All right.
So we've gained lower level privileges on this machine.
And now we're going to start doing some enumeration so we could do quickly first a system info and to
see what we're up against.
You can see we've got the 2009 Microsoft Corporation copyrights so it's telling me you were probably
up against them like Windows 7 or even something earlier than that.
So what we're gonna do is we're gonna take a look real quick.
Just take a peek and you can see we're up against a Microsoft Windows 7 hostname of chatterbox.
We've got a Service Pack 1 on the bill.
So that might be important if we're looking for something like a kernel exploit.
Now you do have the benefit of knowing ahead of time what category we're in.
So we're actually looking for some sort of password exploit.
But we're going to continue on as if we don't know what we're doing.
So we're gonna go ahead and look here for more information.
So we're going to notate down we've got Windows 7 professional six point one point 7 2 6 0 1 and then
we've got Service Pack 1 That's great.
What are some other things we can look at.
Well we can find a quick.
Who am I.
See we are Alfred and we could say OK what about net users.
What users are on this machine well Alfred's on this machine.
And then there's administrator we can quickly check net user Alfred and see what kind of permissions
we have.
And I'm more specifically interested in something like local group membership and you could see we're
only in the users group so we're not in the administrators we're not an administrator.
So we don't have the right to escalate privileges here.
Well that's fine.
We can keep looking around some other things that we want to look at are the IP information.
Right.
So we want to do a quick IP config just see what's going on.
It looks like we've only got one IP address here we're not doing a home or anything like that.
We can do a net stat dash a..
Take a look at that really quick to and this one actually proves to be interesting so looking at this
one we see that we have an established connection here on 4 4 3.
We see the two ports that were originally in the end that scan this 9 2 5 5 9 2 5 6 the one thirty nine.
I don't recall showing up but it's saying that it's available I didn't see it.
So I'm not sure if it just didn't show up in our scan or if it's hiding from us or what's going on.
However there is a few parts here.
There are a few ports here that show up that are listening on the local address of 0 8 0 0 0 but they're
not actually open and available to the outside.
These are internal ports one being for forty five for forty five being SMB.
Now keep this in the back of your mind because for forty five SMB that means that some sort of file
share a way that we can connect but we can use a tool like P.S. exactly or like when EMC or something
along those lines that can allow us to connect this machine with credentials.
Now we don't know credentials of any user but say we got credentials somehow and that could be a little
bit of foreshadowing maybe we can utilize this port to log into the machine.
So let's take a look further and let's go out to our Firefox.
Let's go to that privilege escalation guy.
It's kind of just do a quick run through.
We've looked at the who am I.
We've got system information and we know the hostname.
We've take a look at the net users and we've taken a look at specific net users.
We're not on the domains we're not too concerned about that we could take a look at the firewall state.
We have looked at the IP config we haven't looked at the routing table or the.
The chances are we're not really communicating with anything but we can take a look at are really quick
as well ARB dash a and we're only connecting with dot two and two fifty five.
So these are pretty common here.
This is nothing that I would say is out of the ordinary.
This is your broadcast address and then your dot too is likely the router or where its routing through
and the gateway.
So nothing of particular interest there.
Next on the list we have clear text passwords.
Now we can search through this individually and go find string password and we could do one of those
long ones dot t t x email Di and I kind of do one all in the C drive maybe and kind of look through
the C drive see if there's anything out there we can look for those backup files of the Sam kind of
like we talked about in the enumeration video we can look at some of these things as well but going
to kind of skip ahead just a little bit to the registry and this could be a really quick win.
Now we could do a quick search of the registry and the reason why I'm skipping down to the registry
is because if we do a fine string and something like the C drive it's going to take a long time.
So I'm really looking for quick wins right now and then maybe if I don't get the quick win then I'm
going to start trying to hunt down something that you know might take a little bit so I might run this
step away for a little bit.
Do other enumeration while this is running etc. But the registry is pretty quick so I'm going to copy
and paste that and we're going to take a look at what comes back.
Now this is going to be difficult to look through but we're going to try to see something that might
come out as being a password I've already seen it show up.
But if you scroll through this really quick and you look like these don't really look like passwords.
But the more you scroll down and you see something along the lines of welcome one exclamation and default
password.
Now on the note of welcome one or welcome exclamation or anything along with the welcome one exclamation
lines I see this more times than I want to admit in real pen test.
This is a very very common password.
So it's funny seeing that here but it's not a coincidence it's something that actually really shows
up with weak passwords.
So going on from this we just saw that we have a welcome one and we see it's in the wind log on.
