All right.
So.
Same as before.
We're going to run MSF console so I'm going to go into a terminal and I'm going to get MSF console running
which I already do.
If you are rejoining from an earlier lesson then go ahead and get this loaded and we're gonna use the
multi handler
and we're just gonna do an options real quick.
Make sure that your payload is set to windows and return fritter.
Reverse underscore TGP you have your IP address set as your host and your all port should be for four
four four by default.
That matches everything that is setup here.
Well I think we're gonna need to do is just generate quick shell code here.
So I'm going to go ahead and come into here and I'm going to kill the web server I had running I'm going
to paste this and instead of calling this X I'm just gonna call this Y because we have the x axis and
we might use this at a later time.
So I'm just gonna go ahead and go back delete this here and just say 10 11 for 114 which should match
my MSF console and it does.
So going to go ahead and generate that and while that's running just go ahead and get to a file server
or get to your Internet Explorer and hopefully this generates.
So then we'll just spin off our simple HDP server again and now we're going to navigate to our machine
So we'll just say 10 dot eleven up for that 114.
We should pull down the files are sitting in their I want the wider XY
K and I'm going to say this out to our startup pulled herself.
Let's go ahead and go to computer and if you don't our startup is go ahead and follow along with me
see we're going to come up here and type in program data should bring us to a new folder there we are
then we're gonna say Microsoft Windows start menu programs startup case we're going to drop its application
in the startup
and we're gonna close now all we have to do is log out just go ahead and disconnect go back to your
terminal start another hour desktop up and we're gonna log in as the other user so we're going to log
in as TCM where does it say hacker one two three.
With a capital H log in and let's see if anything happens for us would be useful if we typed in run
there we go and we have a shell now and then we'll say get you I.D. and you can see now we are TCM so
fairly straightforward in this starts to become habit after a while the big things I want you to take
away here is that we're running this ICAC ls that sexy and we're checking for the startup if the startup
has full read write execute full access then guess what we can put an application there we can have
the application run when somebody reboots the machine or when somebody logs in and then we just wait
for a shell the chances of this happening on any sort of I don't know any sort of CTF or any sort of
I don't know exam environment or lab environment probably pretty low I don't see these a lot doesn't
mean it doesn't exist but it's just another way that you can escalate privileges and something that
you should be looking out for especially as things start kind of getting iffy you're looking through
a lot of things you don't see any sort of exploitation it doesn't hurt to check the startup application
so it's a little bit niche something you're probably not going to see but something you should have
in your back pocket and know about.