Hey everybody welcomes the next video.
So now that we've gotten our user access we've got access impersonation tokens the user Jay Smith now
that we're going to want to look at taking this a little bit more laterally so we've got an admin hash
and we have a feeling that there might be a potential Password Reuse where the admin accounts.
So a quick way for us to determine that is to quickly find out what hosts are running SMB so that we
can use past the hash.
So what we're gonna do is we're gonna go ahead and background this interpretation perfect so those sessions
dash out we should see our session still there.
Perfect.
Now we're gonna use use auxiliary scanner port scan
slash TSA
perfect.
Then we're going to show options.
Let's see what options we got.
We're gonna set ports to four for five for us and b set our hosts to 1 9 2 1 680 one hundred one dot
one hundred two.
One two three
then we're gonna set the Reds to 20.
I'm going to go out and run that
perv.
It looks like all of them are open.
However let's see now 1 0 1 is the web host that we are already attacked arms 1 0 3 is the web host
we already attacked it looks like one hundred is there as well so domain controller I highly doubt is
going to be reusing the admin hashes so we'll take a look at 1 to 1 which is an unknown host at the
moment that we have not we're not quite sure about yet.
So the next thing we don't want to do is we're going to use P S exact in medicinally to go ahead and
check that hash or pass the hash for us.
Now we can do this manually board news madness boy just for sake of quickness and use exploit windows
SMB.
Yes exactly perfect show options
or we'll set our hosts to 1 9 2 1 6 8 1 0 1 0 1
then we are going to set SMB user to administrator and we're going to go ahead and Cat Out hash which
is in our local directory here that we grabbed from our other machine one copy that set SMB pass to
this hash
and show options looks good so far so good and set a payload of Windows interpreter the reverse DCP
then we're gonna go and sets l hosted 2 1 2 1 6 8 1 24 set Pt. 2 4 4 4 5 instead of 4 full or 4 which
is what are using Amaru show option to make sure everything looks nice good perfect it does.
Let's go ahead and run it and see if we can gain some access boom.
All right so this info looks like we are on I.T. support 0 1.
So I.T. support 0 1 is is an interesting system based on its name.
So let's get you I.D. what are we.
We are authority system perfect so we're already ready to go.
So at this point we've started off with no access.
We attack the machine exploit it Apache Tomcat with default credentials gain admin access to the machine
dump to the hashes then impersonated a domain user and identified it a potential path the domain admin.
Then after that we've gone ahead and use past the hash and spread it across a few nodes and we see that
this particular one has using the same hash or the same password for their local admin accounts and
now we have two domain machines with system level access on them.
So it's just a matter of time past this point to actually move ourselves and domain admin.