All right let's take a look at our end MAP results.
So we've got port 80 open for each GDP.
And we've got port fifty thousand open also for HDP.
And then we've got our P.S. and SMB open.
So we have a few different paths we can take and to save time.
I'm going to take us down the correct path but we could look at four forty five.
We could do SMB client see if we can connect anonymously.
We can do more information gathering or more renumeration on for forty five see what services running
or what version of samba is running or SMB is running and see if that has any exploits available for
it.
But here in this case we're just going to run off of port 80 important fifty thousand.
So let's go navigate to those.
I'm going to copy this real quick.
Let's navigate to those and see let's do this.
We'll navigate there and then we'll also do an H TTP and we'll do 50000
OK.
So we've got two things here.
We've got Ask Jeeves.
And when we have a web page like this will probably is going to click around.
See what we've got.
We can see that just giving us a pound sign.
And here we could try to search something and it throws up this error which this would absolutely be
a finding on a pen test.
So we're seeing some sort of sequel air and it's trying to tell us maybe hey there's some sort of sequel
injection here and it's giving us a sequel server and all this other stuff except if we drag this this
is actually just an image.
So it's just a trick page.
There's nothing actually here.
So our options here and if we come to fifty thousand we could see there's a powered by Jedi which takes
us to Jedi and there's nothing there either.
So if we're sure that eighty thousand or if we're sure that port 80 is our path then we need to explore
maybe directory busting here and see where we can get.
So what we're gonna do is we're just going to run door buster against fifty thousand and we would say
door buster and like this or you can run door buster but then you come in here and you would specify.
So we would just say hey I want to run it against this and I'm going to say go faster I'm going to give
it a wordless.
So I like to actually use the built in wordless under user share and then wordless and then there is
door buster in here there's actually a door buster under the user share as well that you can use.
And then the medium lowercase list is what I use.
So I'm just gonna leave it with P HP and we're just gonna let it run for the sake of this walk through
in the sake of this video we're just gonna kind of skip ahead a little bit.
We'll look at the results later on.
But what we're gonna find here is we're going to find and ask Jeeves.
PAGE There's gonna be something like this.
Ask Jeeves and we're going to go ahead and find that directory and this is where realism kind of comes
into play.
I find Jenkins servers all the time and I find Jake and servers.
Now we have a log in so we could go try to log in with a password or credentials by C. Jenkins servers
like this where you have bills out there and you have all sort of information on like leak credentials
all kinds of things user user names.
I see API tokens I see all kinds of stuff hiding and Jake in servers on internal pen test.
So if you're watching this you have ever take a server security Jake and server but ok if we go to manage
JENKINS There's a nice little feature in here and that is the script console.
Now Jenkins is very well known for having a script console and here I'm going to go ahead and say cancel
on this and you can actually see I'm on a pause or stop this.
You can see that.
Ask Jeeves has been found in the directory.
So we have asked Jeeves.
It's already found that I'm going to go ahead to stop this.
So we have this script console in the script console runs groovy.
Now Ruby is a language.
OK so what if we did something like Google and we said groovy reverse shelf pure groovy Java reverse
shall I can't make this up.
It is honestly this easy.
Let's copy this and this will allow us to get a reverse shell with Jenkins.
So please don't have your script console open because this is just nasty.
So tend not 10 to 14 but three is where I'm sitting port 80 forty four is fine by me.
So I'm going to open up a new window and I'm going to say that cat and the LP eighty forty four and
I was going gonna run this and boom.
It's that easy.
It's really that easy.
So watch out for your Jenkins senses again.
And if you're a pen tester look for those because they are a valuable valuable resources.
So here we are.
We are on this machine and I'm going to kind of do a little bit of the numerator now and then we'll
move on in the next video and we'll actually do the escalation.
So if we're all this machine the first thing I want to do is I want to say who am I right.
OK we are.
Who am I.
And we are this Jeeves co Suki.
I don't know how to say it.
We could do the quick.
Who am I.
