So let's see if we can abuse this run and now as an alternative method of escalating our privileges,
we know that it is trying to run this particular program exclusively with the cash to admin credentials.
So let's just get a reversal going.
So let's see until they see Chelse, let's name look furnishing.
OK, so we've got.
It looks like it's in user sharing, harshing Chelse city users share the schang shells, and the one
we want is to reverse TCP per.
Where is it?
Invoke Paracha TCP.
I believe that's it.
So let's move this
to the folder that contains everything we're working with here.
Let's just name it.
Update that one.
All right, so we've got the show here, let's modify it.
And let's go down to the part where there's your verse right here.
This is reverse.
We're going to modify that, we're just going to yank it so type Y to yank capital G to go down to the
bottom I to get into edit mode and then we'll escape to get back into command mode and we'll do P to
paste the WDW to delete the words or go clean this up a little bit.
So this IP address and this port is not correct, so we use four for three to blend in with the traffic
and we need to put in our IP address.
Which is 10, 10, 14, 17, 10, 10, 14, 17, that looks good, escape shivs easy and the Luitel
update to make sure it's there.
It is.
So now we is need to create two processes.
Write one.
We're going to host our Web server, which we will make the victim go back to.
And then when it does, it'll retrieve this particular script and execute it and then return a shell
back to us in that cat listening Aiport 443.
Right.
So let's go and do that.
Pseudo Python three module is HTP, that server 80.
But the pain zero or wrap in C minus in VLP four for three.
Are we good to go?
Remember, oil rap is what gives us UpDown functionality in our windows.
Michelle Ngarkat don't wisoff off names verbose.
Listen, Allport four, four, three.
Now we can go back to our victim Shell and let's see if we can get Paracha over here.
And one thing I like to do, I like to encode my power shell before I execute it here, because sometimes
there's different characters inside the commands that can break things.
So that's what I'm going to do here.
Let's just go ahead and start building this shell command out, text added.
We're going to do X new object.
Met that Web client, web client download string.
HDP, 10, 10, 14, 17.
Update that P.S. one.
And must just echo this first.
You'll see it, I'm going to do a minute.
Let's make this big, so do echo minus N and make sure that that didn't work.
Something's not right.
Put this whole thing in quotes.
What's going on here?
Oh, I see.
It should work now get the matching quotes.
So here we go, we've got this now.
We can't just put this, we can't just put this inside of this shell over here because we have all kinds
of characters in here like this.
You know, this single dash here, we got a single tick, double quote.
And the way that encoding works, sometimes it can break all this functionality.
So we're first going to we're going to do is we're basically going to modify this a little bit by echoing
it to I convert and we're going to convert it to UTF 16 little Indian.
OK.
If we were to get to 60, you see what that does?
We have this extra dot because now this is 16 bits for each of these right here.
This is 16 bits, 16 bits, 16 bits.
If I take out that, I convert stuff.
And to do it like this, you see it, everything is compressed, right?
You don't have that extra dot.
The problem is Windows likes it like this.
So we give windows what it likes.
And that's why I'm using this.
I convert to code.
And then what we'll do is we'll just convert it to a base 64.
And we won't wrap anything to zero, don't read the text now we can take the string.
And get this over to our victim, Joseph C. Conroy, then go back over here, control easy and we will
run our show.
Well, actually, what we need to do is run the entire thing, so let's build this out.
OK, let's pull this out and think about this, what we're doing here.
We're going to run run ads, right, so I can type run ads and then user and we want to run this as
the user access administrator.
So we'll put this out like this administrator sacred, and then in here we'll run the power show in
coded command and we'll paste in the encoded command.
Hopefully you can see what this is doing using Runaway's as the administrator used the same credentials
that are stored.
We saw that with Comanche left, right.
Is he safe credentials taught credentials for this particular user and then run this partial command
with this encoded command, which actually goes back to everything we did here.
Right.
This is our download cradle right here.
Hopefully that makes sense.
I hope it does.
All right, so this is copy and paste, this whole thing.
Let's see if we have Michelle.
You see, the Dow came in and we do and we are administrator awesome, so I just showed you two routes
to escalate your privileges on this box.
I hope that was helpful.
And I hope that you learned a lot.
You know, if you have any questions, of course, you can always reach out to me directly.
And I sometimes I go fast in these videos just because I'm really excited.
But, yeah, I'll see you guys later.
All right.
Bye.