Next up is a machine that is kind of similar to the last one.
And this is by design.
I want you to get used to practicing the basics of enumeration.
So hopefully you're getting through these boxes and you're understanding not only the lower level parts
but the privilege escalation.
So you see here we've got port 80 we've got one thirty five and forty nine 154 so similar last time
where we just have a Web port and then we have two art pieces.
So we're going to explore the web port first.
We can see those running on Microsoft I guess and it's running Drupal 7.
So those are interesting already and then you can see that there are quite a few robots that tax folders
here so we might have to explore those as well.
So we're at Ten Top Ten Top Ten at nine and it's going to copy that and paste into here
OK.
And it just says Welcome to ten not ten not ten not nine.
We have the ability to request a user password or create a new account.
These are things that we should explore and you never know what you're going to find.
So not a recognized user name or email address.
So maybe we can find some sort of user enumeration here we could try to create a new account and see
if we can log in with that account and where that gets us.
But first first things first always for me.
I want to look at the version information because before we even tried to log in here or start exploiting
this server we might be jumping ahead of ourselves.
So if you went into this path and you started ducking in or digging in right away you started digging
it right away is the correct English then you might have gone down a rabbit hole just a little bit the
appropriate step here in my opinion is that you should look at the versions does seven point five any
have any exploits this Drew Paul seven have an exploits J query or P any of this stuff.
Drew Paul is definitely the most interesting and I say that from my experience because I know that drew
Paul has quite a bit exploits out there for it.
So one thing that I would look at is I would just google and I would say Drew Paul seven exploit and
I'm probably looking for some sort of CV or remote code execution not see the remote code execution
would be interesting.
So if I could find anything in here that is of interest for me I'm definitely going to do it and scrolling
through there's quite a few of interest serialization here is one that might be interesting a remote
code execution from 20 1963 40 is interesting.
Now just to save time I dug through a lot of these.
It took me a little bit to actually figure this one out.
Now there is this dread lock drew Paul get in to hear and it's actually the CV twenty eighteen seventy
six hundred.
Now this one is OK.
I wasn't a big fan of this script itself.
This is a ruby version of the exploit.
And it didn't allow as much flexibility as I wanted.
So it looks like there's remote code execution and it gives you it gives you a shell here but it didn't
give the full flexibility of what I wanted.
So I went out and did was I said hey I want to know about this exploit and then I'm just going to see
if maybe there's something else out there and what I ended up finding was the CV twenty eighteen seventy
six hundred from the github up pimps.
So I went out to this and I can see that this had a little bit more flexibility and I say that because
we have full command execution on this machine right.
We have a command that we can provide to this and we can run commands in the machine and pull down information.
So I really really really like this one.
So we're gonna go ahead and just download this version of it and you can grab either of these I'm going
to grab the seventy six hundred and we'll just take the raw version I'll just copy and paste it over
and then we need to also install the request and be S4 if it's not already installed.
So I'm just gonna do that real quick.
I'm gonna get it.
We'll call this Drew Paul dot pi pasted in here save it and then I'm just in a copy both of these pip
install and then requests
and then I think the other one was B.S. for.
So we're gonna grab the B.S. for make sure we have it installed OK.
We didn't have that one and now this is saying to run it as Python 3 so we can run as Python 3 even
though we just installed as Pip so we might have to run as Python 2 but we could do Python 3 exploit
or whatever we just called it we call the drew Paul Andrew Paul that pie and then the IP address of
HBP ten not ten ten nine and then we'll add a command in here.
So remember we saw the command execution.
We're just gonna do a quick QMI and see if that actually calls back
and we are N.T. authority I user so it did call back on the who am I so we can get more information
about this machine.
The goal here is hey I want to pull off an exploit and the exploit I want to pull off is I want to see
if I get remote code execution but I need to know the architecture of the machine.
Now the initial one that we want to try is I like doing the fine string version however piping that
in we can try we can say hey let's do this.
And instead of using double quotes let's try single quotes and see if it works if not there's another
command that we can attempt and we did pull down.
So it works just fine as long as you're escaping is correct or you're however you're coding is correct.
