Hi everybody and welcome to the high level overview of the Windows operating system.
So where we left off is where we've installed the Windows Server 2016 OS inside a virtual box.
So the quick thing of how how do we get in.
How do we do actual delay.
Because if you've tried it already and you happen to be on a Windows machine you'd lock your own machine
and not unlocking the current one.
So for input directly on keyboard you're gonna want to go to input keyboard control delete.
There's a few other options as well.
So this will allow you to at least get to the part of logging in right.
So we'll go ahead and log in.
The first thing that's going to load up for you is the server manager dashboard but we are just going
to minimize this for a second.
So we want to be able to work with a bigger screen a more responsive screen.
So what we're going to do is install the virtual box tools.
So what we're gonna do it's called a guest editions.
So what this does is this allows the operating system to be able to interface with virtual box a little
bit better.
So do that again it's devices insert guest Ed. See the image.
So when we come down to file explorer here and we do local piece this P.C. we will see virtual box guest
Ed..
So we're going to go ahead and open that
and we'll go out and click next all the defaults here is perfectly fine but hit and or wait for this
to finish.
And then what we're going to do right after this is we are going to bounce or restart the machine.
This is for everything to take effect.
So we'll we'll actually wait for real time to show you the difference between the two.
So we're going to hit go ahead and install this as we trust it
flickering is OK that means it's installing drivers and turning drivers on to mess with the the resolution.
So we're going to go ahead and just let it reboot on its own
so when this now loads back up we should it should scale to fit the particular window size that you
have.
So in my case it's a pretty large window size.
So we'll go ahead and let this finish
Perfect and scale this back up just a little bit.
Going to go ahead and again do control or delete
log in.
Perfect.
Let's go ahead and resize this.
There we go so it should be automatic.
I was a little early on that so now we have server Control Manager server control manager.
In a nutshell manages the server.
So now on a Windows desktop such as Windows 10 Windows 8 Windows 7 XP you're not going to see the windows
server manager.
However we've installed a server because that's what we're going to be mainly working with.
And what you're going to see a majority of the time on a red team engagement and what you do here almost
1 4 1 translates to a desktop depending on some commands here and there and server specific functionality
but Windows as a whole will have very similar things between both.
So what this server manager allows you to do is essentially manage the server so it allows you to add
roles and features which we're going to go over just now.
It allows you add sir other servers to manage from this particular console connect the server to cloud
resources and to create server groups.
So for now we're just going to focus on adding roles and features.
So what is the role in feature so there are in this party doing role base or feature based installation.
Now there are ignoring a lot of the clicks I want to get you to be able to see some of the features
so there are a lot of features such as hyper v which is a virtualization as well similar to virtual
box.
The web server for IRS some of the patching services DNS and DCP which will go over in the networking
module.
But it's important to know that this server can perform a lot of functions for an organization.
So ADF s so active directory which is something that we are going to arm site Active Directory Domain
Services.
So ADT says we are going to be having an entire module around how to set this up how it works so this
is an essentially what I mentioned before Windows domain.
This makes this machine a Windows domain controller which is where workstations will be able to log
in and be able to authenticate to this particular server.
So compromising this allows you to compromise the host.
So the roles here.
There's also features such as if you need bit locker for disk encryption if you need let's say here
it's getting some good examples and S.A.T. server.
So think of features as services as well they are.
So if we need a wireless LAN service or Windows search power shell as an example for any scripting that
you might want to do the Dot Net framework as a common use for this you're going to in this particular
case we have four installed but in some cases you may want three depending on what your requirement
is.
So understand that when it comes to adding in roles such as Active Directory hyper v ISIS DNS anything
like that you're going to be looking at the server manager.
So we're gonna go ahead and hop out of the server manager for now that's that's we'll be going more
in detail on how to actually install these services in different modules pending on what we happen to
be talking about.
So the next step is is what's common in most Windows platforms is the control panel.
So we're going to hit the taskbar down here come up the control panel.
Now there's a few options here we've got system and security user accounts uninstalling programs turning
features on and off which again is the the feature part that we just showed you just a different way
to do it the network and Internet status and tasks that are there.
So what we're gonna do is if we want to add a new service account we'd come in here under user service
accounts and we can also remove them add new ones create a reset desk there's a lot of variety of things
you can do here now there's another way to do this and it's more of a preferred way on a server which
I'll show you in a little bit.
