So here we are.
We have our end that skin back and we have three ports open.
We've got FCP we've got telnet and we've got HP.
That's it.
So we can go out really quick to the inter webs and see if HP has anything for us.
Subs create a new tab hit enter and we've got this mega corp that's it.
We've got this page here you can view the source and see if there's anything here.
I've got it selected sorry.
View the page source.
There's nothing really here.
If there is an exploit this way we're gonna have to look into either what's running on the back end
here we could see seven point five windows server maybe there's directory busting we need to do etc.
but we're going to explore the other parts first.
So what I'm gonna do is I'm gonna open up a new tab and I'm just going to see if FCP is open.
So we'll FCP to this machine and I'm going to try anonymous log in
and the only other option is we could try logging you with telnet and seeing if we can get in that way
but here we have anonymous log in so I'm going to go ahead and just say Alice and we could see we've
got a backups and an engineer folder here.
So I'm gonna switch over to binary when we go into FTB we are typically in ASCII by default.
Now we have transfer issues sometimes with ASCII so it's always good to just switch to binary when you're
transferring files.
Now we can't do the recursive on I actually try that and it's saying hey invalid commands a reason to
go into both of these and we're just going to grab the files that are in them.
So if we l s there's a backup that M.D. B so we could say Get backup that MDC just like that you know
grab the file and then we're going to do this again for the other file.
So we'll see and then we're going to go into C.T. engineer L S and we're gonna grab this access control
so let's say access control that zip.
Just like that and now we have both of those.
So let's go ahead and explore what we just grabbed.
If I go to my files and my downloads I've got this access control that zip and I can see that there's
a PSAT here which is a.
Email file.
Right.
So this is commonly associated with something like Microsoft Office but it doesn't have to be.
Now this can be opened with other tool.
Same thing with this MDT.
This is a access database or a database.
Now the way I'm going to access these here coming up is going to be using Microsoft Office.
However there are alternatives and I will present those to you.
They're not installing Cal you'll have to take that your own path.
So what you can utilize is you can utilize to read this backup file here can utilize a tool called and
I'll type this out for you so you can utilize a tool called M D B dash Eskew L and just run it against
backup that MTV and then you can also use a tool for the PSG of read PSG.
So those are the two tools that you should use if you want to use it in a complete Linux format.
Otherwise as long as you have access to opening these files you should be OK.
So what I've done is I've taken these files and I move them over and I'm just going to show you what
they look like opened up.
So let me open up the access database which is the backup database.
I'm going to bring this over and you're gonna see there's a bunch of tables in here.
Now you have to kind of enumerate through these tables and see what you can.
You can find but if we scroll through there is the off the user table here and it gives us a few different
categories it gives us the username password last log in etc..
Now we have admin admin backup admin admin and then we have engineer and access for you at security.
So I'm going to copy this password and this is a lot of trial and error.
So if you do this box on your own and it took you a while to find this that's absolutely fine.
I remember doing this box back when it was a live box and hacked the box and it took me a couple of
days to actually solve this just because there's a lot of the numerator to go through and it's not the
easiest of boxes just because of the hurdles you have to go through.
So let's go ahead and just minimize this and we're gonna go and try to access this other file.
Now I tried to telnet originally and if you tried to telnet that's absolutely fine you could say hey
add bean or security or whatever user I'm going to try to log in with them and see if it works.
Unfortunately didn't work so I'm going to go into our files and then I'm going to go to the access controls
zip and I'm going to try to migrate this access control over I'm going to paste this parser that we
found and I've already got the file here but we'll just say replace.
So then this access control that PSG comes in I've gone ahead and loaded that access control PSG into
Outlook and I've just grabbed the file.
So here is the email there's one email that was sitting in there from John at mega corp dot com to security
at access control systems at com and it says the password for the security account has been changed
to this password so please insurers pass on your engineers something to copy this password and now we
know also that the username is security.
So again kind of went through that little bit quick.
But what has happened here is we had anonymous log in right anonymous log in on FCP permitted us to
find these backup files.
We found the backup files and we utilize the database to find the off table the off table allowed us
to access this PSG here.
We extracted the PSAT and inside the PSP was an email.
So this box is called Access is just a hint that we had to use access to actually access that that's
not to say.
OK.
So anyways what we're going to do now is we're going to telnet into the machine or at least attempt
to telnet into the machine.
So we'll say telnet and we're going to do do a dash L for the user name which is security we're gonna
say 10 10 10 ninety eight OK.
And it's a little slow as you can see.
All right Let's paste the password now well let's actually just pace let's say security and then we'll
paste the password.
Say this lets us log in OK.
We are in.
So UCC users security.
So this is the baseline here we have gotten a user account all we want to do in this escalation attempt
for moving forward is we want to be able to get a shell.
So this is your challenge for the next video.
We want to get a complete Shell wants to take that shell.
We want to do the enumeration of the credentials.
So we're going to try to find that command key slash list in order to run that we need a full sea shell
and then we'll go ahead and see if we can't download the root text that is really the challenge here
we're not going to try to escalate as I feel like that's going to be out of the scope of this course
at least the escalation into the administrative account is going to be out of out of scope but save
as is very very in scope for the escalation here.
So we're going to go ahead and try to utilize these save ads to grab the route that takes me off of
the administrative desktop.
So I will see you guys in the next video as we try to achieve that.