All right.
So next up are startup applications now startup applications are a similar concept to that of the auto
runs that we performed when we boot up our machine a application is going to startup.
Now when the application starts up hopefully it's going to give us a shell now.
Same concept right the auto round was simulating a plug in of a device or however we want to perform
it here.
We're just saying hey when we reboot this machine certain applications start up when those applications
start up one of them is going to be malicious and we're going to take advantage of that as a user.
We're going to utilize a tool called ICI ACLU or I cackles or whatever you want to call it.
Basically it's going to look at the permissions of AC L's and allow us to see where we might have access.
Now if we ran power up on this we're actually not going to find anything.
So this is kind of one of those situations where at least one tool doesn't find something that's actually
there.
So it doesn't hurt to have this command memorized or written down or you will find this absolutely on
the Cheat Sheet or resources they provided in the beginning of this course.
So do take note that sometimes you're going to have to manually look at this.
So what we're gonna do is we're going to utilize this icy ACLJ that you see and we're gonna look at
the startups.
So let's go ahead and go to our machine via our desktop.
If you're not there already go ahead and pause and then join me once you're logged in as the user.
All right.
So let's go there and let's open up a command prompt
and I'm just going to copy this really quick
and really what we're looking for is we're just looking to see that the users group actually has right
access to this.
Let's paste hit enter and if we make this a little bit bigger let's see if we can.
You can see that we have right access here if you look at the built in users and we see the f the F
means we have full control or full access.
Now if we look at the Microsoft docs I'm actually going to bring this up over here.
So if we look at the Microsoft docs you can see down here on the remarks what each remark means.
So if we have f here we see that we have full access M is for modify access read and execute read only
and then write only access.
So anytime we see an F especially as just a user we are in business.
OK.
And we see here we have users f meaning hey we can do anything we want to this startup area.
All right.
So what we're going to do is we're going to get malicious we're going to generate a malicious file and
executable and we're gonna have that load on startup.
Now we're just going to simulate a reboot by logging out and then logging in as the avid user.
But basically all we have to do is wait for an app and user actually log into this machine.
We'll get a shell and we'll elevate privileges.
So let's go ahead we'll pause here in the next video.
We'll go ahead and take a look at how we execute this and pull off this escalation.