That is when I say that I don't mean in an active directory sense I'm just talking about the server
itself.
We'll go over that in a minute.
So we also have system in security which handles the firewalls.
So showing that they're up resetting turning things on and off as an example.
All this stuff is inside of the control panel so that their system security.
So it also has power options and administrative tools so there's a few options here we won't get into
these too much right now.
And then the network and Internet so networking sharing center network options.
So this is your internet settings where you can set proxies if you're using something like Firefox which
you probably wouldn't be on a server you can set the proxy there.
However this is more of the the system proxy.
So let's go ahead and say this is pretty much it for the control panel uninstalling a program we don't
we only have the guest additions installed.
However anything else you install here whether it's a server or windows can be removed this way.
So turning features on and off again brings us straight back to the server manager which will then load
up that same menu that we were looking at.
So we're going to go out and click out to this so the next thing we're gonna want to do is look for
administrative tools.
So we have something on here called administrative tools.
With this it gives you a lot of options and different things that you can look for.
So what we're going to look at first is computer management.
So as I specified before that there is other ways to create users on a single server that when it's
not part of an active directory infrastructure.
So we go into here we see a few things Task Scheduler so we can set applications to run on a set time
re trigger different things and then we were going to go over and a little bit.
There is a performance tab as well where you can kind of see how how the machine is doing what we're
going to be doing in this particular case is looking at local users and groups.
So if we go to users now we've got our full list of users.
So the one we're logged into the default account which has been disabled and the guest account which
has been disabled as well based on the the down arrow.
So adding user is as easy as this user first name password they must change it or we can set the account
to disable right away and create.
So test user use test test the password for test user must change to log in and we have password policy
constraints.
So we'll do password 1
just to kind of get around that.
I don't match
so we've got our test user.
So if we were to log out log back in we could use the word test with password one password and we would
have standard access to the server so and to delete one is just as simple just delete.
So that's computer management.
Now you can even get into the servers backups and the disk management aspects but we're going to leave
that alone.
So then the next step we're going to look at is the Windows server settings themselves.
So we don't do that so if we come into here under P.C. properties we can sell it tells us a little bit
more about the system so we can see that we're using to gigs memory.
We have two his memory installed.
A 64 bit operating system now.
This product idea is just a standard one for your evaluation license if you're part of a domain your
work group would change here and we've got a standard computer name.
This just gives you a pretty basic overview something that you want to keep a note of as advanced system
settings.
So in here you can change your computer name so we would just come in here hit change it would put prompts
with a different name we hit.
OK.
It forces a restart when you do that advanced is we have startup and recovery options environmental
variables is something we're going to go over later.
However it's important to understand that the path variable is here.
It's under it's under advanced system settings.
So there's quite a few other things here put in place like where your temp is where the wind directory
is there's a few other things here.
Again we'll go over this in a little bit more detail in a future video.
So another thing to keep in mind is under remote currently If this is on a network and you want to do
remote desktop which allows you to view and interact with the desktop on the server without having to
be physically at the machine you're going to want to allow this.
So in this case we have to put a firewall rule in place.
However you don't want to allow this.
I'm going to leave it off for now so the lap.
There's a few more pieces that I want to kind of go through.
And one of them is services so services are applications that run consistently that performs some sort
of function for the system.
So in this in this example where there's quite a bit running I actually mean that a little too big.
Back over.
All right.
So we can see what's running and what's not.
So for example we've got the background tasks running we've got let's see your credential manager which
is important.
Running.
We've got C or D HDP client is running which is good so there's a lot of options here and stuff is not
necessarily started by default.
So for example the remote remote desktop services to be able to have RTP session able to it you need
to be able to turn.
You just need to be able to start this so we can do that if we wanted to or we start the service and
now it's right.
Keep this in mind because in privilege escalation services play an important part depending on how things
are configured.
So sometimes it can be an easy win just based on how services are and I know I might have sent said
this in a previous video but you can see how this is local system if we're able to create a service
as local system as a regular user and run it we can tell it whatever binary or executable we want it
to be.
So keep in mind have services services run a lot of the day to day aspects of the system so stopping
some of these might not even be possible.
So an enabling them might not be possible without other services enabled and you can obviously create
your own so the next step is we're going to view the task manager task manager as a pretty important
piece here.
It allows you to see what's currently running.
So in this particular case we see a guest services running and then the windows processes which are
the system level ones where they're normally services.
