Hey everybody and welcome to the final video.
The Windows operating system module in this video we're gonna be going over how to manage some basic
aspects of windows from the command line which are still useful to a red team or for an engagement.
So this is a high level overview.
Again this is not a in in-depth course on how to manage windows entirely.
That would take probably the entire module on its own just to kind of go through it's good stuff to
know but I'm gonna focus on the stuff that you're going to need to know off the top of your hand for
quick access to certain things.
So the first thing I would want to do is introduce you to a command called Net user.
Now what Net user does is it lists all of the users on the system.
Now in this case we have administrator default guest just as a quick heads up net is actually a command
in and of itself.
It has a different different uses so go ahead and look into those after the video just to kind of get
yourself nowhere with it specifically.
Net view because that's going to be an important one during engagements as well.
So net user.
So we have the default administrator account etc..
So let's say one engagement we want to create a user.
So we're going to do net user name in the user name and add nice and simple.
Right.
So if we do not user again we'll now see that Brandon is now an active account.
If we wanted to delete it the same concept just instead of add its deal.
So now we can see the brand and an account has gone.
So let's go ahead and add him back now.
A good tip to keep in your back pocket is that Windows requires the previous password to reset to changed
the current password.
But there is a way for us to change another user's password without knowing the previous one as long
as you're an admin on the system.
So if you do a net user name in the star it will let you create somebody else's parser without knowing
the previous one.
So we'll do password 1 password 1.
So now you've got a brand new user with a new with a new password.
Or we could have changed somebody's somebody else's password.
Now this works for your own password too.
So if you're logged in that local the local account lets say you've compromised it and you need to change
your own password you can do that from here as well.
Just replace Brandon with your own username that you're currently logged in with.
Now that's it for user accounts.
What I want to go over is how to handle system information.
So there is System Info is going to provide a good chunk of information about a system.
Now when you view this on your VM like I am mine it's relatively small amount of data for the first
bit because again we've gotten nothing installed.
We have very little information around it.
So what I want to keep you focused on is the the OS names.
So this tells us the 2016 standard evaluation but it also tells us the version which is also important
for knowing which sometimes they have bigger patches that will change the OS version.
So keep track keep that in mind so we're going to have the processor information that type the original
install date which is sometimes important as well available memory virtual memory page files domains
also important to log on server which is normally a domain controller and then what I think is the most
important is the hot fixes.
So these are the patches to the Windows machine.
Now let's say you're on an engagement you just want to know what patches have been installed.
Maybe you have an exploit that only works if a patch is missing.
So we're going to use this info pipe then define string and we're going to look for anything with the
word K.B. for the four knowledge base or KDE articles which is what Windows does for further patches.
So we can see we've got three installed.
There's a good chance that whatever exploit I'm looking for is not installed.
There's only three but maybe we want to look for this particular patch right.
This K.B. article.
So if I wanted to do that I would just do the fine string look for the K.B. article and we can see that
it does not find it.
So my exploits good and just so you know the KDE article there is completely random.
Just type some stuff in there but knowing how to search for those key articles is important.
There's a few other techniques around finding the patches on the system from the command line.
I'll leave that to you for some homework.
This is just a quick way just to quickly grab it if you need it now.
The next important piece is services because services can lend a very helping a very good helping hand
around privilege escalation and getting from a standard user to an administrator or even the system
or even from administrator to system so a service how do we handle services and windows.
You can do it from the gooey which we've done and showed before under the services panel.
However from the command line there's not there's a command called A C Now this handles interfacing
with services creating them modifying starting stopping so SC is gonna be your your go to.
So if you wanted to see let's see what was running what services were actually running in their current
state.
So you do a c query and then we'll do when defend for Windows Defender so we can see that the Windows
Defender process or the service is set a state is running so we know that it's running that's great.
We can do the same thing for any other service.
However let's say we want to know a little bit more about it such as you know what executable is doing.
What's the how is it running like what what run type is it.
So SC QC for query service and we are going to use when defending again.
