‫So the last step of our scenario is to find other systems which have in TLM or Land Man authentication
‫mechanisms on the network.
‫Well, that'll be all Windows systems in general.
‫So as the first step, I'd like to run an Nmap query with OCR detection, find the Windows devices on
‫the network that Capital O parameter is for the OS detection.
‫Top five ports to keep it fast, and the target is the entire IP block.
‫One seven two one six nine nine zero to 24.
‫And here are the systems on the network.
‫01:58 is the college itself.
‫Now, you see two to three is detected as a Windows system, according to the fingerprints, and Maps
‫says the system is Windows seven eight Vista or 2008.
‫So, OK, two to three is our new target.
‫So let's prepare and other and map query for two to three to see the open ports.
‫Port, 445 is open, and we know that the port is used for SMB file sharing just by default.
‫And if you're not sure about the service running on the port for four or five, you can run an end map
‫query with the AS V parameter to run version detection as well.
‫So I'll assume that the service is SMB file share and skip this step.
‫Now here is a critical step we need to have at least one file sharing on the target system.
‫In general, you'll find that the administrative folders are shared because the sharing of those folders
‫is enabled by default.
‫But let's make sure to find out.
‫The shares of our new target will use and map once again, and Map has a script to find out.
‫SMB shares.
‫Now, we don't need to memorize the names of the script.
‫Let's just find the scripts which may help us find the shares.
‫I'll use the Locate Linux command to find the location of the map scripts.
‫Now I know the scripts end with that nrsi, which is the abbreviation of in map scripting engine.
‫Now, you know, two.
‫So let's go to the scripts folder using the CD command.
‫I want to list the scripts, which are about SMB servers.
‫L s Dash L to list files pipe to send the output of the L.
‫S Command to the next command and grep SMB to filter the scripts.
‫So these are the Nmap script related to the SMB service and this one SMB Enum shares is a script defined
‫SMB shares.
‫So now let's prepare the Nmap query.
‫Script to use a script, and here is the script SMB Dash, S&M Bash shares.
‫Now, even though the script couldn't get the details, it did find the shares admin dollar sign C dollars
‫sign, IPC Dollar Sign and users.
‫OK, so let's turn back to MSF console interface, the other terminal screen to try to pass the hash
‫on to our new target two to three.
‫Now, the first thing to search for is exact to find the exploit.
‫So we'll use the exploit Windows SMB exact exploit module.
‫And now he can set the payload.
‫Don't forget that you can use Tab to command completion in MSF console interface.
‫So set the payload windows.
‫Now I know it's a 64 bit system interpreter reverse TCP.
‫Show options.
‫I said remote host has Windows eight VM two to three.
‫Also, the listen host as Carly 01:58, you should be already familiar with all these options.
‫So now we see the exact specific options.
‫The SMB user option is the log in username.
‫As I mentioned before, the options are case sensitive, so you can write SMB user with all lowercase
‫or however you want.
‫So I want to try administrator user and it's password.
‫So I set administrator as SMB user.
‫I copied the hash value of the administrator user that we gathered from the XP system and use it as
‫the value of SMB pass parameter.
‫Liz, the options again with the show options command.
‫Our port is four for five by default, and we know that the port is open on our target, so just leave
‫it as it is.
‫Share is admin dollar sign.
‫And we also know that admin dollar sign is shared on the target.
‫So leave that as it is as well.
‫OK, so SMB user SMB password.
‫Listen, host, listen, port, OK, we are ready to run the exploit.
‫Are you ready?
‫Nope, no chance, the log in failed.
‫So we assume that there is not a user with the name administrator and with the password.
‫Same as the admin password of the XP.
‫But do you want to give up right now?
‫No, of course not.
‫As I mentioned several times, humans tend to use the same password in different platforms and systems.
‫Now, come on.
‫There are a lot of passwords we have to memorize, so it's just human.
‫It's normal to use the same password in all kinds of different platforms, so always try the hash with
‫different users.
‫If you cannot get the session with the default user.
‫Now I'll try another username, ad men with the same hash.
‫OK, so I cheated, I already know that the target system has a user with this name.
‫I mean, you know, you get the idea you don't want to sit here and watch me try a list of users just
‫in the course that's for you to come up with.
‫So let's continue.
‫The other options are the same and run the exploit for admin user.
‫We got him interpreter session.
‫But hold on, just wait a minute.
‫This is not a session from the target system.
‫Look at the messages service timed out and couldn't start, and the exploit decides to send the stage
‫to two zero seven, which is my XP system.
‫Now that's interesting.
‫And the interpreter session is opened on two zero seven.
‫Not on to do three.
‫This is the Windows XP, which we already exploited.
‫So now I'll exit from the interpreter session and look at the options once again to see if I made a
‫mistake.
‫Huh.
‫OK, so no mistake, everything's fine.
‫So let's run the exploit once more.
‫Are you with me?
‫Look, the messages it sent the stage to 02:58, which is Windows eight VM, our target and the mature
‫session is opened on 02:58.
‫It seems we succeeded to exploit Windows eight without using any vulnerability.
‫So let's check this system info using this info on the interpreter command.
‫And yes, we finally have an interpreter session on Windows eight.
‫Not bad, though, is it?
‫So let's have a look at the IP address.
‫Well, it is two to three as expected.
‫So now we can perform post exploitation steps such as gathering password hashes using the hash dump
‫command.
‫From here, we can crack the hashes or use them to perform further past the hash attacks, et cetera.
‫But we'll see a lot of post exploitation methods in detail later on.
‫Right now, I think you get the point.
‫So I'd like to tell you a few more things about the working principle of the past, the hash method.
‫When you look at this slide, you will see two different runs of the exact module.
‫The first one is against a Windows XP target.
‫Well, the second one is against a Windows eight system.
‫If the target is Windows XP s exact module, treat an executable on the target, use it to connect to
‫the target and then delete the executable.
‫If the target is a modern Windows system such as Windows eight, the P.
‫S exact module checks at the PowerShell is available on the target.
‫If it is, the P.
‫S exact module uses PowerShell to open the interpreter session.
‫So if you set the target option of the exact module to two, which means native upload, the module
‫will not use PowerShell even if it is present on the target.
‫But my recommendation is to use PowerShell of the target system to open a session if it's present.
‫Well, you know what, I was assuming that you know what PowerShell is.
‫I'll give you a very short definition for those of you who don't know what it is.
‫To give you a better understanding of PowerShell, I should first define what a shell is in computer
‫science.
‫A shell is a user interface that gives you access to various services of an operating system.
‫Windows PowerShell is a shell developed by Microsoft for purposes of task automation and configuration
‫management.
‫This powerful shell is based on the dot net framework, and it includes a command line shell and a scripting
‫language.