If we go back to our enumeration script take a look at the win log on down here we can say hey windows
auto log in and we've got the win log on here.
Let's query that whole registry.
This little part of the registry here for the win log on and let's get a little bit more information
so we can just do a reg query and you could actually copy the same thing right here if you wanted to
by machine to go ahead and just do the reg query command and it's going to go ahead and search for me.
Looks like a copy to space which automatically triggered an entry for us if we scroll through it.
You can see that we've got a user name two of Alfred and welcome one exclamation.
Well that's great.
It looks like maybe we just found Alfred's password and what could this do for us.
Well we don't know yet.
We don't have anything on the machine open right.
You don't have SSA or anything where we can log in to SSA with Alfred and kind of maybe improve our
shell because we're in this funky shell where I even like tab or something you know type of weird character.
It just doesn't work really well for me.
But what we can do is maybe improve it.
We don't have that option or if we had something like SMB we could do a PSA Zach Attack and try to elevate.
We don't have that option either.
And with Alpha being a low level user P.S. exact really isn't going to work for us.
So that's kind of out of it but what if for example Alfred is a user who is also an administrator but
they're just logging in as a regular account and then they provide credentials when they want an administrative
action.
That's actually pretty common.
Right.
So what we're going to think about is maybe Alfred just reusing his past where we've got these credentials
we might as well give it a go and just see if Alfred is now we're going to start piecing some things
together.
We're going to start doing a port forward and we're gonna talk about that and the thing where we need
to do to do that port forward remember the net stack and then we just do a dash.
You know again remember net stat we have four forty five open we can attack for forty five if it's open
publicly.
How can we do that.
Well we can trigger a port board.
We can say hey I want this port to communicate to another port and we'll forward it.
So how we're going to do that we're gonna use a tool called plank and I want to download the latest
version uplink because you might have issues if you use the one that's built into Cali depending on
the Kelly Linux version you're on.
So let's quickly just go to Google and we're just gonna search plank dot EMC and we'll say something
like putty download.
That's a good one.
And we're going to look for the first release here.
This shark dot green ESD or green end or that UK looks just like this.
So what we want to download is clink and if we look at what plank is it's a command line interface to
the putty back ends.
OK.
Do we know what putty is putty is just in Sage telnet client.
If you've never seen putty I've got an example of putty here and this is just what putty looks like.
You just type an IP address you type in your paw and you say hey I want to connect to that.
I use this all the time.
So we're doing something on the command line using a tool called plank plays going to allow us to run
a port forward.
So what I want to do as I want to download the 32 bit version uplink.
So go ahead and just click on this and download it to save your file and what we're gonna do is we're
going to create a port forward so what we need to do is open a new tab.
So I'm just gonna open a new tab here and then I'm going to blow this up and I put plank in my download
folder should've been where it was we could use do an electorally clicking grep on plank and you see
a plank that you see is there.
So what I'm going to do is I'm just going to do a python dash and simple HP server on port 80.
Now you can do this one or you could do the Python 3 method if that is your choice which remember we
can do it.
I'm going to run this and then cancel.
We could do Python three dash M is just HDP that server all right so I'm going to run the python to
just preference doesn't really matter.
So Python 2 is running what we're doing is we're hosting this web server.
We're going to go ahead and go in and download this file.
My favorite way to download a file is using a tool called cert you till sort you two allows us to do
something similar to like a W get in Linux and since we're in this kind of basic shell it's kind of
my go to.
So we'll do it with a C.D. over to the users folder you can also try doing it in the temp although when
I did my first run through this machine I did not have a lot of luck in the temp folder so we're in
the user folder and we should have right privileges to this.
So what I'm going to do is I'm just going to say certainly tell Dash you are all cash and then we're
going to just do a file in the files and go to my machine.
My machine is now at 10 not 10 not 14 not five.
My IP is actually changed and 14 by five we're gonna save Klink EMC and we're just call it Planck Di
XY OK we'll do a quick dir make sure plaint that EMC is there and it is now on the Cally side.
There is an important step we need to do what we need to do is we need to come in here and we need to
do a quick apt install of an SSA server so we can say Arkansas SSA age.
Now I've already got this installed and you might as well but it doesn't hurt to run this command and
see where you're at.
If you do need to install it go ahead and pause the video and just hit yes on the install let the install
happen and then what we're going to do is we're going to make a quick modification to SS H itself.
So what we're gonna do is we're going to go ahead and just say git it and we're going to edit the SSA
H SS H D config and what we're gonna do here is go into here and we're looking for a permission in here
that says permit permit route log in.