So Wiggins sorry about that add an extra C in there so we can see here that the start type is auto start
which means it starts on boot.
Now there is a demand one where it will only start when you specify which is also called manual.
But the important part here is the binary path name so you can see that that's the executable that it's
running.
And another important piece is the service start name which is local system.
So when you if you have for example if we saw this process and we can't we can't change that binary
Bin path because we don't have access to it maybe in its local system maybe we have access to the executable.
So the actual execute on the file system maybe we have permissions to modify the executable or overwrite
it if we do then just restarting the server gives us full access to the system.
Sometimes it's just as simple as that.
There's a lot of permissions get in place.
There's there's a lot of tendencies and issues that people could run into.
And it just takes one for an attacker to be able to gain system access.
Now let's say we want to create a service right.
SC again the word create followed by the name of the service that you want to create.
So we'll do test as we see now.
We want the start to be auto which starts on boot up.
Leave it that way for now unless you have a specific reason to start it manually.
But starting auto especially for persistence is good to keep.
Just make sure that it's always gonna be there and then we have our been path which in this case we
will just use to do users administrator
administrator will do a desktop and then we'll do paperless and then we'll do by bliss.
We see that should be fine.
So we go to create the service.
So do SC QC test SPC so we can see it's on auto start.
Now we have a binary path which is a pipeline which is perfect and we have service starting now.
Let's say we have this service.
We know that it's we we know that we have access to it.
We can restart it.
We can and we can modify it but it's running his local system.
This is perfect for us.
And in other older versions of Windows XP there is a service that will allow you to just immediately
do this.
It just had incorrect permissions.
So let's say we want to modify the bin path here.
So we do a c config instead that our service name test SBC and then whatever we want to change.
So Ben path we'll go ahead and set this to let's see Windows system 30 to see UMD Daddy.
Let's issues that.
Good.
Perfect.
So when queried again so now we can see it's a system 32 CMG Daddy instead.
Now what do we do if we want to delete a service let's say I messed up I don't want to.
I can't change it for whatever reason but I can delete it.
So SC delete the service name test as you say.
Perfect.
Now we've gone over creating and deleting and modifying.
But what about starting and stopping.
So let's do let's.
How do we we want to first find out if a process is running so that a C query will do.
Do app readiness.
Right.
So right now it's currently stopped.
So we'll get rid of the word query and just replace it would start.
That'll give us say start pending perfect quick back to query and we see it's running perfect.
So what if we want to stop it.
We replace the words stop start with Stop stop it stop pending we go and query it and we've stopped
the service now understanding how to manipulate services even just very quickly like this is going to
be paramount for a red team or you're going to find yourself on Windows systems where this is going
to be important or you might have to be able to test a few things out maybe write a quick script that
will use these commands to test permissions let's say.
So the last thing I want to talk to you guys about is for network connections.
So we look at that on windows with something called nuts that now nets that will provide you active
connections whether they are established during the time wait state which will go over all these types
of states in the networking module.
However just knowing that establishes currently connecting listening means it's way it's a socket or
a port that's just open.
So this gives us our quick quick high level overview of what we're connected to.
But if we do a dash a gives us everything.
So will show us what ports are open internally what ports are open externally what we're listening for.
It gives you a good idea.
Normally sysadmins will we'll take a look at this just to identify whether or not something is connected
in them that shouldn't be such as if a internal system is only accessible internally and it's not an
Internet facing system and it should never touch the Internet.
How why is it have a an Internet based address connecting to it on a weird port that can throw some
red flags.
It can also give you up in an engagement too.
So keep that in mind.
So if you come in on some weird port because you want to do 1 3 3 7 1 3 3 7 Azure as your reverse port
that's going to be eyeballed pretty quick and most firewalls are looking for port for 4 4 4 or 1 3 3
7 or anything above like four or five thousand that it does a quick look at.
So or I'm sorry 10 plus thousand so go ahead and toy around with some of these commands create your
own services test things out you won't have any problems throw everything in the Facebook group will
everybody be more than happy to help out.
So after this we're going to start working on the Linux side of the House.