Dumb user Winton is an intentionally vulnerable Windows 10 64 bit virtual machine which we will be exploiting
this operating system is a bit more difficult to exploit than the others because it's more modern and
has a lot of built in security such as memory protection.
A good bit of the security measures were disabled on this virtual machine to provide a proof of concept
exploitation get started by importing double click the overlay file click.
Import.
Now let's just click Start.
Boot up our system
once you're all booted up.
We can go ahead and click dumb user and we're going to log in with a password of dumb user.
Same case as the username and we going to be prompted with a password expiration message and we have
to change our password so change it to whatever you want.
Press enter and click okay once your password is changed
our first objective here is to get a reverse shell to access the dumb user account.
Unfortunately it's pretty difficult to directly exploit Windows 10 64 bit machines so we'll be going
with the scenario that requires social engineering and user intervention in order to gain our initial
access what we have here is a vulnerable version of FTB shell client installed in order to exploit FTB
shell client.
The user needs to send a connection attempt to a malicious FCP server which we will be setting up now.
I'm going to be showing you how to exploit this with the existing medicinally exploit module which appears
to be the most reliable and also a standalone exploit which is a collection of python scripts
switch over to your Kelly Linux VM but not on then turn it on and pause a video until it's loaded.
You're already ready and this go over to our terminal and type an MSF console.
We are now going to be setting up the meds point exploit module
use Windows or slash FTB or slash FTB shell underscore CLIA underscore b o f
now set the L host to the IP address of your Kelly Linux VM my case it's the one you see on screen and
we are also going to set the s our v host to the same IP address.
Otherwise it'll default to something else so we don't want OK now we're going to set the payload to
Windows Metro printer reverse TCB
everything looks good.
Type in run hit Enter all right.
Make sure your eyepiece are correct.
And now we have a FCP server ready to send a buffer overflow payload to whomever connects.
Now let's go back to our Windows 10 machine
double click on the FCP shell client shortcut
as you can see here it's already populated with some information I've already been trying to add a couple
of times
and tried to automatically connect.
So what you want to do here is type in the IP address of your colleague Linux VM and click connect sat
back over to Kelly Linux and see what happened all right.
I got him interpreter session opened
so if this doesn't work and it crashes for whatever reason keep trying over and over until works sometimes
it didn't work for me when I was figuring this exploit out but it seems to be pretty reliable for what
it is.
You know sometimes you're not going to get it just if it crashes and it does not work.
You don't get your session then just close out double click the client again put put your information
in here your IP address here and then click click connect until works.
So that's that's the best you can do.
But this exploit for me it worked on the first time.
Luckily this time so let's interact with our session
type and get you I.D. okay.
As you can see here we are logged in as dumb user.
What we want to do is escalate privileges to administrator.
So let's see if we can automatically do that by typing and get system.
No we cannot.
That's to be expected so let's check for insecurity configured services and see if we can escalate privileges
manually which is what I want to show you anyway.
So for that we're going to upload a very useful executable called Access C H K and I already have that
in our downloads directory in the Kelly Linux VM that is included with my course.
So let's just use the upload command and return critter to upload that file
OK.
So I've typed in wrong.
Hold on one second let me just go over here.
OK.
So it's just right here in the downloads folder.
Sorry about that we're just gonna remove that folder here's where it is
ok because access is denied.
I don't like that very much.
Let's figure out why is doing this
so I've figured out the reason that it didn't work.
Print the working directory we see we have FCP Shel Klein as the directory and we do not have write
access to it.
So what we want to do is go back a couple directories here.
All right now we're in the see directory and we want to go to users and dumb user.
You should have write access to our own user directory.
I'm just gonna background that and clear it OK so now let's try our upload command again.
There it is.
Good.
So we dropped it in our user directory and we can now use that file.
So
it's going to switch to a Windows shell just type the word shell and hit enter and we're going to run
a command to see all services that we're able to modify.
The goal here is to potentially swap out a legitimate service for a malicious one of our own creation
and I'll show you how to do that next.
If we find a proper service that we can utilize
Kay so nothing found with that
we're going to try another command to see if there are any weak permissions configured in any file from
the C directory on.
All right.
Quite a bit.
They're all in the P.C. protect directory
so I have my eyes on this executable here.
Security Service.
Daddy XY take a closer look at so we're going to use the SC command
against security service.
We're going to see the
specifics about this command.
Looks like it is running as local system.
That's very good because it will elevate our privileges if we can somehow execute a malicious binary
in its place.
And as we know from the Access check 64 Daddy exit command this does have weak permissions and we should
be able to get that accomplished OK.
We also know that it is auto start.
So that means when we reboot the system it's going to start up with the rest of the applications here
in the P.C. protect applications.
So let's just go ahead and run another command to further verify our findings here.
I cackles
running a system
very good now let's see if the services running at this moment.
