All right.
Are you ready for your first exploit.
I'm super excited about this.
So first we're going to start with Meadows boy and just see the power of Metta splitting what is capable
of.
After that we're going to shift off into the more manual exploitation.
So remember we ran the Post multi exploit to gesture and we got quite a few of these that came up.
Now what's happening is it's saying hey I think that this machine is vulnerable to this bypass UAC of
endure and cut your pod in this schedule elevator.
Okay.
And for me from personal experience the ones I like to target are some of the earlier ones.
This kit your pod seems to always be a winner for me though in this you might want to do a little bit
more enumeration make sure but if you're like a CTF or even a you know like one of those environments
you can just kind of copy these and fire away and see if it works.
I always recommend firing a couple of times.
We're going to go ahead and try this exploit a couple times see if it works for us.
Now if you're interested in learning more about catch your pod and why it's vulnerable if you're into
that nerdy nerdy stuff which I know a lot of you are here is a write up on it from cyclist dot org.
I will link this in the resources as well so you can come in here read exactly why it was vulnerable
what was happening and then if we come into the affected software you can see that it affected all 32
versions of Windows and T including Windows 2000 all the way through Windows 7.
So upon successful exploitation that kernel stack a switch to an attacker specified a duress.
OK so let's go ahead and try running this.
So what we're gonna do is we're gonna background our session in minus session nine so this notate whatever
you have and then I'm going to say use.
I'm going to paste the exploit windows local and ask 10 say options.
I'm going to set my session to nine and then I'm going to set my L host to tunnel zero and I'm going
to set my L part to 5 5 5 5 because we exploit it on 4 4 4 4.
So let's make it a different port here.
Let's try running this.
See what happens
gay didn't let's do options try and see what's going on and see it's still set my L host back let me
go ahead and set my L host one more time back to tunnel 0 I'm going to run this again
You could see it ran and we now have a shell and interpreter session actually lost my session in the
middle of recording so I actually went back if you saw a little bit of video editing magic there but
went back so session 10 and then session eleven is now this we say get you I.D. we can see we are authority
system so if we go into shell we can do the same thing and say Who am I.
You can see where authority system we now escalated this machine so we took advantage of the post exploit
suggests or we took a well-known Colonel exploit and we utilize it to elevate our privileges and we
used it all through interpreter very very very powerful we had a shell very easily we had full control
of this machine very nice very easy and then all we had to do was set a couple parameters run it and
then guess what we elevated the system very easily.
So you're going to see some boxes like this when you're doing CTF or you know the capture the flag hack
the box try hack me whatever site you're on if you are wanting the quick win and you can use medicinally
in your environment this is a great one to utilize very very great one to utilize one of the first things
I'll try if I'm in an environment like that if you are trying to avoid using Metis blight then we will
cover that in the next video on how you can do this from a manual perspective including getting the
shell we're going to completely go backwards we're going to we're going to get a new shell in net cat
and then we're going to elevate from there.
So I'll catch you over in the next video we do this all again manually.