Everybody welcome to next video.
So now we've done our recon and we've kind of found out a possible path to attacking this machine.
We're gonna go ahead and actually attack.
So the first thing we want to do is generate a war file that we can use to upload to Apache because
you can see this deploys a wire file to a server location so the first thing we're gonna do is we are
going to generate our payloads.
I myself am dash P windows interpreter reverse DCP l host.
So you go to 1 9 2 1 6 8 1 for Port sequel to do for 4 4 4 and dash F will be la mode.
Put this in the shell Dot.
Go ahead and run that and generate our payload.
Just so you know if any of you weren't following on why it's a Windows payload you can tell based on
what we saw in the port scan so we come up to the port scan up top we can see we're seeing Microsoft
DNS net bios SSN so this kind of gives us a hint that this is a Windows machine so we're gonna make
the assumption that it is.
And if our payload does not work for whatever reason we can go ahead and try a Linux payload instead.
So the thing about war files is we have shelled out war now a war file is just a zip file.
Right.
So it can be deployed.
The problem is there's two ways to to exploit this when this loads up.
There will there will be a MSF or interpreter shell kicked back to us.
The problem is if we do on the show that we are
you can see we have this file.
So this is what actually gets dumped.
All of these get dumped into a directory called called whenever we name our war file.
So that's how war files work in Apache tomcat.
We need to know what this guy is.
So the reason for it unzipping it is because we want to know what this is because it doesn't tell us
this is always random.
So we'll just keep that in the back of our minds.
Now we're gonna set up our own interpreter show our interpreter handler so we can catch our shell that
we just generated.
And while we're going ahead and waiting for that to load up we will go ahead and deploy this.
So we'll browse
we'll do shelled out war open and deploy.
So now we kind of got that set up one set this up use exploit all tie or set payload to Windows.
INTERPRETER sluggish reverse TTP said I'll host 9 to 1 6 8 0 1 4 7 0 port 2 4 4 4 4 1 and go ahead and
run that.
Now if we remember over here this was r GSP file right.
So if we go up to here we click on Shell.
Now in this case.
OK.
So it happens to have directory listing so we can just click this but if it does not have directory
listing you would just paste it here.
And we click that's it.
So let's go over to our handler.
We've got our payload.
Awesome.
So let's take a quick look.
Get you I.D. and it looks like we are administrator which is perfect.
So if we do get system we should be ante system authority on this info on something called Web instance
one on the domain Red Team nation.
So perfect.
So we've got system access on a server that is part of the domain renting nation.
So we'll have to keep all this in mind.
Now we're going to move on to post exploitation.