Welcome back.
And in this video, I want to talk about a few more useful comments and post exploitation modules.
So what they got right here, I establishment interpreter session with my Windows 10 main machine.
And now let's see what else could we find useful after exploiting the target?
Well, if the HELP command somewhere around here, I believe there should be an option called search.
And what search allows us to do is to, for example, search for a specific file types on the target
system.
So if we search Dash H, this will give me an options that I can use with this comment.
For example, if I wanted to find all the JPEG pictures on the target system, what I could do is I
could type search that F and then starshine dot jpeg press enter.
And what this is going to do is it will manage to extract all the JPEG images that are located on the
target system.
Now you can also do for any other file type that you want and you can also mix it with one of these
options right here.
And here are the results.
We can see there are a lot of them.
All of these are JPEG files, as we can see right here.
Now, if you scroll all the way up, we can see that the list goes on and on.
So maybe we would want to narrow it down if we were searching for something specific.
But right now, we got all of the JPEG files on the target system.
OK, another thing that I want to show you is the usage of post exploitation modules, how can we do
that?
Well, if I go and put my session in the background, clear the screen, and since we are on a Windows
machine, what we can do to search for the post exploitation modules is we can type search and then
post windows, press, enter, and this will list out all 191 post exploitation modules and you can
scroll through them and see which ones you would find useful.
For example, if your target has our card and it connects to the various XPoint, you can use this module
I use and then the module name show options.
And usually these modules will only want this session ID, so they are very easy to run.
You can see just said the session ID to.
First of all, let's check out what session I have and it is one said session ID to one, then run the
program and this will list out all of the various interfaces and possibly the passwords of the connected
wireless access points.
Now since my machine doesn't have a wireless interface, it simply just prints out no wireless interfaces.
So this post expectation modules depend on what you're looking for.
So let's grow a little bit up and see which type of modules we have.
So we got a bunch of enumeration modules you can enumerate from to extract all the chrome data you can
find inside that browser in case Target is using Chrome.
Check for Riam so you can use this module, for example, to check out whether the target that you managed
to hack uses a virtual machine or if it's a virtual machine.
So let's see how that would work.
We know that my Windows 10 main machine is not a virtual machine, so it should give out false as a
result of that session.
One, run this checking if my target machine is a virtual one and it says it appears to be a physical
machine, which is correct.
Who can also be more specific when searching for the post exploitation module, such as, for example,
type search and then passwords.
And we can see right here, if we get some post exploitation modules for gathering passwords, credentials,
total commanders say password extraction.
Let's go a little bit up, see what else we have.
Not really too interesting.
However, one module that we can use to extract the cache, the versions of passwords on a Windows machine
is reconned type search and then hash dump.
Then we can scroll a little bit up and we got somewhere around here, a module here it is called Post
Windows Gather and then hash dump.
So let's scope it type use and then paste the module name if I type show options said the session to
be one.
As you can see, they're very easy to run.
Only one option is required and I type run.
It will tell me access is the night.
So this simply means that not a system level account if we know how we can fix that.
So I'm just going to do that real quick just to show you what this has done.
Post exploitation module outputs once it works.
So I'm going to real quick elevator privileges
and here it is, the privilege escalation worked from the second try and I'm going to type get system
background this session and now use both Windows Gather and then cache dump said session to be session
two because this session two in this case is the session with the system level account.
And if I type run, this should give me the hashes of all the users on that Windows machine.
And here they are, we got the administrator hash, we got the user hash and we got some other hashes
as well, and we could use them to crack them with some other program.
But more about password cracking later on in the course.
For now, we just managed to extract the hashes.
Another useful option that we have that requires system privileges inside of the.
But the shell, if I go inside of my system level of control and I type the help menu, scroll a little
bit up.
I should see this option called Clear e.V. and this stands for Clear the event log.
What does this mean?
Well, this command for clear application system and security logs on a Windows system.
So it is something similar to covering up our tracks.
How can we run them?
Well, it takes no other parameter.
So all we need is a system privileged account and we can type clear event and we can see right here
it is wiping out records from application system and security.
And another thing that I want to show you before I close off this video is that you can run post equitation
modules even from the interpreter.
So you don't need to always put it inside of the background in order to run a post exploitation module.
You can simply just type run and then the module name, for example, I will use this one post Windows
Gather and then Neum underscore applications and if I press enter for this post module will do is it'll
print out all of the installed applications on my Windows Ten machine and we can see them right here.
So many different modules exist, so there are hundreds of post expectation modules, you run all of
them the same way, so you can just go and search through them and find which one is useful for you
and you can test them out and see how they work.
Right now that we covered all of this, you have a pretty good understanding of what post expectation
is.
So let's just remind ourselves of the most important things that we do.
After exploiting the target, we try to elevate our privileges.
We create persistence in order to be able to enter that machine whenever we want.
And we search for useful information on that target machine, such as password hashes, such as different
files that we might find useful.
And those are the main parts of both the exploitation module.
Of course, you can then use the commands like Clear Event and other comments that are used to cover
up your tracks and delete the log files, which could be useful to cyber forensics in case they want
to track back the person that was on that machine.
So thank you for watching this video and I will see you in the next lecture.