List Matus voidable three services again.
Now, here you can find an interesting HTP service, it's got a long description, and this time I'm
going to use a port number to get information about the service.
And nothing to view from the browser when I go to tend to tend to that 10 Colen 59, 85.
It's kind of weird, huh?
Would you expect something?
So you've only got this information.
A service runs on the port 59 85, the only meaningful thing here, of course, is the port.
No, but it does mean a lot, so.
Open your browser and search what Dysport number is typically used for.
Now, when you look at that post, you're going to get some extra information, as this post says,
this is a win R.M. service so you can search for when R.M. exploits.
Search when R.M..
Ha ha, that's terrific, you see how you get some of those module's.
So let's just use the first one when R.M. off Method's.
So options.
Set our host to tend not to duckpin.
And we're on the module.
All right, so let's do it from the beginning.
Display the service on 59 85.
And you see the information immediately that saved the host.
And then list the winner in module's again.
Let's use a second one this time.
When R.M. Command.
Show options.
Set our host to Melissa Voidable three i.p.
That username.
The vagrant.
Set password.
The vagrant also.
Show options to control.
OK, then we're on the module.
And look at that, that's a perfect result, so you can take advantage of this module.
So let's have a look.
Over the other modules again.
All right, so there is only one exploit module.
And let's use this now.
Joe options.
Set our host to ten point ten to ten.
That username to vagrant.
So that password to vagrant.
And show available payloads.
And I'll choose 64 bit reverse interpreter Tsipi as my payload.
Set our host to my colleagues IP address.
That airport to 59, 85.
Let's have a look at those options one more time.
So everything looks perfect, then exploit.
And there it is, you got this session so even our export code migrates to another process.
So let's quickly do who am I and where am I?
And there we are in the metastable three with a system level user privilege, so let's send that session
to the background unless the sessions.
And we can move on to another service.