All right now let's say background on this session.
And we should still be in our M.S. 16 0 seventy five reflection.
So quick pause after I recorded this I realized that I went through this on my own once and was already
in this reflection.
So go ahead and type in use exploit windows local M.S. 16 zero seventy five reflection here.
This is what you're going to want to type in.
Make sure you do that and then follow along with the rest of the video.
So sorry about this small confusion here.
And let's go ahead and continue the video what we're gonna go ahead and do is we're going to just do
options really quick and I want to make sure that we have all the settings the same so make sure that
your ell host is set.
If it's not.
Sometimes it sets your eat zero instead of your 10 0.
Make sure that your output is set to all fives because currently our session one is running on all fours.
So make sure that we set it to all fives or any port of your choosing.
And lastly let's go ahead and run a 64 bit maternity reverse TCB and hopefully this will work for us.
So go ahead make sure you set your payload.
Make sure you say you're Elle host.
Make sure you set your airport.
Make sure your sessions correct and go ahead and run this.
Let's see what happens.
OK.
And we get a return fritter session.
Beautiful.
Now let's load incognito.
Let's list out our tokens and you can see now we have the impersonate token.
So here we go.
And a copy this and we're just going to say impersonate token and I'm just going to paste this like
this.
You can see we have impersonated user authority system.
I'm going to drop into a shell OK.
And then I'm going to C.D. over we actually we can say who am I.
Quick.
We are authority system.
I'm going to see these over to see users administrator and then to desktop do a quick Dir.
And you can see that there is this file H.M. dot text.
Now if you're used to hack the box there should be a root flag here.
So if we type out a gem dot t t we see there's no red flag.
So we're going to do one more video here.
Figure out how to find this root flag we you talk about alternate data streams and then we'll cap out
this section of the course.
So I'll catch you next video briefly talk about alternate data streams find the root flag and own this
machine completely.
So you over there.