OK.
Let's exploit this shall we.
So what we're going to do is we're going to need to open up MSF console.
So we're gonna open up a few tabs here and MSF console being the first.
And then we're also going to open this and we're gonna need to generate a an executable.
So let's go ahead and just type an IV config.
Make sure you get your tunnel IP address here minus 10 to 11 that for dot 114 and let's go ahead and
copy this MSF venom command here and I'm going to paste it in and just replace my IP address.
So what we're doing is we're saying hey MSF venom generate me and executable file that's called programmed
out XY and I want to use a Windows interpreter reverse IP shell I'm going to supply the L host and it's
going to go ahead and just pick all fours as the L port by default
hit Enter
OK.
Now let's go ahead over here and let's use the mole tie handler and we're just gonna set the payload
the same things so we're gonna say set payload windows my typewriter reverse DCP we're going to set
our l host to the IP address of ten to eleven dot forward dot 114 or whatever yours is.
I've already forgotten it.
Let me make sure for 114 is correct.
OK.
See options triple check here we don't have anything else to do.
We are good.
Let's run it now.
We're gonna need to do is we're going to need to put this file on the computer so I'm going to do is
I'm actually going to make a directory I'm going to call it move and then I'm actually going to move
this program out XY over to remove folder and see the interview.
Now what I'm gonna do is I'm going to host up a python simple HDP server on port 80 and I'm going to
go grab that file so let's grab that file go into here and as our low level user let's open up our Internet
Explorer like the olden days and we're gonna go out to our IP address attend at eleven dot forward island
14 and we just have programmed at XY so we're gonna go ahead and download this
and we're going to save this and we're going to save it into our folder for the run folder.
So we're gonna replace that program.
Let's go ahead and go to computer see
program files auto run program and then we're going to replace this here.
Now what's gonna happen is we're gonna go ahead and log out of this and then we're going to come back.
So we're going to log out and we're going to log out as the actually hit disconnect.
Don't log off.
Hit disconnect come back to our desktop and connect again and what we're gonna do is log in as the administrator
user so that user is TCM in all caps and then it's capital H lowercase a c k e r One two three.
So it's hacker one two three with a capital H hit enter and it's going to say hey we're going to try
to run this program can we run it.
Sure let's run it and then let's go over to our Meadows plight and see what happen.
Oh we've got a shell.
That's awesome.
So if we say get you Idi OK we are TCM dash P.C. who is the administrator.
So we do have full administrative access to this.
We could try to get system see if it works and know get system here.
So that is it for this lesson.
The next one we're going to move on to another registry escalation which is going to be always install
elevated.
So I'll catch you over the next video and we start talking about the always install elevated feature.