First up on our list is the auto run feature.
Now you may have seen auto run before.
Think about when you plug in an external disk or even a C.D. rom com back in the day and the windows
will prompt and it will say hey what do you want to do with this when you plug something like this in.
When you plug this drive in and you say hey just run it.
That's an auto run.
So what we're going to be looking at is we're going to be looking at auto runs and seeing if we can
find anything that runs automatically and when that runs automatically does it have the permissions
on it that will allow us to change those permissions of that auto run or the executable and elevate.
So we can check for this in a couple of different ways.
Now the way that I'm going to show you here first in the way that's built into this is to just open
a command prompt and use this auto run 60 EMC which will allow you to check for any auto runs.
Now this one is a little bit more of a visual we're gonna go out and see what's out there and kind of
have to look at it on our own.
So let's go ahead and go into our our desktop now.
Be very cautious of your exploration time here.
You can add an hour very easily just click Add hour and add an hour to your time.
So if you're working through this make sure you're watching expiration as well.
So go ahead and go into your machine and just open up a command prompt and it's just easier if you copy
and paste what's here from the course.
So it's going to right click and paste.
And actually I ended up copying something else.
So let's go ahead and give this a quick copy and then we're gonna go ahead and paste here
OK.
And this is a cis internals tool.
A lot of these are going to be windows CIS internals tools just hit agree and now you're going to see
that it's searching for the auto runs here and we're going to look through this to see if there's anything
of interest for us.
And it takes just a minute to come back.
So here we can see now at the very top we have the run.
So we see in the run current version run we have something called my program and it looks like it's
in C program files auto run program programmed EMC XY so this might be something we want to look at
a little bit deeper and what we can do here is we can use a tool called Access check to do that.
So access check is just yet another CIS internals tool that we're going to utilize throughout this actual
lab.
Here you're gonna see access check come back.
So be aware of it and what we're gonna do is we're utilizing the switch of w the U.
OK.
So WVU the W says only show me items I have a right access the V says hey I want to see verbose meaning
I want to see as much detail as you can provide for me and you just says hey ignore the errors suppress
the errors so we're going to go ahead and run this and we'll talk about what we're seeing
and again it didn't copy for me Sorry guys.
So let me copy one more time and we're gonna go ahead and paste this
it's going to ask you to agree again to the CIS internals licensing and now what's happening is we're
looking for file all access for everyone.
If everyone has read write access to this file that automatically runs.
Guess what.
We can get really malicious with this file.
Make somebody else run it as administrator and then we can gain administrator access.
Now what we're gonna have to have happen is an administrator is going to have to log in.
It's going to run.
They're going to say yeah I'm going to let this run and then we'll get a shell back.
So it's actually pretty cool.
So from here we're gonna go ahead and pause but actually before we pause I want to show you one other
thing.
So as a quicker way to identify this we're going to utilize this too.
Let's go into our tools folder and let's go to power up and empower up.
We can just hit shift and then right click and we'll open up a command window and what we're gonna want
to do in this command window is we're just going to want to say dot dot backslash like this and then
we'll just say power up dot.
P.S. 1 just like that actually sorry power shell execution policy bypass.
And then we're gonna say that dot dot just like this and that'll load that up.
Now this is going to be a little bit small text on the screen.
I have no way to actually increase this unfortunately so this size can't be increased but if you need
any syntax or have any questions feel free to reach out.
But here we go we're loading it and then we're gonna type in and start typing and invoke and then dash
all checks.
So it should auto tab and it's going to start just looking for all these different checks.
Now this will come into play later.
So go ahead and just leave this up when you're running it just minimize it and we're gonna come back
and look at what this does.
But if we actually scroll through this you're going to see that it's going to identify the run program.
So somewhere up here towards the top start scrolling down and we'll see if we can find it.
And here it is.
So checking for modifiable registry auto runs and can figs.
You could see that I found the auto run of my program tells us the location of program that e XY.
And it says hey everyone has read write access to this.
So it's a modifiable file.
So that's what we're gonna do we're going to pause here now that we've done the overview and then next
lesson we're gonna go ahead and exploit it.
So you're welcome to go ahead and give it a go on your own using the exploitation steps here.
But I'm going to walk you through these exploitation steps in the next episode so I'll see you over
there.
Charlie.