So now that we have compromised at this particular machine, we've established a foothold on the victim
host, we now need to look around, we need to explore, we need to orient ourselves to get a sense
of the lay of the land.
And so what are we going to do here?
Well, you know, we could simply try to drop tools like windpipes or jaws or a seat belt or power up
or Watson or Sherlock on this box.
We could run a script and just try to enumerate all the potential escalation vectors.
Alternatively, what I'd like to do here is give you a manual approach.
I want you to see under the covers so that you can get a better idea of how these particular attacks
are executed.
It's one thing to click a button and escalate your privileges.
It's another to know what's happening under the hood.
So you might just want to observe and see if there's anything we can do to achieve vertical escalation.
So let's start with the net user commands, right?
If we just type a net user security and of course, I type of that net user security, we can see this
particular user is a local group member of the Telnet clients group, which makes sense because we're
telling that it into this box right now.
But you can see we are a low point of user net users.
We can see there is no user on the box engineer and administrator, which we don't have access to,
of course, because we're not an admin and a guest user, which is a low account.
So it's not really different from our account here.
Sometimes horizontal escalation makes sense, but escalating to a guest user doesn't really make sense
in this particular case.
So let's take a look at the folders that are present on this box.
We type the error.
Actually, I didn't mean to do this.
That will show us everything.
But let's just do a diary first.
You can see we have three folders, right, administrator?
Public and security.
So these are the three accounts that have logged into this box.
At some point, you have timestamps over here that gives you some idea of when and when the folders
or the initial login occurred.
Let's just try the public account first, because we can't exactly login as an administrator right now.
But let's just see what's in this public folder
and let's take a look at everything there.
Space fogie, you see there is a desktop folder
and there is a link file.
This is a shortcut, OK?
This is a shortcut file.
And let's see if we can read it.
Right, would type control of the center, we could see that we cannot read that.
That's probably because I didn't put it in quotes.
So let's try to do that now.
And it looks really, really messy because it's a binary file.
But what we can say here is that there is a common.
Inside this shortcut runs and it looks like it's trying to run something as a user on this particular
box access because right, if I type hostname, you can see that name is Access as the administrator
and we're passing the sacred switch and then we're including the path to an executable.
So what this looks like is that when someone clicks this particular link, it will execute a program
called Access that Easy, using credentials that have been saved by the local administrator.
Right.
That's the way I read this now.
We can validate it is by looking at the command list.
If we type Komansky, you can see if we do command key space for such list, we can be available credentials
on the box.
And we can see here currently stored credentials, access administrator domain password.
Right.
That this is what we want.
Now, we have a couple of different options here.
Let me go back to this.
We could.
Simply pass a different command to run as right, we could pass maybe a command to create a file.
And maybe a batch file and in that batch file, there's a command to create a local user account so
that when we execute this script, it will create a local user account because it would run with administrative
privileges or we could just pass a reverse shell to this instead of this access that we get past, like,
you know, a virtual parameter, maybe Ngarkat, maybe machine.
But that wouldn't give us the credentials of this administrator.
And we want the credentials because we might be able to use that to pivot to another account.
Right, if those credentials are reused somewhere.
So the way to do that is to use the data protected API.
This is a API that's built into windows.
It's called API.
And you can use this with Mimecast offline so that we execute operational security, good OPSEC and
we're going to basically run Mimecast offline and we're going to see if we can decode a master key file,
which will then use to decode a credential file which will contain the credentials for this administrator
user.
So let me show you how this is done.
And first, let's take a look at this sacred switch to see if we can find out exactly what it does.
So I flip over to this Windows box I have set up.
We can take a look at it, open a command prompt.
But if you're wondering what this box is, this is the flare VM.
So if you go to Google and you type fire flare fire, I flare VM.
Here it is.
You'll see this is a Windows ISO that includes a bunch of advanced malware analysis tools and essentially
just down the windows saw from TechNet.
And then all you do is you go on to this install script and you just run it on the box and it puts pulls
out a ton of tools that are very useful for reversing malware.
So I'm going to show you how to set that up in this lecture because, well, that's not really the scope
of this particular lecture, but it's a good way that you can set up a VM for analysis and doing experiments
and that sort of thing.
So if we go here, let's see if we can get to run as we can, and you can see if we should grow up a
little bit.
There is a safe, quiet option and it says to use credentials previous to say by the user.
So now we know for sure that's what it's doing, is trying to use the credentials save by the administrator.
Right.
So let's see how we can get these credentials off the box.
If we Google like these papy.
Let's see these Pappe saved maybe.
Here we go, operational guidance for offensive user Bapi abuse.
This is a long article, I encourage you to read the whole thing, but the part we really need is the
path to the master key and the credential key.
And here he says these keys are located here.
This is where we want to go.
We'll start here.
OK, so let's go to minimize.
That's.
Let's go to that folder, CD, the users security app data roaming Microsoft, and by the way, if your
shell is slow or it feels broken, you could type of power Shell TAC file tax base and then I'll give
you a partial prompt.
And then if you did something like P.S. version, I still have backspace.
That's kind of annoying.
Fergin version table.
You see what version of our show we're in, which is to point out just an alternative to using the built
in telnet session.
Of course, you could also just get the reverse shell from the shell with the same privileges of this
current user.
And that's another option, but I'm going to get out of this for now and let's see what we have here.
The IRS pays for such a we have this protective order.
