Hello everybody and welcome back.
And right now let the set a function that will allow us to check if our script is actually being run
with the administrative privileges or with the simple user privileges.
Now this can be useful in order for you to know what your available options are.
We will code in our reversal.
Our simple one letter command or pardon me one word command.
True but just be for example check for the check privileges and we should be prompted back.
Whether the user that we are currently funding descriptors is an administrator or not.
Now I have written a simple script right here in notepad.
This simple script right here first of all it imports the OS library.
It has a function called the has admin.
Now you can call it anything you want.
Basically what this function does is it will check if the admin if the user that is running the script
is having the administrative privileges or if the script itself is having the administrative privileges
how it does that basically with first of all create our global variable called admin and then we try
something something that will actually check if the user is administrator.
Now that something is basically accessing the temp directory in windows.
Now you might be asking why are we actually accessing the temp directory.
Well basically in windows once you actually access the temp directory that means you have administrative
privileges.
Since simple users can't really access this directory.
So what we perform right here is the check of that directory.
We can access it in case we can't.
As we can see right here except admin admin variable will be set to false.
In other case where we actually can access it the admin variable will be set to true.
So now that we actually run the function once once the user of our server actually executes check command
then the function will perform the check right here.
And also we need to set the if administrator equals to true.
Then we will send back to our server administrative apologies if it is not true we will send user privileges
so that the user of the server actually knows whether the shell is on the user or administrator account.
So let us implement this in our program but before we do that let me actually show you how this works
in a simple command prompt.
So we open a command prompt as the user then we goes to the desktop where I say the script and I will
just write on this script so checked out by what I get back is user privileges.
So it went through this code the trend is function.
It notice that with the user privileges it cannot access these temporary this directory pardon me which
is the temp directory and then it set the admin to false.
Then this loop right here checked if admin is true since it wasn't true it printed out user privileges
but right now if we go and run the command prompt as the administrator so right click right here then
run as the administrator click here yes then if we go to the same directory I can just find the script
did I say it so users then the account name then the desktop and then I'd write on this program once
again we can see that right now it says administrator privileges.
So this program works all they have to do right now is implemented in our reverse shell and in our server.
So let us do that.
Let me open this like this with to decide.
Let me know the reverse shall the key why we can see everything here.
We already have set as in the previous video we can see all of our functions that we already coded and
let's look right here.
Code the function is admin.
Now whether you call it has or is I mean it doesn't really matter.
You can call it anything you want as I said right now all we want to do is just basically copy this
program right here so global admin is our variable then what we'll do is we will try to perform the
check of that directory so OS is the library that people use for this we already use for example this
part right here perhaps that we just open open these type of brackets in this part always stopped in
my room.
We already used before.
So this is a little bit of a bigger command.
That's why I am I am keeping it from here.
So see cuts backslash and then Windows.
We closed the apostrophe.
We closed the brackets then a comma and then open apostrophe temp closed apostrophe.
Then the closed square brackets and then closed to normal brackets.
So we can move this so we can see the entire actual command.
And here we perform the check of the directory.
If it can't go to the directory we set the admin to be false.
If it can't we will do that with else admin will be set.
Control will let us do it like this to true.
So now let's enlarge this.
We do not need to see the rest of the code right now all we have to do is go to our.
While True loop basically the shell loop will let us go all the way down here and let us actually perform
another.
Else if statement so.
Else if command.
And then first for example.
5 letters since that is how much check has equals equals 0 check.
Then we added the two dots right here.
We will actually try to execute the is admin so his admin.
I believe that is how we called it.
Let me just check it out.
We execute the is admin function and what we want to send is basically
or we actually want to send back the admin variable but right here we will not name it false and true
we can just name it something like this admin equals user privileges and here admin will equal administrator
privileges.
So we set the admin variable to be a string.
And right now we will send this string to our server.
So let us go down here.
So you try it is admin and then RELIABLE send admin which is our global variable except so in an ease
in any other case.
If this doesn't work we for example can't check or perform this program.
We want to send to the server.
Our string that will say can't perform the check.
So this is basically it for the reverse shell.
Now let's see if we have to code anything in our server side of the code in order for this to work properly
so controller to say this control X to exit and let us now know the server or b y.
So let us see what will happen once we send the check comment so check we send that it performs all
of it as before and then we get the result back and then we print the result.
So I don't think we have to add anything right here we can just compile the shell.
So let us go.
Right here we have the reverse shell right here.
Let us compile it with our Heiko file and also with our image.
So Python twenty seven scripts by installer not the AKC.
We add the data so the dash dash add that data and then we specify the path to our image which is the
root python programs reverse and then go on file right here
so also add right here the dot and comma and then dot after that we want to add one final option so
one file then no console.
And also the icon which is in route downloads and then dragon wallpaper Chinese that I call or basically
any icon that you used.
We also want to specify the name of our shells so reverse shall not be why now let us actually compile
this into our program.
Now remember that the reason why our image is an opening the previous videos is actually because we
forgot to specify the slash in front of our path with our image.
Now we'll show you what I mean in the second if you missed it.
So that's why in order for image to open properly after we were on the program you need to have this
slash right here.
So without this slash it will not work.
So make sure to have this slash once again then.
Now let us actually use our use B.
So I will plug it in
I will go to my DOS directory and now remove the reverse shell that the C Intermedia wrote and then
Caroline and I will go on directly back and I will run my server in order to reason listen for the incoming
connections.
So it does unplug this use B Drive
let me check if we deleted the previous the previous backdoor.
So let me just enlarge this.
There so we need to delete this backdoor that you see.
And right now we should be good to go.
Let us paste this on the desktop right here.
Now let the sexually run the program.
Right now it should open the picture as we can see right here.
All works properly and then in a few seconds we should be getting the shell back then we will run our
check function in order to see if we are administrator or in order to see if we are user so shell is
here Let us see if normal comments work.
So I pick config works in my works are mine as it works.
And right now let us type your check what we get back is the user privileges.
So right now we know that the user the trend our shell is an actual user account and not administrator
account.
Now let us close this.
Let us make it just a little bit prettier before we end.
You can remove all the necessary files or pardon me all the unnecessary files.
Well let's make this string a little bit prettier so admin and then set a plus for pardon me it said
commission are right here.
User privileges and here let's add the plus for the administrative privileges.
So it looks just a little bit prettier we can save this.
And right now if you were to run this reverse shell as an administrator you would get prompted back
the administrator privileges after that comment.
So that would be about it from this video where we checked out if we were a user or the administrator
account we will make sharp comment in the next video.
Basically what we will do is we will code our help comment when someone that is using our server actually
types help they get prompted all the available options currently that we have coded in our reverse show.
So I hope you enjoyed this video and I hope I see you in the next one by.