Slash preferred since we know that's kind of what we're looking at at this point and you kind of already
know because of the section where we're going.
We're gonna go on this path but we could see here that the impersonate privilege is enabled.
So are we all should start spending Hey impersonate privilege maybe I've got something here.
So what we're gonna do is we can also pull down just to show you we could pull down system info and
save this out to a file and run our windows privilege checker right.
So I can come here.
Copy this.
And then let's just go ahead and say oh it's actually here.
Let me do this.
We'll go to a new tab here and I'll just say gee edit this info text even though I've got this in here
paste and say and then I don't ever remember the command because it involves a little bit of stuff.
So I just type in history and then I say grep windows X place to gesture and I just copy one of these
so well to say Windows X place to gesture and then it's got your database that you used last time we
were doing this to the enumeration section a pasted in here and it's gonna run this and we're going
to see what sort of things come up so I'll make this a little bit bigger for here.
And if we scroll through this there's a lot of different things right.
But the hot potato comes up rotten potato comes up tater comes up these are all potato attacks.
So if you're seeing this this is one of the easiest ways to get escalation on a system.
We have things for Internet Explorer but those are really Microsoft Edge those aren't really what we're
after here.
If I see a potato attack I'm going to try that first.
So it's something to be thinking out and thinking for.
But I mean you have all kinds of attacks here.
So this is something that you should run pretty much right away and see what you can get.
You could also drop one piece on this machine and run one piece see what that pulls back it's gonna
pull back a lot of the same.
So don't be afraid to to look through some of these see where you can get escalation.
Now the other thing that we're gonna do because we're doing a potato attack is we're going to run Metis
for this one.
This is the most common and easiest way to do it.
So that's how we're going to perform it.
We're gonna go through and we're going to go ahead and just get a Metis blade shell really quick.
So I'm going to say as MSF console and we're going to do a web delivery so we're gonna go ahead and
just say use mall tie for use exploit multi script web delivery and here's how we're gonna set this
up we're gonna say.
Options and we have targets down here.
We go ahead and show targets we're not going to use Python w Python was on the machine.
We're just go ahead and go for power shell because this is gonna give us a power shall command to run
and it's gonna run it for us.
So we're just gonna go ahead and say set target to and then we're going to have to change the payload
because the payload is also a python.
Now I'm going to set this payload to Windows mature printer reverse TCB and why am I doing that.
I'm doing that because I tried X 64 on this when I went through this the first time and it did not work.
So X 64 does not work.
We're actually going to have to just get a lower level shell and go from there.
So we're going to an X 86 shell and if we need to migrate we will but for now let's just go ahead and
do this and then we're going to set the Al host.
So my L host is 10 dot 10 dot 14 dot three and my server hosts is gonna be 10 dot 10 to 14 dot three
as well.
When we type options one more time we should have all the settings set.
So a server host is set R L host to set our payload is set and our exploit target is set to power show.
And I'm just gonna run this and say hey give us this power shall command to run.
The job is already started in the background so we'll have to worry about anything and then all we gotta
do is come in here and just paste this hit enter and hopefully the magic works over here.
OK.
Starting a fire we should get a shell.
There we go.
So now with this type in sessions one in open up our session and here we can do a quick get your ideas
see where the same user.
We could do the this info and see that we are x eighty six on sixty four architecture so we might need
to migrate and we can also do a get Krebs we could say hey what get probes do we have.
So this is the material way of doing it again we see this in person a privilege.
This is what we're after.
Now we could run the Post that allow us post multi recon and then local exploits the gesture just like
that.
And this is gonna do that same type of checking it's going to see what's available to us.
And you're going to see that there are a couple of built in potato attacks as well.
So let's go ahead and let this run really quick.
Actually what we'll do is let this run we'll stop the video here and we'll go ahead and move on in the
next video and we'll actually start the escalation process.
So take a look at what's here.
You can see juicy.
This is a potato attack reflection also potato attack.
So two potato attacks right here.
Go ahead pause now.
Meaning the next video and we actually start working on the escalation.
So I'll catch you over in the next video.