All right guys and girls we are going to be working on a machine today called Devil diva.
No not I'll.
Now this is a nice machine to take a step up.
We've been mostly learning about SMB exploitation today we're gonna be learning a little bit more about
Shell co-generation and how we can do a little bit of enumeration and let's just let's not talk about
it yet.
Let's do our first thing first kind of deal.
Let's go ahead and spin up that machine right.
And let's go ahead and star and map skin some missed out a new window here and we're going to do and
map T4 dash A B and again for the second video in a row.
I've already forgotten what the IP addresses is dot five we're going to scan dot five and we will let
that scan.
So in my common stalling tactic let's talk about the machine a little bit more in detail what we're
going to be seeing today is a machine that is very common at least at the beginner levels of hack the
box.
Now the exploitation type isn't really as common.
But what what you're going to see is you're going to see a very common port combination something along
the lines of port 21 and port 80 you see that a lot where you have a Web site and you have port 21 or
you might have port 22 in port 80 and you have to leverage and exploit somewhere in order to get somewhere
else and you're going to see that here in a minute.
Now if you remember back to Episode Two We talked about FCP remember we had FTB in our machine it was
was lame right.
We did lame and we had T.P. and I talked about the staging process about having to need a place to execute
an exploit and you're going to see that come into play today.
How can we leverage FTB if we have anonymous access and how how can we enumerate what is in front of
us so we're gonna go ahead and just let this scan finish really quick.
And then once the scan finishes we're going to be be looking at it and we'll talk further into detail
OK.
The scan has returned.
So let's take a look here and as I kind of discussed we have port 21 and we have port 80 here.
Now there is a little bit of information that is being disclosed to us.
Here you can see that we have Microsoft I guess seven point five.
Why do we know that.
Well because they're putting it in their headers now on a vulnerability assessment or a pen test.
This is a no no.
This is a information disclosure.
It's a low finding it's very low.
But all this is here is information disclosure right.
It's information gathering for us.
We want to avoid this if we can.
Same thing with the site title I guess now that's beginning to tell me just from experience that we're
probably looking at a default web page if the title is going to be I a seven on the other front.
Here we see that there is FTC open with anonymous log in and we can see there are some files in here
that to me the experienced I look as if they are an i s a directory right a web root directory.
So what we're looking at is anonymous log in which again is probably a no no.
Right.
Why why are we allowing people to log in anonymously unless there's a very very good reason for this.
This is probably a ding on an assessment as well.
If we scroll down through the rest it's going to take some guesses at the operating system.
It's not a phone.
So again this isn't really come through that great.
I got some trace route.
Nothing nothing fancy.
So we're going to focus here.
So what it looks like here is we have a Web site and we've got FTB so my enumeration for a Web site.
First things first.
The first thing I like to go do is I like to go out to the Web site and we'll just go to 10 that tend
to 10 up five and you see that it is in fact a default web page for you to click on this.
It would go to to Microsoft's Web site.
Now you see this a lot during pen testing.
OK.
When we're doing pen testing we come across these default web pages a lot.
Now this signifies one of two things.
One they have a Web site out in the open and they have it running on the back end somewhere at a different
directory right.
There's probably a directory to this to a web page they're running and it may resolve to a domain name.
Let's just say Google it may be like Dad Dad Google dot com is where they're running on this web server.
But when you just navigate to port 80 or par 4 4 3 the default web page is still here.
This is a finding on a pen test as well.
This signifies that there is poor hygiene.
Right.
If we're seeing this in the other.
The other thing I should mention too is the other part of this is OK potentially when I'm a running
Web site they are just they just have eyes on for whatever reason.
Again same thing.
Poor hygiene as an attacker.
If I'm seeing default web pages that makes me think OK what other things have you forgot to turn off.
Are you a lazy person a lazy engineer on the other side that I'm up against.
Why am I seeing these kinds of things.
So because of this it makes me really inquisitive.
Right.
And when I see default web pages I think OK there's probably a reason that it's up there.
If there is then there's probably a hidden directory somewhere.
So my first thought is in this instance is I'm going to look for extra directories and my favorite tool
for that is called Door buster.
Now let's go ahead and open up a new tab now door buster stands or is short for directory busting.
And what we're doing is we're going to brute force directories here.
So we'll say directory one directory to directory three right.
We'll just try to go through a whole list of directories that we provide and see if any of them come
back.
Now we may be able to find some hidden information especially and capture the flag type stuff and in
real world situations where you run into this.
So let's go ahead and type in Dir buster.
Now I'd like to do a door buster and like this start its own process.
OK.
Another thing that I should know is there are other tools that we can use.
Door buster is my favorite.
A lot of people are big on go Buster right now.
I haven't jumped on that train.
I've used it sometimes and it works very well.
The other one that people like is called Durbin D I R B you can use either those as well and be successful
here.