Let's go in there and we need to see what our options are.
We have a said we're going to need this.
This is the security identifier for the security user and we're going to need this parameter to pass
to cats.
So let's press control Gypsie, go over to our other VM.
She's open notepad and place it in.
Where else do we need her?
Let's see.
We can go into this folder.
We are spaceports.
And this file over here is the master key you type and we try to view it.
We won't be able to, but we can use Circuital to essentially encode it base64 style and then we'll
be able to essentially expel it from the box and then decode it on our Flávia.
I'll show you what I mean in the moment.
So let's see, there's a code switch to decode the base64 encoded file and there's an encode switch.
We want to encode the father base64 to make for easy transport and we'll save it to the temp directory.
So let's just do certa util.
In code.
File, name, and we'll save it to the temp folder with the same name, and we have to submit to a file.
Why, because he says in code file, right, you have to submit to a file somewhere, so that's what
we're doing it this way.
Presenter It says it completed so that we should be able to view it if we do type C calling backslash
temp, backslash the name of the file.
We've got it here so we can take the certificate and copy it.
Good, Joseph C. Let's go back over to Flavien.
Open an e-mail pad.
Paste it in and we'll just save this on the desktop.
Let's see.
That's Tom.
Master Key was called Master Key Safe, very cool.
Let's go back here.
The other thing we need to do, if you read the rest of this article, is you'll discover that there's
also a credential.
File.
Let's see if we can find it.
Here we go shopping with Windows seven, the credential manager allows users to store credentials for
website to network resources credential fasel stored here.
So we need the credential file, so we need to go to this path.
And actually, it's this path here, which I think is the same thing.
But let's and see if we can get that credential file out the same way.
So that dot, dot, dot, dot space for such a and we need to go to the credentials folder
and here's the other file.
So we'll copy this guy and we'll just run.
Certainly tell him this as well.
Certainly to encode this and we'll save it into the folder, the same name, and we'll just type that
file.
Photocopy copy this over to our Windows VM.
We'll just call this credential.
All right, very cool.
Now that we've got both files here, we can use Circuital to decode them, right?
That's top.
We've got the master key and we've got the credential file for decirte util, decode, master key that
text and we will save it with the ID.
From our session here, so let's get it, let's see what was it called?
This the name right here.
See, it's for the master key, which just closes out.
That will say this.
Where does administrator
CDC calling users
just hop?
S..
Tactic.
OK.
Decode, it's a file name, and we want to save it with its result.
Well, whatever.
I didn't copy the whole thing, but it got me what I needed.
Actually, that's bothering me.
Let's just rename this what it's supposed to be.
There we go.
All right.
So I try to rename it.
That's fine.
I'll just leave it the way it is and we'll do the same thing for the other file.
Certainly you tell you tell Decode credential.
And we'll try to say this with the other name, if we can, for the credential file.
Here we go.
See back over to the.
And it looks like that worked good.
So we actually don't need these guys anymore, so we don't confuse ourselves.
All right.
So now that we've got these here, we need to disable Windows Defender and then download Mimecast.
Manage settings, all right.
It looks like it's disabled and everything else is disabled.
Good.
All right, so let's grab me the cards where we compiled version Meimi cards, GitHub.
Yeah, looks good.
Gravid latest release.
Grab Zipp.
Hopefully it'll download without being destroyed by the antivirus, since we already disable the antivirus,
it's extracted.
Let's go to the downloads folder and see where it is.
Jump in here, there we go.
All right, let's run.
Maybe that's the first thing I want to do is just look at the EDP API cash.
You'll see there's nothing there, right?
Moustaki cleared and the credentials are cleared, but we're about to change that.
So what we can do is we can say DP API Master Key in and we're going to put the master key as input
desktop with the name of it.
This is it right here.
Said.
Here.
And then the password for this particular user, go back here.
Grab it.
Let's see.
Oops.
Kat Crans is the password for security.
And I believe that's it.
Let's just go and presenter.
That was David Pappe Cash still out there, I we did something wrong.
I might need to pull in the full path to this file and pass that here.
So let's see if we can get that shift right click.
Copyists path go up.
Can I go up?
Yes.
Me around.
Let's take this out right quick paced.
Let's try now.
Yes.
Now, if we run the cash, we'll see.
We have the credentials and the cash and the master key in the cash.
Very good.
OK, so now all we need to do is use this master key to decrypt the credential, file the Pappe credit
in and we'll put in that file that we had this guy copy this path.
Right, click and I copy that shift, right, click, copy as pass, right click.
There we go.
And look at that, they've got the clear text credential, Bob, for the administrator.
That's what we do this right now.
We can use this password against other assets in the environment.
If this were a true red team, Pinterest engagement, and now we can actually log in as administrator.
So I'm going to say that I just.
Right.
Click it to see what a clipboard exit here out of this.
Matt.
And we'll just put an administrator, we should be able to get in
right click control Shalvey up there is something wrong.
Administrator control of the.
Not sure what's going on here I go, what's on a clipboard that's on a clipboard.
I think that space might be getting in the way.
Let's try it this way.
Joseph C..
Administrator control should be there we go, control you to close it out, exit, and now we are the
administrator.
Who am I?
We've officially escalated our privileges on Xbox.
So in the next lecture, I will show you the alternative method of escalating your privileges using
run ins and outs of our show.
And then we will dive right into that.
Right.
So I will see you guys in the next lecture.