All right.
Let's talk about gaining shell access.
Now this should be somewhat of a refresher video because we covered a lot of this in the mid course
Capstone but I just want you to think about what you can do now that you have a credential.
So so far all we have is a credential right.
And we're going to see what we can do with that credential.
So the first thing I want to do is I want to boot up Metis play and we'll say MSF console and if we
have SMB open and we have a username and a password well then we can use that user and password and
especially that user has a machine and their local administrator to get in a shell we can use that with
P.S. Zach so we can search for P.S. Zach or if you know the windows exploit S&P it's exact you can do
that as well.
So here it's used 10 line 10 right here and we'll just say options.
Now what we can do is we could set the Argos so we know the F Cassel machine is that 1 9 2 1 6 8 fifty
seven one forty one and then we have to say set SMB domain to marvel that local set SMB pass to password
1 and set SMB user to EF Castle OK we could say options here and we could try to run this but we need
to run this with the appropriate payload so let's go ahead and just set the payload right off the bat
with set payload windows we're going to say X 64 interpreter and then reverse DCP and we'll go ahead
and say options.
Make sure everything looks set.
Let's go ahead and set an L host as well.
So let's set the outpost to Ethernet 0 here and we'll go ahead and give this a run and see what happens.
Now this doesn't always authenticate on the first go and it always doesn't authenticate with the first
automatic targeting.
So we may have to give this a go with a second attempt or we may have to give this a go and see it's
not working here we'll give it a go one more time.
Looks like it's doing power shall power Shell might not work here we may have to try a different target.
So it's always good to exploit targets here and guess exactly is one of those funky ones where either
it's going to work or it's not going to work with that specific one.
So let's show just show targets and we've got automatic power shall native upload and MF uploads.
Let's go ahead and just set target of two and we'll run that and we've got a virus detected what happened.
Oh no.
So if we go to our Windows machine you may have heard the ding.
We've we've got a virus detection here.
So what's happening is that we are we are blocking this virus with the P S exact right.
And somehow windows defender got turned back on.
Don't know how that happened but that's OK.
If you're s got turned back on that's fine as well.
This is a good learning lesson.
So P.S. exact getting blocked.
So what if we can't.
Yes exactly.
OK let's try something different.
Let's go ahead and let's try a new tool.
So let's go ahead and let's try this exact pie and see if that works.
Let's do a dash help just to see how this looks.
This should be familiar to you.
Right.
We're just going to use the domain username and then password at the target name.
So all we're gonna say is marvel that local.
And we're going to say something like F castle and then we'll give it the password one at 1 9 2 1 6
8 7 1 forty one run that apologies.
It's a forward slash try that.
OK look here.
So my term printer got picked up.
P.S. exact up pi did not OK.
We got a show at this exact pi.
Now this is a little bit more obscure.
This is not infinitely more obscure.
There are still antivirus is that you can pick this up at Windows Defender which I love Windows Defender
Windows Defender did not pick it up right here so bad on Windows Defender but still here we are.
We've got a shell in the system now.
We could take this and we can get a little bit more quieter so we can say control C and kill this and
we can go in and we can do SMB exact or w am I.
Zac we can say S&P exact like that and that one didn't work.
OK let's try w my exact and see if we get that one to work
in this one doesn't look like it's going to work either which is OK so we need other options and this
isn't the first time you're seeing any of this right we saw this in the very last video of the midcourse
Capstone where we can try us and be exact and w my exact and just be familiar with these tools.
So what you have and what I'm trying to point out here is don't give up on the first tool you have at
least four options I just provided you here and if you saw in medicinally we actually have more than
that we have a power shelf feature as well please scroll up just a little bit there is a power shell
version of P.S. exact as well so don't just give up at the first one and know that there are multiple
options and if I all tap back into that you could see to that you know we we were able to get in with
our P.S. exactly but we weren't able to get in with our with our W and my exact or we weren't able to
get in with our P.S. exact on Metis flight either right.
So it's important to know that we have all these different options available to us and that P.S. exact
is one of the more noisy when it comes to antivirus.
So I would avoid starting here my tip pro tip is to start with something like SMB exact or w my exact
see if they work see if you can get a shell if you can what you can do.
They're only like half shells is what they're considered they're not fully interactive but they're good
enough to navigate around the C drive you can issue commands with these there's a lot of things that
you can do.
So what you need to do is you navigate around and you issue some commands and you say hey let me figure
out what's I've antivirus if anything is running and then you once you figure out what's running try
to see if you can't disable that antivirus so then you can run something more robust like Windows interpreter
or mature printer on Windows because it just does so much more for us.
So what we're gonna do is we're going to go back and we're going to disable that in defender.
I'm going to make sure that that's all disabled again.
If you're as re enabled just go ahead and disable it as well as we move forward.
Make sure those are disabled so that we can perform some of these other attacks with medicinally.
And again the tip here is to make sure you get in quietly first go in navigate around try to find the
antivirus that's being used.
Then attempt to use something like P.S. exact or even another method in Metis flight to get around it.
So hopefully that all makes sense and you don't give up at the first failure.
So that's it for this video.
We're going to move on to ITV six attacks next.