So what I'm going to do is I'm just going to copy the web address and should paste in here and actually
didn't.
OK.
So we'll have to type in a GDP double dad slash slash.
And it likes the port 80 at the end like that.
OK.
On top of this I like to use more threads because we get to go faster when we do that so on top of that
we need a word list.
Here is our word this area now Kelly is very nice if you go to the base here.
There is a user folder share and then if you start typing word lists like what you find there is a worry
list folder.
So again user share worry lists inside of that is Dir.
Buster here.
And then there's word list.
Now the one I like to use is the medium but for this instance where it is going to use small and in
some cases if you're really got a lot of time there is a big word lists out on GitHub if you search
for door buster big worry lists somebody has made one says go ahead and select this wordless.
Now if we come down to the bottom down here what were we looking at.
We're gonna brute first directories files we're gonna be recursive.
That means if we find something we're going to we find one directory we're going to go ahead and go
on and try to find more directories inside that directory.
So this is great.
The one thing that we're gonna do here is though BHP is not or searching for.
Now this this is a Windows machine right in highly probability that we're running against a Windows
machine because we're running against Microsoft by us and we're gonna be running against ESM ESM exe
file extensions ASPCA aspects file extensions probably higher more probability right than we are going
to be p p.
If this were an Apache web server for example then we would be using a p p extension but in this instance
I'm going to hedge my bet that it's not.
So we're going to go ahead and say something along the lines of ESM comma ESM X comma RSP comma A.S.A.P.
x.
Now they'll search for all four extensions on top of this.
I always like to add in some other stuff when I'm doing this in the real world assessment like a text
file like a zip file backup file rar file a secret database etc. You can make this list longer the longer
you make this list the longer it's going to take especially if it starts finding directories.
Now let's go ahead and hit start on this guy.
Now I'll be honest I have actually not run directory busting on this.
I am just showing you my methodology when I see a web page and especially when I see something like
this.
Now my eye my trained eye would actually go right here to f T.P. OK so GP I am seeing a s p underscore
a client I'm seeing I start Di H Tam and I'm seeing welcome dot P G we do a view page source we come
into here and we see what welcomed at PSG right.
So we could probably replace this file with a picture of something else if we wanted to we could just
go out to the web and we can go to Google and let's just say something like cute dog.
Right.
We'll take the cute dog let's go find an image of one and let's say I want to.
I want a j peg so.
OK.
This one's a j peg I'm just gonna go ahead and say that image out to my desktop and we'll just call
it we'll call it dog J.
Whoops a dog that JP.
All right.
And this is just a proof of concept here that we are in indeed in a web folder.
So let's go ahead and do this.
Blow it up.
Ominous change to my desktop since that's where I put the file and then let's FTB over to this web or
this this machine.
I should say now it's going to ask for a name.
And we saw that anonymous log in work so we're just going to do anonymous anonymous.
OK.
And then we have commands it gets a help.
And you got a lot of commands very similar to Linux you could say less VW D.
OK you could see what directories you have access do now we could enumerate this.
We could go into this A.S.A.P. net underscore client and see if there's any files in here.
Dig deeper get information out of it just to save time purposes I'm not going to do that but just know
that that's perfectly OK in terms of enumeration.
So here let's go ahead and just do a put this just means we're gonna put something onto the server.
I'm going to put dog that JP onto the server Ellis looks like it's there.
Nice.
OK.
So now we come here and we say forward slash dog died J.P.
I don't know what happened to my wonderful picture but my wonderful picture is somewhat there.
So we know that it worked.
Right.
We could put a text file there whatever OK.
Why is this important Well this is important because we talked about this two episodes ago I can put
things into this folder but unless I have a second chain of where I can have somebody execute them or
I can execute them myself then FTB really isn't that vulnerable to me.
But what do we just do.
Well we just came in here and we executed this file.
Right.
We access this file the server read this file and we've executed it.
So what's stopping us then from putting malware onto this and doing the same thing.
And that's really what I'm after.
I want to put some malware under this machine and I want to exploit it.
Right.
So we're going to do that right now.
So what we can do is we can use a tool called MSF venom in the last episode.
We very very briefly talked about MSF venom.
And one thing that you can do is if you ever need a cheat sheet you can just go up to Google and you
could say MSF venom and know this is like you could see chichi right here.
You can do something like RSP X and just find something particular like this is one that I've been to
in the past.
You could look at these cheat sheets here there's a high on coffee cheat sheet as well.
There's a bunch in here they'll tell you like Hey if you're doing it against a Windows machine or hey
here's a recipe right here and this is really what we're after right.
Because we know that they run A.S.A.P. HSV X as an I.S. server.
So this is the type of file we're going to need.
Now this or an Apache server.
OK maybe we need an Apache payload right.
