary file.
So if we try to look at it, it looks like Google GOOG.
But let's see if we use Xynthia on it.
Xingdou doesn't even know what to do.
We could try using repassed and that's what actually output it as a inbox file, which will be able
to read.
You see now there's this inbox file, which we can
read quite easily this way, but I have a better technique.
We can use mut zero app to search mut.
It's really it's really basically a text based, text based email reader,
and it's really cool to watch this like we already have one stop.
Yeah, I already have it.
So let's do
it all.
But see what flags we want to specify
we want.
What do we want?
We want to open the mailbox and we'd only mode we don't want to modify anything, so say Takar, and
we want to specify which mailbox to read, so check everything in the file.
OK, it's that inbox power.
It wasn't even that access control.
Oh, it was in the engineering folder, I think.
FTP Engineering
Access Control Inbox.
I think that was right.
I'm seeing
some of this happening.
Let's see,
OK, this e-mail does not exist.
Create it.
Sure.
And look at that.
Now, we can actually see the email that came in from John at megacorp.
And if I press enter, I can see it came from Janet Megacorp, it went to security at access control
system, dotcom megacorp access control system, security account.
So we have a new account and it says the password has been changed to this.
Please ensure that it's passed on to the engineers John.
Oh, thank you, John, for giving me credentials.
So it's good copy that controls you see a quick queue to quit.
And where's that credit file in?
Here it is.
So now you put this in here.
I'm going to put a star next to this one, since we know how it works and we have more credentials,
very cool.
So let's go back to our reconceiving that finished it.
Did it really tell us anything new?
Just kind of strange.
But we did know that in addition to 80 percent to Port 21, that Port 23 was also open, which is telnet.
So we could just try to connect the dots on that.
Right.
And I'm not really satisfied with these EMAP results.
I'm going to run in the map again in the background
because it didn't show us any of the default scripts or the version checks, which is kind of weird.
So I'll let that run again.
Let's go back to Discovery and see if we can turn it into the box
using some of these creds.
It's taken a while, let's try it again and again, if you don't have the time I command, you could
just do a little app installed on that.
So let's try to bargain with admin admin first.
All right, let's try this one next corpulence.
Interesting Spotify user is not a member of the Telnet client group, so remonstrating was added to
the above group.
So we know the user is valid.
That's an interesting error.
This is what we do, right?
We capture credentials and then we just spray them across the environment to try to get in.
Let's try back up Admon next.
Back up admin.
Admin.
Nope.
Let's try this guy next.
Security Security Controller.
My session looks like my session locked up.
All right.
So it's locked up with to control a ex to kill the pain.
Let's just try it again.
Cat creds and let's fire up telnet
and let's try to log in.
And it looks like we've got to show.
Very cool.
So in the next lecture, we will look at escalating our show.
I will see you in the next lecture.