You can see we're pulling down a Microsoft Windows Server 2008 our two data center six point one seventy
six hundred Bill seventy six hundred.
This is all good information now and then a 64 bit computer.
OK.
So why did I run this remember where this came from.
This came from payloads all the things and that cheat sheet is something that I use.
So when I want to pull down system info and I just need a few lines remember from one of the very first
videos here comes back into play so I don't want to pull down the whole system and I just want a few
lines.
And now we know we're up against this 64 bit machine.
OK.
So now what we're gonna do is we need to generate a payload that we can utilize and host up for this
machine.
So it's opened up a new tab and since this is a Windows machine we're going to try to load up a 64 bit
payload.
So we're gonna say MSF venom payload of Windows X 64 and we sort of call it show reverse DCP and then
we'll do a whole host of 10 that 10 to 14 not for doing Alfred a four for a three do a file type of
sexy and then we will dump that into a shell that you see.
How about that.
That should just take a second.
All right.
And now we're gonna do is just do our Python dash em simple H P server on 80.
This should just be like clockwork for you at this point muscle memory.
So what we're gonna do here is we're going to execute this command but we're going to use our favorite
command of cert you tell.
So I'm just gonna say Sir you till actually let's make a directory first because I don't even know where
we're at.
So let's make a directory of C. We'll call it C we'll just call it temp C temp C if that works or a
quick OK and hopefully we have that now.
So let's go ahead and just do a quick search Ito and we can say something along the lines of your l
cache and we'll do a dash f of HBP tend tend 14 up for Slash show.
C and we're going to put that over in C temp shall die.
See if that works OK it says it completed successfully.
That's good news for us.
So we're gonna do is we're going to open up net cat over here and we're just gonna say net cat and BLT
4 4 3 and over here we're going to execute this shell itself for this executable so go ahead and drop
that.
See if we pop shell we do.
Perfect.
Who am I.
We are.
Authority I user.
Great.
So now what we need to do is we need to see how we can elevate the shell.
Now there is a Metis Boy Method we could have taken this and gone into medicinal use the local exploits
the gesture and found an easy win on this.
So this is vulnerable to an exploit that you have seen before which is a 16 0 1 4 and that is if you
have finished the exploit there are the kernel exploit in the try hack me lab that we actually didn't
walk there.
So if you're doing your homework and finishing out things you sure saw the MSA 16 01 4.
So we're here.
We can't use medicinal so let's try something different than Charlie let's use a tool called Sherlock.
Now we've used Sherlock in the course or at least we've talked about it and it's similar in the sense
of power up where power ups looking for exploits but Sherlock itself and power ups a fine way to go
if you went that way first Sherlock is going to tell us any sort of exploit we might be able to find
from a kernel perspective or just from an architecture or build perspective and we can do the same thing
with System Info.
I'm just trying to show you different methods here at this point.
So let's go ahead and find Sherlock so I'm going to open up a new window and we're just going to locate
Sherlock so we're just gonna type in locate Sherlock dot.
Yes one.
Now if you have power shall empire install you can use the power shall empire but you should already
have it downloaded from earlier lessons in the course.
So let's go ahead and see these downloads and we're just going to get it Sherlock.
P.S. 1 and at the very bottom what you should have here is find dash all bold so go ahead and write
that in if you don't and the reason is same thing as power up when we did the invoke.
Find all bones or find bones.
The reason we're doing this is because we're gonna execute this and call it all at once.
Now we did that in the original lessons.
We did that with access to a machine.
So this time what we're gonna do is we're going to change it up just a little bit and we're gonna do
a power shell download and call.
So this download and call can be run all at once where you download it or download and execute.
I should say this file so we're gonna need to do is going to need to host up Python dash M simple HP
server on 80 and on our actual C here on the machine.
I'm going to Cedi over to the temple to recreate it and I'm going to pull over something that I will
share with you if you've never seen it before so it is fantastic.
This resource they booked I have tricks I.
They should not be new to you right.
They should have.
You should have seen this before.
You should have also seen it from the wind piece and lots of different resources throughout the course.
But here you could see that we have basic power shelf or pen testers and there are all kinds of commands
in here that are fantastic so definitely worth looking at and getting familiar with.