Or if it's GSP or for using Tomcat then we're gonna do a war file and we have a bunch of different cheep
cheep payloads here.
This is perfect.
So what we're gonna do is we're going to generate a payload so all we're doing is generating malware.
We are generating something that is going to say hey I'm listening on this connection use this payload
here right and this payload is going to be a return greater payload.
Remember that I told you in the last episode that if I have the opportunity I will use them interpreter
payload.
We also could just use a generic windows exploit payload here.
But what we're gonna do is we're going to use this type of payload and we're going to exploit it.
OK.
So this payload is going to say hey use this payload contact back to me.
Reverse shall right contact back to me at my listening host at my listening port.
And then let's set a file type in a shell.
So let's go ahead and type this out and then we'll talk about it in more detail.
So we're gonna do MSF venom and we're gonna do a dash P for payload.
And this payload should look familiar to you.
Right.
Windows.
My interpreter.
And then we're gonna say reverse DCP OK.
Now we don't know if this house is going to be a 32 bit or 64 bit.
So let's start with a 32 bit if we need to improve the payload we can all right so let's do this.
We'll say l hosted and then we need our IP address minus ten not ten not fourteen not twenty four we
need a listening for we're just gonna use all fours for now and then we are going to say a file type
so I'm going to say RSP X you could also do a ISP that'll be fine but aspects and then we're gonna do
is we're gonna put this all into a file OK we get this call this e x the ISP x.
Now if we didn't add this into a file here then this would print out Shell code for us and we're not
we're not at that level right now or printing out copying and putting into the things we need this to
be into its own ISP X Files so when we execute it it runs the command that it needs to and it knows
that based on the file type in the server we're putting it on is appropriate for this ISP x file type.
Okay.
So we're gonna hit Enter now it's gonna take a second to generate it's gonna put it on the desktop is
where we had it and then once it generates we need to do one other thing we need to now open up one
more new tab and then I'm going to go into Metis boy MSF console follow along with this and we're gonna
run that exploit handler now you saw all this in the last episode you just saw it done for us now we're
gonna do this ourselves.
OK so let's say use exploit mole Ty handler.
Now we really haven't gotten into net cat yet but when we do this is very similar to net cat we are
just listening right.
All we're doing is saying open up a listener.
And on this port talk back to me at this IP address and we're just me listening on that port.
So let's go ahead and just say options you're going to see that there's literally nothing in here.
So we're going to have to do is we're going to have to set a payload so the payload has to be identical
to what we just generated.
So that's going to be.
Payload of Windows and you should be able to auto tab is just a little slow interpreter and then we've
got reverse underscore DCP options again OK now let's set the L host to your IP address.
You're listening host.
The port has to match as well all for us as the default.
That's perfect that's what we chose.
Let's go ahead and run this.
Now we're just gonna let this sit here and it's going to run in listen.
OK.
So coming back to here I bet we've lost our connection.
Let's see if we have we have.
OK.
Let's say bye and connect again anonymous anonymous.
Now let's go ahead and put that E X dot aspects file on here.
We did it.
Perfect.
Another thing that I should note too is we are likely transferring the ASCII right now ASIC II.
Preferably we should transfer via binary so you type binary and then transfer your file.
I think it's OK if you ever run into issues with FTB and you're transferring a file or a payload and
it's not working.
Try switching to binary and then transferring the file again and seeing if that fixes anything.
I've had that happen in the past.
It's better to use binary over ASCII OK so we know how to call out right.
We've got a listener going we've got our malware uploaded and so we're waiting here for a connection.
Now we need to engage that malware and make the server execute it.
So ISP X X that ISP X here hit enter.
OK it engaged.
And look we just got a session that easy.
OK.
So we say sis info x eighty six.
INTERPRETER We won the lottery there we got the right write system on everything OK.
X eighty six interpreter architecture x eighty six windows 7 Bill.
And then we say get you I.T. crap.
We are not authority system.
Darn it.
So we can't do things like cash down right now.
Right.
We're not we're not system.
Now there is a tool that we can try to use called Get system hit Enter didn't work.
That's OK.
Sometimes you get wind from this but do note that in a rare occasion that actually can crash a machine
if you're doing it on a pen test.
So be very careful but one of the favorite things that I want to show you and I talked about it last
time is there are post modules in return fritter.
So what we can do with our session is we can actually background the session and then we can say let's
search for this.
We'll say search suggested like this.
And there's only one.
But look this is a post module here.
So let's copy this and we're going to say use paste this hit enter and then let's look at our options
now and look what it's going to ask for.
It's gonna say Hey all I need is this section because you already have a session.
So just give me that and I'll I'll access that session and we'll we'll do a little bit of enumeration.
So this is post exploitation enumeration.
OK.
So we're gonna say set session to 1.
Now we're going to run this.
