OK so now we're on the machine and we need to escalate.
So I'm not going to show you the enumeration process.
I think we've hammer that pretty hard at least from a power up or a wind piece perspective or how we
would define this.
We're on an already P section which gives us an advantage that gives us the view advantage we get to
click around and really look at things like a regular user would.
So what we can do is just look at what's in front of us.
Anytime I have an already P and I have a session that's intentional through the machine that I'm going
to look around because there's probably stuff here that the creator of the box wants us to find.
One thing is in the recycle bin we found that h h you PD dot XY.
Now we have no idea what it is but if we go into Internet Explorer and we start looking around there
I like to snoop so internal explorers on the first things I look at or your browser or anything because
I want to see what you're looking at or if you had any data you're hiding or anything.
So Internet Explorer is a great place to go look and I just look through the history here.
Favorites are a great place to look to sometimes box graders or put information in there or little bits
of little bits of hints.
So this is what we're getting here is we're getting a hint in the history.
If you look at the next dot gov they're looking at a CV 20 19 dash 13 88.
Now if you looked at that Zero Day Initiative video it said hey we need this h you PD that you see.
So my guess is this person thinks that there is this escalation opportunity here and they are playing
around with it and then they delete the file but they actually didn't cleared out completely.
So what we're going to do is we're just going to restore this file.
This might take a second because this box is kind of slow but go ahead and drag the file to your desktop
and now let's make sure that we close out of Internet Explorer.
This is critical let's close out of Internet Explorer.
The reason being when we run this exploit it's going to spawn Internet Explorer for us and it's going
to spawn your next door running as systems.
We want to make sure that it's all closed down.
So now we're gonna do is we're going to right click on this age EPD and you want to double check the
properties and make sure that there is no security feature here if it is just go ahead and click on
block and then we're going to right click on this and say run as administrator.
Now we're going to get the UAC prompt and this is a prompt that we've all probably seen before.
It says Hey you don't have permission to do this.
You need to run as an administrator.
Now if we click show more details here we'll see that there is show information about the publisher's
certificate.
Here is where the flaw takes place.
When we clicked on this issue by and we click to see the certificate what happens is this opens up Internet
Explorer and it opens up Internet Explorer as system.
So when we navigate to Internet Explorer now that he's gonna be open it's gonna be running a system
and we're going to be able to pop a system level shell doing this.
So let's go ahead and just hit.
OK.
Here and Internet Explorer should be running in the background.
It's going to go ahead and hit no here you can see that it's trying to load this very sign.
So I'm going to do is I'm just going to click on this little wheel here and select file save at
Interior you're going to see that this air pops up we're just going to ignore it OK.
So what we're going to do is we're going to go ahead and just type in here.
We're gonna say see Windows system thirty two and then we're going to do an asterix dot Asterix Asterix
period Asterix hit enter and it's going to say hey look here we're going to have all sorts of files.
So one of the files that we're gonna have in here is going to be the command the CMT so scroll up just
a little bit.
And you'll see is here.
We're going to go ahead just right click on that and say open.
We're going to type in.
Who am I
and you see that we are authority system.
So we have elevated this machine and this is crazy because this was a twenty nineteen late twenty nineteen
exploit.
So this is relatively new this is something that you still will see on perhaps some older machines or
you might see this again in any sort of CTF environment.
This is a really really nice one really new one and it's neat because it's something that we see all
the time and it just opens up this Internet Explorer for us and all we have to do is open up a command
prompt.
Super super easy.
So hopefully this is valuable for you.
From here we're going to move on to the capstone of the course.
I'm really excited.
So I'll meet you over the capstone of the course when I explain the challenge and what we're going to
do.
And then we'll move on from there.
And we're nearing the end of this.
So hopefully you have been enjoying this so far.
I'll catch you the next video as we talk about the course capsule.