Everybody and welcome to the first video of the exploitation module and the Red Team blueprint.
Now we're going to do a quick test to kind of show you why using manual methods is sometimes good and
sometimes not.
Now in this example we're going to be actually attacking a machine based on a vulnerable service but
we're not going to use Metis Boyd or any other exploitation tools that we'll give that will make this
easier for us because there is some times where an exploit for service is available online but not necessarily
in a spike module.
Now if you've never used medicinally before that's fine.
It's a it's just in a nutshell an exploitation framework that allows you to mix and match exploits and
payloads with exploits themselves make them all the more stable and it's pretty well versed and a very
common tool to use.
We'll have a whole mini module later in this particular module around how to use it let us play what
it is how it works et cetera.
However in this video for those who are aware of Metis boy we're going to be doing this by hand.
So you know everybody understands the process of what happens when you need to do this yourself.
We'll get rid of this Dropbox.
All right.
So the first thing we want to do is we're going to want to run it and map scan on our host right.
So if we do and map and then map 20.
So if we go ahead and run a scan we'll see there are quite a bit of things open.
However let's see we've got twenty one and twenty two open OK we've got go for which is filtered net
BIOS so this probably a Windows machine.
However it identifies as Apple for some reason which is probably incorrect because it says like we have
Microsoft.
Yes.
So let's take a look at SSA right.
So if we do not Cat 1 and 2 1 6 8 20 and 22 so if we look here it's got a safe 2.0 system ACH SSA to
Version 1.0.
OK.
So that's pretty interesting.
So that kind of gives us an idea that maybe this particular service is a lower version such as 1.0 which
might be vulnerable to something.
So go ahead and grab the name of the service.
All right.
Let's go ahead and go open up a web browser Firefox.
So this is why enumeration is important because there's going to be some times where you just have to
look at this manually like for example what we've done so far is we've done it and map scan which is
the first part of our reconnaissance here and then we actually manually banner grab the port itself.
So now we've identified some sort of service but we'll go ahead and close out of that.
So let's do the service and exploit DV exploit these is ran by Offensive Security which has a very well
versed set of exploits in payloads attach them that you can upload your own to solve or verified some
or not so keep that in mind.
But if we look through here we've got a file share over overflow automation server create folder create
create folder and then we've got.
OK.
So we've got a user name remote buffer overflow that kind of tells me that's remote code execution for
the most part.
So let's take a look at it.
We can see here exploit D.B. has verified this.
So if we scroll down to the bottom there should be an image perfect
so I'll go and click on this image.
So it looks like if we run it with Python the remote IP and the service SSD h it should launch and then
and then we do a net cat connection or socket connection to port for 444.
So let's see why that is so we can see here that it's issuing the connection using per Emiko.
That's fine.
So this tells me it's an egg Hunter and an SDH exploit.
Which is fine.
What's important here is it's a self-contained.
So everything is local to everything that's needed is local to the actual executable which is great.
So we can see here here's our OPP code or our payload and this is our identifier for a hunter.
But what's important here is this we see here that this is the command well relatively old command there's
MSF payload isn't used anymore it's called MSF venom.
However we'll go over that in the mini module for Metis.
However this looks like the code that it was user generated.
So it's a buying show.
So it's not a reversal we're going gonna have to connect to it.
This is the port that they set.
So Port 444 for Rob and it's going to encode it an X 86 from next.
Okay that's fine.
So it looks like it's pretty straightforward.
Is there anything else in the instructions here.
X less than version 5.5.
So this means we should be able to work with that.
So it's a pre authenticated remote code execution.
So we'll go ahead and download this
as you do this.
Go ahead and exploit download and get the raw view go out and copy this copy good and clear this out.
We'll do a W gets.
Go ahead and download this call.
Oh so we can see in here we've got the 1 8 5 3 5.
So if we do 1 8 5 3 5 1 in this exploit.
Why.
So if we do leave pad exploit DOP y we open this up call.
Everything looks fine looks good to me.
So let's go out and close this.
So what this showed us is that it was a bind shell.
So we'll open up a new tax we're going to have to run this based on the image it looks like it's going
to hang the executable.
So to use this python exploit.
So in this case we ran it and we made sure that some of the the include.
So if we look back here at the file including apparently go on Kelly It should already be installed
a lesson system are default to any python install but param goes not.
So make sure that that's installed if it's not installed you're going to get an error right away when
you when you run Python exploit IP y and it will go ahead and tell you.
So that's what I want to
perfect.
So I run this again takes a target and a port so we know our target is wanted to 1 6 8 0 1 20.
And our port is twenty two.
So go ahead run this OK.
Looks like it's hanging.
So we'll go ahead and connect it
so a port for 4 4 4.
So if we go ahead and click enter we should.
If everything worked correctly get our shell for our windows machine and there we go.
So if we want to know.
Let's see we loaded into system 32 which tells me right away that this is a privileged or administrator
account so we can confirm that with Echo username.
Oh that's right.
Your name is not set because of how we did this.
So the user
so there's only guests and administrator on this system and based on us being in system 32 I can generally
assume that we are administrators now.
This is good because this allows us to do even more and even more stuff later on when we get into these
post exploitation and persistence phase.
So for example maybe we want to do we want to create a user not user see when at
go.
So we do not user we can see wins there.
So if we add it to a local minister group not called group traders win at perfect
so we are successfully able to add our new user to the administrators group and then we could actually
use if remote desktop is set up we could actually use this to log in to the system or we can use other
tools which we'll talk about later such as a P.S. Zach that allow us to log in and actually execute
a prompt as we want.
So it's important to understand that you can do this manually and sometimes you need to for example
this exploit might not be in Metis Blake it might not be in your go to exploitation framework however
it's available.
So it's always good to double check manually and in most cases you will go to exploit DV or some other
other sites you're going to find that in most cases they just reference actual code for a Metis point
module which is perfectly fine.
However note that sometimes there is discrepancies where something is not an exploit D.B. when it might
not be a Metis boy and vice versa.
So it's always important to do this manually just to kind of test things out and make sure that you
understand at a lower level what this is doing.
Because if this script failed let's say from a python related issue maybe the code that they when they
typed it in or pasted it and they missed a character you know something as small as that you should
be able to see what the issue is and fix it yourself pending.
It's not the exploit itself that's failing such as the return codes or the order of where the egg Hunter
is placed outside of stuff like that you shouldn't need you shouldn't need to worry about that right
away.
We'll have a whole exploitation course goes on how to fix this if you really had to in a simulated environment
so in this case just keep this in mind this was just a quick example before we start getting into a
little bit more depth on the exploitation site.