And what this is going to do is this is going to look through all the x eighty 86 exploits that it knows
of that our privilege escalation exploits it's going to compare what's going on in the Windows system
and say hey yeah.
That might be good for this or no that's not going to work.
And then it's going to return a list of those that will possibly work for us.
OK.
And this will only take a minute.
And then what happens is we're gonna go through this list and we're going to say OK I'm going to try
the first one or the second one or the third one and we're just gonna keep going until we know you know
if it's vulnerable look I mean you're coming through.
So best scenario for us here is we've got one two three four five.
We could go through this whole list if we're desperate.
The one that I like to use we could use this bypass event viewer.
Let's just go straight for the win here I believe.
Get your pods going to work.
Get your pods pretty friendly so let's go ahead and say use paste.
Now I'm going to show you something.
Let's type in options.
Let's set the session to 1 and look.
It already has our target as Windows 7 that's fine X 86.
Perfect.
So our sessions.
Good.
And let's type in options again okay.
Look at the screen remember the screen see what happens now let's hit run.
This is not going to work OK.
We launched we launched a process we did not get a reverse shell back.
Let's type in options again look what changed.
Now payload options are in here.
Why didn't this work.
Well for me it always tends to default back to my Ethernet interface.
I don't know why it does this.
So you could without seeing the screen if you keep it in the back of your mind you could just say Hey
I know that I need my ell host to be 10 not 10 14 got 24.
And you know what.
I know I'm already on a el port of all fours so I'm already listening or I've already used that port
up.
Let's do something different.
Let's set the airport to four four four or five.
It's fine right.
Let's look at our options now.
OK.
And now let's try running this and let's see if we if we can get this to work.
So it might take a second from the first exploitation it might might take a second here OK.
And what has happened.
I've lost my session.
So let's go ahead and I'm going to control see here what we need to do is we need to setup another listener
and we could probably just tab up a little bit.
There you go.
And then say options here OK.
So I'm going to run this again.
We just need to execute that payload.
Sometimes your listener dies.
Hopefully you're a little bit more fortunate than me and yours didn't.
You can see now that we've generated again we've got the shell.
We'll be quick about this.
We'll go background you tag up a few times.
We've got the kitchen pod in there are ready set the session to two instead of one because our new session
is session to and then we'll say options and now let's go ahead and run it.
And it's possible that we killed our session with the failed attempt there.
What I actually believe happens is that it goes it tries to connect and then you potentially lose your
session because it closes out the other one to exploit it to be the new one.
So let's try this one here OK.
And now we ran the session and we're OK.
So if you lost your session like me showing you proof of concept no in the back of your mind that hey
I probably want to set an el port on these private ask or an El host as well in these previous attempts.
And then let's go ahead and say get you Aidid and you can now see that where authorities system.
So same thing as before we can do a hash dome look at the hash is we can go grab the.
The route the user whatever the flags on those not going to show you to do that we can load modules
you've seen that over and over right.
This is kind of coming becoming repetition.
So this is a great way of doing this.
My challenge to you is look into payloads OK I don't know what the command is I believe it's MSA venom
dash l might not be Al there is a payload option in here that lists out all the payloads
OK let's do a dash El payloads then and it lists all the payloads.
My suggestion is to go back into this machine and instead of running return fritter try running a Windows
reverse DCP payload or something along those lines.
See all these windows.
INTERPRETER let's skip those just run a Windows reverse TCB shall reverse DCP which is right here.
Try doing that as your payload.
OK.
And with that as your payload you don't have to use interpreter so what you can do is instead you can
just say hey I'm going to use the x fly handler I'm going to say net cat NBL P I'm jealous and I'm port
all force here and then just wait for a session to come across and that's it.
Ok so my challenge to you is to redo this exploit using it manually as opposed to using Metis boy and
interpreter and see what your results are.
So a little bit of homework but that is it for this episode.
So we we took our our scan we looked at some things and we could check real quick on the on the door
buster like I said never ran before and it hasn't found anything and that's fine.
It finished the request so you know it's always good to do directory busting.
It's also good to run Nick so if this were actually a Web site we'll get to Nick too at some point.
But if this were a Web site good to run Nick tow as well.
Directory busting of course inspect the Web site but here it was really a parent that to a trained eye
that FTB was the way to go because we had execution here we did a proof of concept with the dog j peg
and then we're able to generate with MSF and I'm a payload and then execute it here and get a shell
and then we also went in and we were able to use the s exploit suggestion and use that to get another
shell.
There's maybe a lot of information right.
This is some some new tricks that I'm throwing at you.
Please re watch the video.
Please try it on your own as well take everything and try the manual way and then try it again this
way as well.
See if you can repeat all the steps I did without watching the video just using your notes.
It's always good to have a good notebook so if you're not doing that already go ahead and start doing
that now.
But that is it for this lesson.
I am TCM until the next one.
I really do.
Thank you for joining me.