OK.
So here we are.
We are ready to figure out this escalation and we know it has something to do with the windows subsystem
for Linux.
So what can we do with that.
Well we have a little cheat sheet guide.
We talked about it and we know that w SL that EMC exists in Bashar e XY exists so we could try to find
both of those really quick.
So if we go to our terminal and we say something along the lines of where we do a dash are just means
recursive and we're going to look in and see and I'm actually going to expand it to Windows.
I think it's hiding in windows somewhere and we'll do a bashed out you.
Now you could use a find or any other command that you would like against this.
This is just how I use it to quickly find it.
You can see there is the bashed out EMC and we could do another quick one of these where I copy this
and we'll run it against the W S L that XY and see where those are hiding.
Let's do a quick one on WFLD at EMC and I'm guessing it's in this when s x as folder as well because
that's where everything else has been related to this Windows subsystem for Linux.
So you can see the w a cell that XY here we can go ahead and run pretty much any of these and see what's
going on.
The Basha you see will bring up a bash command prompt.
But remember we could do something quickly like a who am I on this w cell that XY and C.
Now we can do like a quick paste and say Who am I.
And it should return route and you can see there did return route.
Now remember I told you that you can't run this but if you could w a cell Python Daschle you could run
a python reverse shell or even a bind shell here and open up a port.
However that's not the method of exploitation here.
That's what the true escalation that we're going to do.
So let's go ahead and just run the Bashar XY and drop into a command prompt here well a Linux terminal
I should say OK.
So it says teach you why name failed.
Inappropriate.
That's fine.
Let's just say Who am I.
Root hostname.
And we're on set nodes.
But don't let this fool you.
This is just the Linux SEC notes so you can do a quick you name dash and see what we're on we're on
a Linux machine for Microsoft.
So we're on this subsystem for Linux.
Now we are in a non Titi y.
So what we need to do is try to elevate or escape here and we're going to do a quick python and do a
dash C and we'll do import peachy y and we'll do P.T. y dot spun and we'll go ahead and give it a bin
bash and see if that works
Now you can see we have the route at SEC notes have you ever are concerned with t y escapes you see
something along those lines you could do a t t y escape and Chichi is usually what I go with on a search
spotting a T2 I shell this net sector.
W.S. here is really really good.
You just come in here click on it and you can see here's where the python command came from.
I just did a bash instead of an S H there's echo there's all kinds of different options to try to spawn
82 y shell.
So now we have a t t y shell that's great.
Now we haven't done any sort of Linux enumeration in this corpse because it's a Windows course.
But some of the quick things that I like to do when I'm looking is I like to get a lay of the land and
just say Hey what's my present working directory.
I'm in route.
OK are print working directory to it Ellis Dash.
L.A. we could see OK well nothing going on here.
We do have a batch history which we could try to type the history command or just try to cap that out.
I always check the history command.
That's one of the first things I check when I'm doing any sort of window or Linux privacy.
I also do like a pseudo dash l.
However I don't think that I'll run here.
So I already see something very very interesting and this is actually really common.
If you're doing sort of like Linux Pervez stuff if you do history you can see easy wins in history all
the time is one of the quick wins.
Look at this command here SMB client dash you administrator here's a password here's a 1 2 7 0 0 0 1
seed.
Well we can run this command.
This is this is it we win we're we're going to get root we can run this command and this will give us
a our access to the file system.
So let's take a quick look I'll show you.
If we just open up a new tab and we just paste that really quick and we give it the IP address instead
of local we give it the IP address that it wants and we just say what else did it ask for anything.
Wants us to see drive use a C and unless you can see OK we've got full access over this system but that's
not really a shell.
We could go in and we can get the.
The flags are trying to capture the flag here.
That's that's not the true way.
So let's go ahead and exit out of this.
Again I mentioned impact it before and I mentioned P.S. exact.
Now I realize that maybe you've never used impact.
It is expected that you know what it is at this point because this isn't a beginner level course fully.
So I'm going to go ahead and just show you really quick so you can go in packet get hub if you've never
heard of this.
This secure off Corp right here you just click on this link very very easy to install.
You can just do a quick clone or download grab this link here.
I always put this in my opt.
So I would go C.D. slash opt.
I would say get clone paste this in here I'm not going to actually do it already have it hit enter on
that then you can see into your impact folder and you could say Pip 3 install period and it will install
it.
Now I think the original calls for Pip install if you're on Cally 20 20 or later you're not going to
have pip installed by default because now Python 3 is the way to go.
So let's go ahead and imagine you've done all that or you have it ready to go.
Let's take these credentials and try to do something with it.
Now we did the P.S. exact before and we can try it again.
I'm going to show you this is actually very real world.
So say you tried to do P.S. exact it's an easy win you could do administrator and we can say something
along the lines of paste that at 10 dot tend turned ninety seven OK it's going to try to connect it
found the admin rightful share that means we have added privileges we can write to the admin share it's
amazing that's what you want to see except what do we have happening.
Looks like we have some sort of antivirus blocking this again.
This is very common.
So if I were to see this on an assessment I'm going to go ahead and try to kill this and maybe we can
just do something else.
So there's a few different exacts.
There's an SMB exec which does very similar thing gives us kind of a half shell.
So I'll try a W or SMB exact here.
Another one is called w my exact I always try all three.
You never know where you're going to get lucky and now you're in this semi interactive shells.
You could say who am I and you're going to return authority system.
So we are system on this machine.
We do have a full shell we have full control we can utilize the net cap that we found.
Go spawn a quick reverse shell and get another shell on this if we want something fully interactive
as opposed to the semi interactive.
But at this point this is full on edge of this machine.
So I hope you were able to take it this far if you weren't.
That's OK.
You're in this class to learn so keep challenging yourself as we go through these challenges the challenges
are to get a little bit harder as we go up until we get to the lab section of our course and then into
the Capstone.
So from here we're going to keep doing walkthrough and we're going to try to build up that mentality
of how to do enumeration and you'll have a little bit of hints to kind of go along with it and then
you'll build it all up as we go.
So keep challenging yourself.
This is a struggle that's absolutely OK but I will see you in the next section where we're going to
be covering impersonation attacks and this is some of my favorite I gets down to real world and some
of this and we're going to do one of my favorite hack the box machines as well.
So I will see you guys in the next section.