So just task list their task list or slash s V.S. all right.
You're running all the currently running services go up try to find our service Daddy see their security
service study see and yes here it is
OK.
So based on the information that we've culminated at this point we can assume that security service
that EMC is going to be started from this location when booting up Windows 10.
My approach is going to generate some malware with MSF venom upload it and replace security service
that EMC with my malicious file of the same name at the same time we're going to be running a Mets point
listener so we can get a reverse shell back with administrative privileges the first step we're going
to go back to our Kelly Linux locals VM
All right.
I'm in my home directory now and I have this MSF Benham command so I have a payload that is for windows
with a 64 bit architecture and we have reverse TTP we have local host of the IP address of Kelly Linux
local port of four four four five.
We're going to format that in EMC and we have the name of security service dot EMC.
We want to replace that legitimate service with this malicious service.
Let's just make sure real quick that we are not using port for four four five
though.
All I have to do for that background the service and show options.
Kay so we're using a port four four four four four This met a spoilt exploit module so we're good we
can use the port that we just utilized in our MSF venom command we're just going to go back to our session
and back here.
Hit enter.
We're gonna generate our malicious executable
okay with the upload command we're going to upload security service dot EMC to the dumb user directory.
Very good.
Now let's switch over to a window shell and we're going to delete the legitimate security service that
EMC file or that want to use the Windows command line OK.
So that did not work must be cleared because the process is still running.
So let's try moving the file instead.
To try to move a file from our directory to the legitimate service directory try to override it we want
to overwrite.
Yes access is denied.
OK.
Still didn't work.
This is not looking good.
Let me try to instead rename the service so I have a Ren command I have the file path of the legitimate
service and then I'm going to rename it to security service.
Easy Daddy sexy
okay.
So that did not give us an error.
That's a good thing.
Me just take a look real quick in this directory.
Make sure that it is actually renamed
Oh I tried to Ellis I'm not in maternity Rochelle anymore that is not going to work so we're going to
use the dir command.
All right.
There we go as you can see here it was successfully renamed.
Now we can simply move the malicious filed into this directory
to paste in this move command as you can see here have the malicious binary or executable here and I'm
going to move it into the file path for P.C. protect and name it Security Service study XY.
Now let's set up a Metis point listener or when the malicious executable is executed it's not going
to happen until we reboot the system.
So I'm just going to make another tab MSF console and we going to set up a multi handler
so use multi force slash handler said ell host of the IP address of Cally Linux that airport of four
four four five.
This would be specified in the MSF Benham command and set the payload to the same payload we specified
in the MSF phantom command.
So Windows 64 bit interpreter
reverse TCB run that it's now actively listening for a connection.
Now back to our Windows machine.
We're going to have been shut down or slash or to restart it.
Go ahead and check to make sure you up so that command is shutting it down.
Takes a little bit but it's going to work.
OK.
As you can see here we have our maternity session.
We have system level privileges but I've noticed that it dies pretty quickly about one minute.
We only have one minute to do whatever we want to do.
I am going to try to figure out how to establish a persistent connection.
So we do not lose the C right there.
I've tried about six times and every time it dies at about 30 seconds or one minute so we're gonna have
to figure out a solution to that
OK.
I've restarted it being the Windows 10 machine and I'm going to run this post exploitation module which
is going to migrate to a nother process and hopefully that's going to maintain persistence with this
return pretty shell
as you can see here we've spawned a notepad Daddy XY and we've migrated to it successfully.
So now we should be ok
is very useful because it was dying every 30 seconds six times in a row.
It was not reliable.
Now we have a reliable return British shell so that portion of this lecture is complete.
Now I'm going to show you a collection of python scripts to accomplish the same goal of exploiting the
FTB shell vulnerability
so I have a collection of python scripts called exploits and security tools framework.
I have it installed here on the Kelly box that is included in this lecture are included in this course.
And here it is just change directory to E and we're going to type in Python.
Start by P Y that will allow us to access it over a Web browser so just loop back address.
There we go you should see the screen and I'm going to type in F T.P. that'll give us access to this
exploit which is what we want gave we're going to use a listener reverse shell using port for 4 4 four
and callback IP Kelly Linux IP click Run.
All right.
So now this is just the malicious FCP server waiting for a connection from our windows box.
So switch over to your windows box and send a connection request to your Kelly Linux box same as we
did before so here we are in our windows box it's going to open up type in the IP address of Kelly Linux
and press enter see here we got the malicious payload.
Going to tossed out over here and what I see here is an interactive shell right here in the web browser
type.
Who are my there we go.
We're currently interacting with the dumb user account and that's pretty much how it goes.
So we could do the same thing here.
Exactly what we just did.
You know you know how to escalate privileges at this point this is just to show you a different way
of how to exploit that FCP shell at FCP shell remote command execution.