In this video, we are going to practice pen testing with a try platform for free.
We are going to hack into one of the easiest machine on the platform called Blue.
And we are going to follow all testing steps from scanning to exploitation, post exploitation, elevating
privileges and exfiltration.
If you do not have account on Hack Me, go to the platform and create an account for free, which is
very easy.
From the learned tab, you can search for blue machine and open it instead of using our own Kali machine.
We are going to use the free attack box that is provided by hacking for free.
Just click on Start Attack box and it will start in the split tab.
You can click the button to view a tag box in fullscreen to open it in another tab.
Once you have the attack box open in a separate tab, the first step is to scan the machine.
Open a new terminal.
And use the command as shown on the screen.
We are going to use nmap the stealth scan here as represent the stealth scan.
SC will check all default scripts against the machine.
Is used for version enumeration and dash O will check for the operating system of the machine.
Now you can see that a number of ports are available on the machine, including four for five, which
we are going to target in this tutorial.
If you scroll down, you can also see the OS version, which is Windows seven, professional service
Pack one and the versions of other services that are running on it.
Let's go back and try to answer some questions.
The next question is how many ports are open with board number under 1000, which we already seen.
Which are three in our case.
In the next step, we can run the Vulnerability Scanner script for Nmap when the Machine.
They use the command as shown on the screen.
And you can see that it has told us that the machine is vulnerable to 1710 vulnerability, which is
eternalblue.
This pace dancer in Hackney.
No answer is correct.
Now, in the next section, we are going to use Metasploit to exploit this machine.
Open a new terminal.
And start Metasploit.
With MSFT console command.
No search for eternal blue.
What?
My 17 Dash zero ten.
And you will see a number of modules listed.
We are going to use the exploit.
MZ 17 zero ten into the blue.
Just use the common use and full name of the exploit.
No to check the parameters that are required by the exploit.
Give the command options.
And you can see that we need to provide our host as a target to the exploit.
Now if we go back to the Hackney.
It has asked us to change the payload to Windows x 64 six Shell reverse TCP.
Let's try to do that.
Now go back to try.
And the next question was what parameter we are required to set, which is our host.
This type are host and click submit.
No type options again.
And set our host as our target IP.
It said command.
Not give the command to exploit.
It will take a while.
I will get the metaphysician.
However, we were required to obtain a shell, not a matter of session.
I think our payload has not been set.
Just exited and set the payload again.
These don't options.
And we can see that our payload has been set correctly now.
Not exploit it again.
And we have got the shell.
Can give the command.
Who am I to check for the current user, which is system in this case?
Now go back to go had me and mark the steps as completed.
Now let's background this session with Control Z.
You can check the active sessions with Sessions command.
And here we have a session.
Now, in the next step, we are going to escalate this child to interpreter.
And we are going to use a post exploration module.
Search for sale to my operator.
Now use this module post multi manage sell to my operator.
We can also give the command.
Use zero to use that.
You check the options?
Where we need to provide you the session number.
Nor give the command set session two to select the ongoing session.
And then use the command to exploit.
And you can see that our post module execution has been completed and a matter practice session has
been opened in the background.
You can check.
With Sessions command.
In order to open up the session, use the command sessions I three.
We can use different metatrader commands now, such as LZ.
Be asked to list down all running processes.
You can also check the list of commands that are supported by Metatrader with command.
No, let's just migrate this metadata session to an active process.
Are going to migrate to services that in the background.
There's no doubt it's bad.
And use the command migrate.
And our matter session will be moderated to the process.
You can use the command UID to know the current user and we can also dump the hashes hash command.
No.
Let's go back to try and answer the questions.
We have used Chad to make a better model to escalate our privileges.
We were required to change the sessions.
The Options menu.
And mark some actions that we have already completed as completed.
We already escalated our privileges.
Who am I?
Command.
We have also migrated to another process.
Now let's move to the next task, which is cracking some passwords.
We have already listed the username and hashes with hash command, so the non default user is drawn
on the machine.
The next step, we are going to crack its hedge.
To the copy.
The hedge.
Create an empty text file and paste the hash in it.
No.
Save it.
We are going to use John the to create this hash.
Right click in the folder and open the terminal in the same folder.
So the first step is to locate the rock traditionally that is available in most of the penetration testing
distros.
And we have the part for all traditionally which is located in user share where you.
Not to crack the hair, Use the command as shown on the screen.
Specify the dictionary with dash w flag and you can see that John has grabbed our password.
So copy this password and paste it in I the answer.
Now the next step is to find the flags.
There are multiple ways to do that, but we are going to search for these flags with my interpreter.
We can use the command search within the operator to search the flags.
We are.
All flags are listed.
Now let's just check the content of these flags one by one.
I think there is a typo.
And we have our first leg, which is the machine.
Just go for the flag and paste it into Acme.
Now the second flag is located in the config folder.
Just copy the part.
And get the contents of this flag with my Twitter.
No.
We may need to change the backslash in our slashes.
This tape.
And then we have our second flag.
Just copy the flag and paste it into Hackney.
No, Let's just take the third flag.
Copy the location of the third flag.
We did look at it in documents folder.
Get it out with the better.
Better.
Seeing backlashes to forward slashes.
And enter.
Nor copy the flag and paste it.
Right.
Try again.
The consummate.
We think we have a question and answered this market complete.
And we have completed the room.
I hope you enjoyed this room and learned how to do practical testing with a practical approach.