Hey everybody welcome to part three of the Mets point mini module.
We're gonna be going over the interpreter and going over some of its features and the full scope of
what you can actually do with this.
Now keep in mind this is just one type of payload but the Turpin Air has so many different uses that
it's always a good thing too.
If you have the room and you have the ability to use it it's going to make your job significantly easier
down the road depending on whether you're going for stealth or not so the first thing I want to show
you guys is the mayor's point interpreter and in its working form.
So we go ahead and re exploit the same machine that just a second
means dash for perfect.
So now we are server to go ahead and look at the health functions.
So we've got a few things here.
We can get the we can do timestamp which changes the timestamp in different Mac attributes of a file
which can be sometimes important hash dump is an interesting one.
So if we look at hashed hash dump this actually dumps the hashes for the system so we can do things
like pass the hash for the administrative passwords.
So this is always a good thing to do once you gain access to the system.
You'll need administrator to run hash dump it because it won't load.
It'll tell you that it has failed because you don't have the correct permissions.
But we'll go over that right now in our case if we do get you I.D. which tells us what user logged in
as we're entry system authority because the service running happened to be running as administrator.
However there's a quick way on unpacked systems and some even patch systems where you can use the command
get system.
Now get system.
I'm not going to go into exact detail because there's a lot of different things that can that can go
wrong with that.
But essentially what it does is it tries multiple different known privilege escalation methods and tries
to gain administrative access from standard user using get system.
Now we do get system right now we're already anti administrator but it's got the technique one so named
pipe impersonation now as a tidbit that I want you guys to do is go out and look up what get system
does.
There are few resources on it but it is out there.
And once you find out what for example in this case technique one is named Piper impersonation.
So go ahead and find out how that works in detail so you can get a better understanding of what you're
actually trying to do because in some cases get system might be let's say you don't want to use it because
it's too invasive form the system that you're running with.
However if you know how to do or have code for how to do each of these techniques yourself you can do
them in a very specific fashion to where you might not cripple the system.
So let's take a look at some more of these options so we can place or allows us to play an audio file.
Nothing written to this.
That's kind of interesting.
We can record the mike.
We can start a video chat list any web cams grab a snapshot of the webcam and stream this this so you
can go pretty pretty in-depth with a module and this is all stuff just built in by default we haven't
gone in the post exploitation stuff yet.
So if you go a little bit up what we can do here is we can enumerate the desktops to see what windows
are open and what workstations have been opened.
So that kind of gives us a better idea of someone's on the system directly.
So what does that include desktops in Room desktops
so we can see here we have default disconnect when I log on and I say desktop OK that's fine.
That's cool.
That's pretty standard for one person logged in so we can get the cat to get the desktop the interpreter
desktop so whatever desktop happens to be open at that point in time we can get the idle time.
So the last the remote user has been idle.
So in this case I just moved the mouse so it wouldn't say much but I don't time
so we could see here.
Thirty eight seconds the user in this case was idle which can sometimes be important because you don't
have to do anything on the screen or manipulate anything to get that answer.
So no one's touched the machine in a while.
You don't see a video or a web browser open.
Chances are they might not be standing at their machine or logged in so it's another thing here is key
scan and start stop and dump.
Now this is pretty interesting because you can actually key logged the user so you can run and have
it open up a Web site of your choosing.
So you can there's an exact command that you can use directly inside of interpreter that you can launch
Firefox Internet Explorer and have it point directly to a particular page or open a new tab or redirect
a current user you can do a lot of things with this.
But what's interesting is you can hook this into a phishing attack so that way you start capturing the
keystrokes or you can wait until they open up a web browser with a banking account information or anything
like that and then start key start the key stand start and then 1 give it like 10 or 15 minutes and
then stop it and then dump it.
So then you can actually get the keys that were that were pressed in a.k.a. the user name and password.
So we can even take this with the screenshots so we can interact.
We can actually go and grab a screenshot of the desktop.
We can also set whichever desktop we want to look at and then we can control some user interface components
if you want to make things pretty obvious.
So that's just user interface.
So let's let's take this a little bit further as you guys can see here there's a lot of options available
in the maternity show and this is all just stuff there by default so we can clear the event logs all
of the windows logs that are on the system that are run in the event viewer or we can clear them instantly
we can drop tokens so we can stop any impersonation tokens which we've gone over impersonation tokens
and what they're actually used for.
But in this case we can impersonate administrator or a different user entirely.