However anything running a system tends to show up on here and we got background processes that are
started at runtime.
So we've got the search feature is running the Windows shell experience which is the guy who is running
and the spool are for printers.
So that's all right.
So if we need to be able to kill something we would come in here and hit any task.
I'm not going to do that because I would kill it going.
But in this particular case if you had something that's stalled you would come in here.
Performance is another one it allows you to see kind of where everything's at user so this will show
you the currently logged in users on the system and what they're doing as far as like what's what's
open under under their account.
This is sometimes good to look at from an administrative standpoint to know if there's users that are
just logged in and just been sitting there details is a little bit more about each executable and the
description for it.
And then obviously we have our services tab where we can quickly come in and start and stop different
things just from a quicker quicker aspect.
So keep keep a task manager in mind so second to last thing that I want to go over is the event viewer
now Event Viewer is Windows logs.
So we're gonna go over a quick system very very quick overview on the windows logs.
Right.
So if we want take a look at the security log we can see here it says log on right so we can see down
here under.
Details
system authority
user account let's make this a little bigger
user account management.
So we're going to look for a log in something interesting
so here we go.
So special log on.
So this is showing the administrator having logged in perfect.
So this.
So this means it was it was successful.
They were able to log in and in the module that we talk about Windows log specifically will go over
what a failed one looks like.
Other different types of logging that's around.
So just keep in mind that the event viewer is the windows logs which there is.
This is the security log in this particular case there are application logs so when applications fail
don't run they throw an error message.
Whatever the case maybe they crash it tends to show up in here.
We've also got system level ones as well which are just more of like run the business.
So we've got an error here.
Application in specific settings.
This is most likely due to the firewalls that we have in place and the settings on the system by default.
So we're going to close that out.
The last thing I want to show you is the registry.
So we're going to go in.
So that was right click Run Reg at it.
Which brings up the Registry Editor.
So what's important about the Registry Editor is think of the registry as the brain for Windows.
It holds all of the information around user user accounts.
What they do how things talk to each other.
So for example the classic route has information about registered applications.
So when you've installed something.
So if you install adobe reader to read PDA files the information of how a dot PDA extension on a file
is supposed to be open by PDA reader.
That type of stuff is stored in here.
So the current user.
So this is information about the current user logged into the system.
That's viewing it.
So in this particular case it's me it's running as administrator so it's going to have administrative
settings here.
So local machine stores specific settings and information about the machine itself.
So this can be password policies for the local system.
There's a lot of different things that can happen here.
SAM WHICH IS holds the usernames and passwords.
It's not technically stored in the registry but it is in a file which is on modifiable and unreadable
by the user during live runtime.
So you'd have to pull it off when the system's not running.
So you've got software classes.
There's there's quite a bit in here.
Be good.
I'll leave a link below the video around a little bit more about what the registry is.
And each individual piece so each key users.
This is showing profile information for the machine for already logged in users and currently log in
user.
So this is for every user on the system so gives us a little bit of information about what they're doing.
Stuff that's been used in profile settings et cetera.
And then the last one is the current config.
So this is information gathered at runtime.
It's it's more or less like boot time so when things fail in some cases you may have seen where you
were running into an issue on your windows machine and it just died and you needed it to boot from something
called a last known good config.
That's what this is doing.
So that's what this is.
So this is the last known good config that it was booted with.
So that's the registry.
This is a high level of of windows from a general perspective.
We're going to in the next few videos go much deeper into specific areas of the OS.
It's good to understand that from an attacker's point of view as well to know where what you can leverage
and what you can't based on the system settings.
So I want you guys to go ahead and play around with this create some user accounts test some firewall
restrictions put some stuff in place turn on and off services look up what the services do kind of get
a general feel for some of the different things.
Now when it comes to the registry be careful that you don't change anything that you are not aware of
what the outcome is going to be because changing the registry can cause it not to boot at all.
It could cause it to fail there that there's a lot of issues that can happen and there's not really
a fallback for it without reverting or reinstalling.
So when you're working the registry in your since it's a VM You don't have to worry too much.
But you don't want to have to go through the reinstall process because you borked up a command or you
put in the wrong entry or deleted the wrong registry key.
So just keep keep worry about that.
In most other cases that everything else I showed you play around with everything install a role if
you want to just get familiar with the with the layout of the the Windows operating system as well as
the server based edition.