So you see it says prohibit password and it's actually commented out we're gonna uncommon this and we're
gonna say yes permit that route log in and I'm going to say that.
So what that's going to allow us to do is log in as a rule.
And here's what's going to happen.
Go ahead and do a quick service.
SSA to restart and make sure you restart your SSA service.
And actually if just to make sure it's enabled us to SDH start.
Make sure the service is started.
And let's go back to our machine.
So we're going to utilize uplink and the command looks like this.
We're gonna say plank that you see we're going to do a dash l l actually stands for user name our user
name is Root a dash p for p w actually for password and my password is Tor.
I'm very very secure a dash capital R the capital R stands for Port Ford.
So what this means is I'm going to say hey I'm port forty five for this machine.
I want to go ahead and open that up.
Remember 1 2 7 0 0 1.
And I'm going to give out four forty five to the other machine which is going to be us.
So this is a port Ford OK.
So this is going to allow us to access this machine this port from our machine.
So here's how that's gonna work if that's confusing.
Just go ahead and hit enter.
It's going to say hey do you want to store the keys in the cache just go ahead and say yes and now it's
going to get at this screen and yours might stick like this.
Just hit enter a couple of times and keep hitting enter and you can see that you're brought to a root
log in.
Now look your route actually you are in another box here in your own box but you're in the box from
within the box is like box section.
So what we're going to do is we're going to run a command now and what we can do is we could check this
and this is gonna be funky because of the box reception that we're in but we can run a net stack you
know and we can prep on for forty five.
And when you run that command just hit enter a few times until it comes through K you could see it came
through and look 1 2 7 0 0 0 1 4 forty five we are correctly connected to this machine we have correctly
port forward it.
So this is something that took me a long time to get my mind around.
Just make sure you understand what's going on here we are forwarding this port that is only open internally
to us we're allowing this connection over the SS H We're doing a port forward so now and if you need
more information on that command you can come back into this as well.
Remember I said at the beginning the video that you can come in here and you can look at this kind of
print out and look at plank and see how you can do this.
Now you can also do a port forward with maturity but we're kind of staying away from this.
Here is information on what 0 0 0 0 means all the way through if you want some reading material.
OK.
So the last thing we're going to do is we're going to use a tool called when e XY so when EMC is a Linux
based application that's going to allow us to execute commands on a Windows system.
So how are we going to do that.
Well we're going to give this a go.
We don't know yet what's going to happen.
But what I want to try is I want to say hey when a b c and the syntax is gonna look something like this
or provide a user name I must say administrator and then we're going to do a percent the percent is
gonna say Hey upcoming now is the password we're gonna say welcome one exclamation MSA.
Do this over port one at 1 2 7 0 0 1.
That means we're connecting to 445 with Winn-Dixie over the 1 2 7 0 0 1.
This port Ford and when I want to execute is command a XY.
I want to try to get a command prompt.
Now when I hit enter it's going to get it fails and we're gonna just run this through a couple of times
until maybe something happens for us.
And OK we've got a shell now what kind of shell is this.
Let's go ahead and say plasma and again hit enter a couple times and you see Chatterbox administrator.
Now this isn't the best shell to be in.
However we could run something if we wanted to improve this.
We could upload like net cat.
We can do a search you tell that EMC and then run another you are all cache upload net cat and then
run net cat on this machine and get a improved shelf who want to where it's not all funky like this.
But the goal of hack the box or any sort of capture the flag or any sort of lab is to get the administrator
or the system level on this machine.
So we've done that we've actually gotten to the administrator.
It's the same thing as owning the machine.
So this is the correct path.
If you've got this on your own congratulations that's really really awesome.
If you didn't.
Hopefully this makes a lot of sense what we did was we went.
We did our basic enumeration we didn't have to rely on any tools.
And like I told you guys we did this within a quarter of the page the first quarter the page had all
the answers for us.
So this is a good example on not relying on tools and just the basic methodology of how we can do this
from a hands on perspective and not to trust everything that you see if you just we're doing this and
use it.
Alfred welcome one that's great why do I need this password for it.
You never know where that password is going to go.
This could have gone to something like a web application or something else internally we don't know.
But if there is a credential that's being leaked especially in a capture the flag situation chances
are it's meant to be there for some reason or another.
So take note of everything that you're seeing especially with these open ports and being able to do
port forwarding and these sorts of things like these passwords they come up all the time.
So from here we're going to move on and we're going to start talking about the windows subsystem for
Linux which is something that's kind of a newer feature that just came out and we're going to see how
a mouse configuration could allow for a complete privilege escalation.
So I'll see you over in the next segment.