So we have a execute which you'll just execute a command as if it was on a shell on there and get the
environmental variables which is that's pretty standard if we want to know where temp is and everything
like that get PD just gives us the process identifier for the current process where attacked where it
currently attached to some interpreter does not spawn its own process it sits inside of a currently
running executable.
So in this case the SAC is what we exploit it.
So it's currently sitting inside of that process so it would we would get that PD get probes and it
basically attempts to elevate its or not elevate but attempts to enable all privileges allowed to the
user in that current process.
So if you are not an administrator but your process is let's say it starts off by default it a very
simple simple permissions.
Maybe it doesn't need to open a socket or anything else like that.
It just lets say a web or a word.
As an example.
So word doesn't need a whole bunch of privileges attached to it.
However what get privacy does it turns on all the privileges available to a process and depending on
the privileges that were enabled we could do certain things or migrate to a different process or throw
it in debug mode depending on what we're trying to do get the sides and get the UI of the user that
we're running on.
Pretty self-explanatory stuff.
We can kill a process get the local time P grep so just filtering the process by its name.
We can kill the process list it reboot it.
We can actually interact with the remote registry so we can change registry entries if we want to.
We'll leave reserve to self revert to self alone shell which is another interesting one which if we
type shell it brings us directly into a prompt for the machine stealing tokens.
So this is another example we we are taking a copy and using an impersonation token from a different
process to spot to be running as that user instead of our current one.
So what we'll do is loose shell.
So again we do shall we get our actual shell.
So we have our system right now on top of this.
There are post modules that we can do and what's important about these post modules is that you can
do different things depending on what you want to do.
So you can scan it do another scan against the network or port scan disk or see what host or live through
a different one.
We can add users to domains there's a lot of things.
So to run a post module you will do run and then whatever the modules path was.
So to get a quick look at that we can do post slash and then hit the tab button and we do want to display
all of the abilities.
So if we look here we can see we can check for malware we can brute force DNS.
We can do look ups.
We could check the environment variables.
We can cache we can dump the DNS cache windows auto log and we can grab credentials so depending on
what we want to do.
So if we want to look at just windows right.
So if we do it all down at the bottom here
go too far too far.
Stop.
Well that's what happens when you're VM lags out run post windows so let's take a look at these options
hundred and seventy five.
That's a little better so let's see here.
So we're just looking at windows.
It looks like we have a manage when recon we've got gather.
So gather seems to be the generic set for us to look at.
So let's oh let's see here now.
Check the m.
So this just basically checks to see if our machine is a VM.
So if we do let's say gather then check the
so we can see after we ran that post module what it did was it loaded the check VM in the memory and
then actually runs it inside of the same bit of memory.
So we can see here it is a sudden virtual box virtual machine which is cool.
So what I want you guys to do is take a second to look through all of these.
I'll show you another way to view a larger set of them.
But this is a good way to kind of get an idea of what you're looking for.
So gather credentials so depending on what you're looking for could be looking for specific things memory
or could be looking for things and registry keys common configuration files the auto log on.
As an example if you had auto log on set up your credentials are stored somewhere.
And it goes ahead and does that.
So this can be very very very powerful.
But there is one post module that I want to turn your eye to specifically.
So if we do run persistence.
So what we've done right there is we've set up a persistence show.
Now what this is going to do is it's going to it created the payload firm interpreter reverse connecting
back to us.
And what will happen is is this will run when the system restarts and every time it restarts it'll go
ahead and try to connect back to us.
So there's a few options where we can change this out but I'll leave that to you guys for an exercise
for you to look up the persistence options that are available and to find out how to set it up when
a user logs into the system or different variations such as that.
But what we've done now is we've made it possible for us to keep access to the machine so take some
time with this look through this a good way to to test this stuff out is to create a virtual machine
with Windows XP Service Pack 3.
So there's quite a few ISO images out on the internet for that so I'll leave that to you guys.
And what you can do is you can load up that same software that sits back.
So if you look at the exploit DV link which should be in a few previous videos you'll see that it has
vulnerable software link at the top right of it which comes with an installer.
So you guys can go ahead and install that software run it and then you can exploit this system exactly
the same way I am.
But make sure using Windows XP Service Pack 3 just again try to find that on the Internet.
I'm not going provide an ISO for that since it's technically not available from Microsoft anymore but
there are quite a few ISO it's just kind of lingering around.
So go ahead and set up that VM attempt this whole exploit from start the last video all the way to this
point with persistence and then play around with some of the options.
So you guys get more familiar with how the process actually works.