But the download to execute commands are great.
There's one in particular that if you look it says hey this downloads the from a command line it downloads
and executes and that's what I want.
So this just is the echo command that will download and execute this file.
So if we go into our text editor and we just open up a new tab all I'm going to do here is I'm going
to change this out and I'm going to say top for it looks like this person was using hacked the box when
they're saving their notes we're gonna just say Sherlock.
P.S. 1 copy this and hopefully this will work.
So we're going to try to run this here and I'm just gonna paste hit enter and that should download the
file we should see a hit there's the hit and now hopefully it'll start executing the file OK.
And it takes just a little bit for this to come back.
So if you need to pause while it's running if it looks like it's frozen it's not frozen.
You just got to give it some time.
So what we see when we go through here is that we've got a bunch of different exploits to try as familiar
as catch your pod.
So if we were on for example if we're on our machine we might even be able to exploit the ketchup pod
but there is one in here.
If you go through all of these and you try to exploit them there's one that is exploitable at least
There might be more but as you go down the list and I try down the list the first one that I found that
worked for me was this M.S. 15 0 fifty one.
So there is an exploit D.B. one for it but however I like to use the get hub that we're familiar with.
So let's go ahead and just do M.S. 15 0 50 1.
We'll go out to Google M.S. 15 050 1 exploit and we should have our Windows kernel exploits.
So let's go ahead and go into there.
So now we're here and let's go ahead and download this zip here.
I've tried a few of these different ones and for whatever reason this is annoying when I get to work.
So the compile version was not working if you tried that and it failed and you moved on then.
Unfortunately this is where it was at.
But maybe you found a different way to route it.
So we're gonna go in here and just download this zip on the dive in and go right to this M.S. 15 0 50
one X sixty four to EMC and I'm going to put this into my transfer folder so remember we have that transfer
folder down here
almost and drop it into here and I will explain why.
So what we're going to be doing is we're going to be transferring over a net cat and Ms 15 0 51 X 64
because we need net cat to be able to actually execute out.
So we're going to do is I've got the transfer folder up and running here.
So I'm just going to host the simple HP server
on 80 and then I'm going to do a couple of cert you to call.
So the first one is cert until you're all cash dash F and we're gonna say 10 10 14 dot for net cash
that you see.
Net cash.
OK.
So that one grabbed and then the next one I'm going to do is this one which was M.S. 15 dash 0 fifty
one X sixty four XY and I'll just call this m s 15 die C on the transfer over they'll just be a little
easier.
So then what we need to do is when you just say M.S. 15 XY and we need to give it a command so we're
gonna say run neck cat as system level privileges.
And when you do run it we're gonna go ahead and just say that I want to connect out to 10 that 10 to
14 not four will say on four four four four.
And when you do it execute command exceed and before we run this let's go ahead and come over here and
just listen on that cat 4 4 4 4 and then we're going to try to run this cross our fingers Hey oh let's
see if it works a empty authority system.
Perfect.
So this one was a little bit more complex and the last one in my opinion especially if you were trying
this on your own it might have taken you some time at least a few hours if you got it and under a few
hours.
Good job you're doing really really well.
So there are a lot of little rabbit holes in this machine especially starting with Drew Paul and drew
Paul is the web server and you could have gone down the rabbit hole of trying to create an account or
logging in you could have looked at a number of all the exploits that were out there you could have
taken the route of the really exploit that was there first before finding the pimps exploit and going
that route and then just kind of channeling this into different types of execution you could have used
the the windows exploit checker.
I wanted to show Sherlock here just to show that you have options and you can use power shell you can
use powerful download and execute.
From there we were able to do research.
Now the research for me took a little bit of time just to find the appropriate kernel exploit.
So I lost shell several times doing that but eventually I found the exploit and we were able to elevate.
So it just takes a little bit of research a little bit of time persistence.
There is no easy way with most of these protests.
It just takes time.
So you got to see a couple of kernel exploits.
I want to hammer those home that you should be looking at those from here it's going to increase a little
bit in difficulty through the next three boxes.
So buckle down we're gonna get through this.
So give the next box ago and hopefully you did really well.
But I'll see you in the next machine when we walk through that one.