Everybody welcome to next video we're going to be talking about the first step in approval desolation
is learning about the OS.
So what OS is this person currently using.
So on Linux environment you can do you name Dash.
Now this provides you quite a bit of information such as the architecture of some dates the type of
system it is.
Kernel versions and you can deduce this with you name and based on the kernel version and the micro
versions you can attempt to look provoked escalation in such as two point six or two point eight.
Whatever the case might be but on a Windows machine if we take a look here.
So this is a Windows machine.
We have to do something called CIS info or cis info.
So what.
System Info does it goes ahead and grabs this information.
And now keep in mind I'm using this from the UI or from the command line to show you that it could be
done do turn British showers or any type of shell as well.
So we can see.
Here we have OS name which is Microsoft XP Professional and we have OS version which is five 5.1 or
Service Pack 3.
So now we know this is Windows XP Service Pack 3.
Now what's good about this is there are a lot of exploits available local privilege escalation exploits
as well as remote.
But quickly show you that this account does not have any admin rights.
If we do that the user administrator could try to change the password password and password we get access
tonight which is exactly what we'd expect.
Now let's take a step back and take a take a stab at this Windows machine from an attacker's perspective
from a perfect escalation.
Let's assume that I have remote desktop access in some way shape or form that could be done through
an interpreter or a Metis boy payload instead of a return trigger.
You can do whatever you want.
There's the RNC inject.
Let's assume you've gotten that far.
And again this can all be done with the interpreter you can just upload a binary and then execute it
without ever having do anything.
But we'll go ahead and assume you have already access.
So we're running Windows XP Service Pack 3.
Now the quickest way to do this is to actually issue a search for that same thing with pivot escalation
taxing in the end on exploit.
And this provide you with quite a few results.
There's quite a lot of pick to pick from here and there's a good common one that's always a good go
to.
So what I would recommend doing is going through each one of these figuring out what they do.
So for example on this one right here
we can see that this is predestination and that's 11 0 6 2 and is vulnerable on our version and we can
see if we keep going down it's a compiled version.
So we have to compile this and it looks like it's a win DCC.
OK.
So on on a Windows machine or on a Linux machine let's say with R. Kelly machine we need to be able
to compile C code for a Windows platform.
Now to do this you can do apps install Ming w dash w 64 so that we'll go ahead and install it.
I've already got it installed.
However if you run into a problem where it says the binary cannot be found or the package cannot be
found you're going to want to go into ATC tapped sources list and make sure this line right here on
the bottom is there.
If it's not go ahead and add it save the file and then do apt update
and apt upgrade and run them both I'm sure there's two to outsiders in there and an to upgrade you to
want to run that right after you update the source list file and then you can do the install mean w
dash w sixty four that will go ahead and install it.
Now we've got it we've got it installed now the next thing we want to do is find out what exploit we
want to use.
So again there is is an exploit that's fairly common for Windows XP.
So assuming you went through this test you've kind of found out what you were looking for what you can
do is you could search for and this eleven dash 0 4 6.
This is a very common Windows XP Prevent Escalation exploit.
We'll take a look at this one so RFD DOT says local escalation always seems to be a good one.
It's pretty stable.
It's export DB verified so they've tested it and it looks like they tested it with most versions of
Windows XP server Vista server 0 8 and server 0 3 and Windows 7.
Even so this is a very very good exploit.
Always keep this number in the back your head you never know when you might find it.
So when the raw code we can tell that it's C codes we'll go out and copy that out we'll do V.I. exploit
that see and we'll go ahead and paste this all in.
And we'll leave it as is now the next thing we're going to do is compile it so I 686.
W sixty four.
Ming thirty two dash DCC Dash.
When thirty two.
And then we're going to do the exploit and then our output exploit Daddy.
Perfect.
We are missing one piece here.
If we take a look at that exploit one more time we'll look at the compile instructions actually provide
us with a full command that we're gonna want to use.
So if we go down here looks like we're missing a flag at the end.
OK here we go.
So we're missing this flag right there.
So we go ahead and rerun that command with that flag.
So we go and look here we have exploit that XY perfectly set up.
So we set up our Python server
port 80 and we'll go ahead and go over to here again and again I just want to show you quickly that
this is not password password that we do not have access.
So what we'll do is we'll open up Internet Explorer go to Agent P to that 1 6 8 1 twenty.
There we go.
Go ahead and save this just anywhere on the desktop is fine.
We'll go ahead and then we're going to just open it so it easy here it looks like it escalate into privileges
so we'll do a user administrator star and we'll do password password.
Oh look at that.
It worked completely but if we did the same thing over here
we could access.
So it successfully escalated approval to root our two system.
So what we can even do here is do that user or not local group administrators butchered that whole thing.
That he and the local administrators will do.
What's this user called guest account guest account slash and done so that if we come over here type
of thing in
we still get access to and that is because this prompt is still has the same tokens.
So if we go ahead and reopen a new command line do user Schrader star star.
That's right.
So the reason this is because when you when you originally get your token it requires you to log out
and log back in.
However our group our users now part of the local admin group.
So when the user logs back out and logs back in the new tokens will be generated and then they will
have the administrative token attached to it.
But we still have this command prompt right here which has system level access and we can do pretty
much wherever we want.
So this is kind of showing you a quick step in keeping my meds Boyd has a bunch of local privilege escalation
exploits that you can use and just launch directly from the mature and gain system level access from
there.
So it's always good to just quickly double check on Google what purpose escalation exploits you have
now.
You can even take this a step further.
Let's say you're not running you're not quite running into you don't want to necessarily run a perfect
escalation exploit itself.
You could in turn try to run a common issue for Windows XP.
Now to look for something like that you would it's a little bit of trial and error search on this part.
So you do Windows XP Service Pack 3 Prevent Escalation and you're going to find a lot of exploit DB
right away.
But when you start getting past the exploit D.B. you'll start seeing common exploits OSTP total guide
for Prevent Escalation on Windows.
You'll start seeing quite a bit so privilege escalation in windows using medicinally so that there's
there's a lot of things that you should also double check when it comes to privacy escalation in general
because there's always there might be some easy ways such for example.
There are some services and Windows XP that allow you to edit the bin path that will.
You can set it to whatever binary you want and then when you restart the service it restarts as systems
and then it gives you immediate access.
That was a mis configuration from Microsoft a while back but that still is present in the versions that
have not upgraded.
So keep that in mind there's a lot of things you don't have to go to the exploit route but learn how
to search this stuff up.
Start with whatever service whatever version of the OS you want so I want you guys to take a second
and go through this and take a look at even Google tutorial right.
So go ahead and look up how to read this tutorial and then take a look and see what.
See for example this is how can Windows XP VNS eleven dash 0 0 6 so take some time learn how to do this
stuff manually and also learn how to use the exploit itself just like we showed in this video.