Hello, guys, hopefully you guys are enjoying my videos, and in this video, we are going to create
a local user on the one or two that won't say, I want that 54 server and we are going to do that.
We are going to create a user and then we are going to give the user local admin access.
And that's because if our user decides to change his password, then we won't be able to have his password
anymore.
So that's why we want to create this user so we can add some persistent to this machine.
Now that we you know, we found out that we have a logo.
I'm an actress now.
We want to take advantage of that and create our own user so we can get into that machine whenever we
want.
All right.
So let's go ahead and do that.
And we are still using crack map or CME, and we're going to do that within an hour.
And the machine that we have local time and access is that 54 and we are using the domain use of Itzik
and the password.
One, two, three, four, five, super secure password.
And we are going to be executing some CMD commands over here.
Right?
Lowercase X is for the uppercase, X is for our show.
So in here, what we want to do is we want to do an end user add.
Um, so this means that we're going to create any user in this new user.
Now we need to provide with the user name that we want to use and then the password that we want to
use.
The user name that I want to use is just users and the password.
I'm going to keep the same password.
One, two, three, four, five.
OK, just the same as I guess I just keep this very real secure.
Let's see what happens.
The command was executed.
That is awesome sauce and we can see if if that user was actually created, we can use to execute this
command and this command of what it's going to do.
It is going to give you all the users are on on this machine.
All the local users are on this machine.
So I was going to do that and execute it and we have an error.
Um.
The command completed with one or more errors, so we have administrators that see what we did as a
net users or net user, I believe as net users with A.
S at the end.
Still, give me the same air.
User accounts for.
So we do have local admin.
Um, what if we do?
It is not use.
Why is it not working at user net users?
OK, what if we do instead of a let's just do a power show and all we can do from here is to, uh,
who am I?
Oh.
See what we get from here, do we get all of it?
So we got the apes that you saw, this woman gives you that we are the built in and still we even get
the like the.
OK, let's see another way.
Mm hmm.
Huh?
Why I.
What if we do, uh, from here, when the power from power show, let's see if we get that Deezer.
The errors net users.
I believe that I'm still not giving me that.
Is that because we created that user?
Yeah, I think that's why.
OK, so that's that's because we created that user so we could do.
Ms.
What we could do is we can just try to maybe remove that user
and.
The way that you remove a user, how do you.
How do you do that, remove a user from the world from power, so, so.
I think is just if we go over here instead of ad, let's just say specified delete.
OK, so now let's go ahead and add a different user and less historical admin.
And now let's go ahead and list the USA's.
There we go.
So the issue was that we created the end user code user and then we when we tried to do the net user,
we were not able to do that because that basically the object was attached to a user.
So that I guess that I never seen them before.
Kind of cool.
OK, so here is the user that we created.
We name it admin and the password is one, two, three, four, five.
So now this guy is just a regular user, right.
And a regular user doesn't really have privilege.
So we want to add this user privilege.
So we want to add it to a local admin user.
And how do you do that?
I'm going to show you right now and we're going to use the command line, lowercase X, and we want
to do a net local group and mean.
And so basically, we want to we want to and administrators, there we go, so we are going to add the
user, I mean, to the local administrators group at.
Let's see if that works.
It looks like it worked with no errors.
OK, so how do we verify that?
Really easy.
We just got to remove all of this over here and we can do the net local group administrators and that
will show you who is in the administrator groups.
As you can see, animals in there and monitors and there it is in there.
So now we should be able to authenticate with this user.
So you want to do a track map, one or two that want to state that one, that 54 user admin password,
password, one, two, three, four, five.
And then you want to do local.
Author and crack map.
Let's check let's start with our.
And it looks like admin password, one, two, three, four, five was the person that we gave it password,
one, two, three, four, five.
Ironmen.
Right.
And we are trying to do local authentication, but if we do a let's go ahead and pass a command and
who am I?
Oh.
And it's not so that the kitten with this.
What it would say about the.
When we passed a D for Dumaine, and this one is going to be for the domain, it's going to be just
Web.
It did not take that let's go out and see it SMB.
So that the four domain doesn't take it, that's fine, let's go in the.
Assembly lock authentication.
And.
It looks like we were able to authenticate, but it didn't pass that command.
OK, what if we do crack map exec and we do assembly and let's go out and go to the Help Command?
OK, groups, local, blah, blah, blah, spider.
Domain to authenticate to local art, authenticate locally to each target.
So it isn't there for somebody.
Let's remove all this.
So it looks like we do have authentication.
What if we do, um, look on allegation?
Who am I?
It's not executing anything.
What if we do it for when I am?
We're not erm it's not authentic to me.
What if we do there's another one that we could do is all that.
It doesn't have the X, but does it have the local authentication?
No jury is out, so that doesn't work when more.
It's saying that.
The admin user.
For some reason.
Doesn't take the OR for it, uh, yeah, it looks like we don't have access through Winmar, even though
we are if we go back to the commands.
Instead of using let's use use.
OPSEC alerts to local group administrator.
Saw, one, two, three.
Commando's administrators.
I forgot, yes, so we goes elements in there, so we do have now, um, as you can see, we do have
we just added that you or whatever, it was obvious that it's not working.
It's not letting me execute any commands or anything like that.
But we do have admin access.
And from here, what we could do, we can just remoting to the machine and we can do whatever we want
to that machine, because we are as you can see right now, we are a member of the administrators group.
So we do have persistent in here.
So thank you guys for watching.