Picking up right where we left off.
So let's go ahead and use P.S. Exactly.
So I'm going to say use exploit windows SMB.
P.S. Exactly.
Well say options and then we are going to be at.
I'm actually going to make this full screen just for ease.
We're going to set the R host to 1 9 2 1 6 8 57 seven 41.
That is Frank Castle's machine.
We'll set S&P domain to marvel that local will set SMB pass to password one set SMB user to EF Castle.
So go ahead and get all that typed out if you need to pause at any time if I'm typing too fast.
Just go ahead and pause.
I'm trying to delay just a little bit here but from here let's go ahead and set the payload to windows
and we'll say X 64.
Interpreter and we'll say reverse TCB and then we'll set our host to eat 0 type in options.
And we should have all of our stuff set.
So we've got the correct IP address correct domain password user.
And then we've got the.
Correct.
I'll host here.
So let's set the target to to remember that's the upload file upload we'll go ahead and run this see
if it works hand we got status virus infected.
Good job Windows Defender.
Let's go ahead.
If you're defender kicked on let's go ahead and just turn it off one more time.
So I'm going to do is I'm going to come over here and just go into defender and even though I have the
group policy in here it still comes back on for me it hates me.
So let's go ahead and manage settings in turn off.
Yes let's do this one more time.
So let's go in and run this exploit and now we have a shell.
OK.
So from here what we're going to do is we are going to look at the network.
Let's get a shell.
Let's just talk about this.
This is some post exploitation right.
We want to run a route print and see what the routing is.
On this I always do this and just check and you can see there's ten top ten top ten to zero on here
and the 1 9 2 1 6 8 fifty seven dot zero and the routing table.
So we know that there's two Nicks.
I mean the other way to look at that is just say IP config and look at that right here right.
So when I do six forty seven one forty one ten top ten top ten that one twenty eight we could say our
dash a and see what it's talking to in terms of machines that are out there and we know that 128 exists.
But look it's also talking to one twenty nine.
So we do know that one twenty ninth out there.
So how the heck do we make sure that we can talk to one twenty nine.
Well we're going to pivot here and every time I say this I think of the Friends TV show the whole pivot
scene.
If you never seen that with the couch.
That's what I think about every time.
Go ahead and google ads pretty funny.
I'm going to go ahead and hit control see here and just back out.
And then what we can do from here is we can actually just say run order out and we're just going to
say dash s and this is gonna set up a route for us to this network.
So what we're doing is we're saying hey from the IP that we exploited which was 1 9 2 1 6 8 57 died
0 such 24 network.
Go ahead and make a route from that to this through this machine.
So we're going to do that
and it's going to say it's deprecated.
Don't worry it's it's fine and weird.
Come here we added the route and then now we can say run auto route and then we can say dash P like
it says so lists all active routes.
Make sure that we do have a route here which we do.
The route is going through session one which is appropriate.
Now we can background this and we can come in here and we can do something like search port scan and
we can just say use we'll do five.
We'll do a scan options set our hosts 10 top 10 that turned out one twenty nine and we could do a pink
sweep we could do a lot of things here.
But the proof of concept is that we're just trying to attack this machine or just proved that we are
pivoting into this other network.
So we're going to do as well as we're just going to say I'm going to set the port to I'll just pick
for forty five because we know that's open and we'll just run this and you can see DCP open on 10 dot
10 dot 10 not one twenty nine.
So we have successfully pivoted into this network through this other machine and this is just one example
of pivoting.
But what's important right now is the concept of pivoting you're going to pick this up over time you'll
learn all different kinds of tools and you'll pick up your favorite tool that you like to use to pivot.
But for now just understanding the concept of pivoting and what it means is really important from a
practical level you will encounter this from time to time.
I would say it's not it's not high probability but it doesn't mean that you won't encounter it.
So understanding the concept of what it is and then learning how to do it through tools such as an interpreter
or through something like proxy chains which we won't be covering but you should read up on it's it's
fantastic it's a good topic to learn about and again that tool is proxy change if you're curious you
can utilize pivoting through a few different ways not just Metis boy but you can use SS age pivoting
as well.
SS age is open on the box and there's different tools that will do a lot of the same thing so I encourage
you to read up on the topic.
And from here that's it.
We're gonna go ahead and move into cleanup and then we'll wrap up the networking section.