Hello, everyone.
My name is Steve Allen.
And now let's take a practical look at an example of scaled down
software and attempts to exploit it using Metasploit.
In this case, we will focus on exploiting a data see relevance
Server 2.0
system running on a Windows XP platform.
So this service operates on Port 912 and possesses
the ability related to buffer overflow with the s printf function.
Now let's actually make our though Windows
XP will
smaller make it on the right side
here.
And also we had some text here.
Yeah that's it.
And now what we're going to do here
is go back to our attacker machine.
So here so this is printer function,
utilize in data, see real events. Okay.
The service source code is responsible for constructing
a specific string based on a user input.
So when a malicious manipulated by an attacker, this vulnerable function
kind of leads to a complete compromise of the target system.
So now we will use the exploit real win as piece s
c pc initialize exploit because it specifically targets
vulnerabilities within the real win scalar systems.
So use, exploit, use, exploit windows
scale the real one actual.
Can you hear my voice? Yes. Perfect.
So real win
SPC p initialize.
So exploits windows.
Okay.
The real win is now s c p c
initial size here and let's show options.
And as you can see here, it automatically selected the method
operator, reverse shell for us and they will explain that right now.
So the real win is c, p, c
initialize exploit is tailored
to a particular scalar system.
Reopen By focusing on a specific system, we can better understand the intricacies
of that system's vulnerabilities and assessment its security accurately.
So real win scalar is a real world
system used in industrial and critical infrastructure settings.
So by testing its security, we simulate scenarios that are relevant
to our actual industrial environments, helping us identify and mitigate one
the realities that could pose significant risks.
So this exploit provides an educational opportunity for students
and penetration testers.
It allows them to gain hands on experience in identifying,
exploiting and securing vulnerabilities in the system,
which are crucial for safeguarding critical infrastructure.
So the exploitation of the system is
in infra infrastructure or control systems environments is growing concern
due to the potential impact on public safety and the economy.
So by using this exploit, we can assess the security of ICE's as components,
helping organizations identify weaknesses and develop stronger defenses.
So this exploit aligns with the specific vulnerabilities
found in the real world Skater Systems, demonstrating the importance of tailoring
penetration testing to be unique characteristics of the target environment.
So it emphasizes the need to use relevant exploits for effective testing.
And in summary, using this, we exploit Windows Skate.
A real win as CPC initialized exploit is vital in
ISIS environments because it provides a targeted real world
and the crucial approach to identifying and addressing vulnerabilities
that could have severe consequences if left unaddressed.
And we will also use the another exploit for better
for deepening our understanding here.
So now we will need to set our hosts here in this step.
We will be going to specify the target
machine's IP address as the value for our host.
In this case, our target machine was let's actually see the one line.
Yeah, one four, two and one three is seven.
So set our house here.
192168142
and 13813137 here.
And after that let's actually show the options here.
We have set the output that we didn't set.
This is the default here.
This is a list import for an interpreter here, a payload here
and we will also changes and here module options We had we have set the our host
so we will not change to our port here because this specific protocol,
this specific service uses this nine
one to TCP port.
And here we will also need to choose the payload.
So the payload is a piece of code or software
that we want to execute on the target's machine.
Once we have exploited its vulnerability here, we will choose the windows.
Metal further binds to the raw payload here.
So we will what we can do here use payload.
Use payload here.
It was use
or use the bind
TCP, your reverse ECP here.
But I think, however, the PARTICIPE is more reliable
for this kind of jobs.
Yeah, sure we can use this binds TCP here.
So said payload windows here.
Local operator multiple other bind the ECP.
That's it.
Here we have our set this payload
and here
the default for data serial and skater here so show options
so the default port is 912
so a partial so if you don't know what ports our ports are like, doors
through which data enters or access a computer or network.
So in this context, the Port 912
is the communication channel that this okay the system uses.
Now let's explain the overall goal here.
So the objective here is to exploit a nonlinear ability in real one
skater system running on a target machine with this IP address here.
And we want
to leverage this linear ability to establish a connection to the target's
machine remotely giving us control over it.
So to do this, we have selected this specific payload
which is designed to create a backdoor on the target system.
And once the payload successfully executes, it opens
a communication channel on Port 912 912 so that the fourth port data serial.
Vince Carter this is the port for data C stadium.
So this will allow us to remotely access and control the target machine completely.
Now we will need to proceed, proceed with them
with the exploitation, exploiting the targets
to determine whether the vulnerability can be leveraged successfully.
So this action will help us assess the security of scalar systems
and understand any potential risk associated with this vulnerability.
Now, let's presents here, and as you can see
here, the started by intercept handler.
Now we gained this method predator shell here.
That's perfect.
We have successfully exploited this.
Now we can do
our things here, like we can set the law to the
we can set that, we can use this
and a lot mimic and mimic cats here.
So the first step involves involves
loading the mimic cuts model into our metasploit environment.
So this module is a powerful tool for exploitation tasks,
particularly in particularly in extracting and manipulating credentials here.
So we will load the we will load the mini cuts here.
So a lot of mini carts
here. And as it is a mimic
that has been replaced by Kiwi police, use this in the future.
We can also use the Kiwi here
that doesn't have this.
Actually they are they are almost the same here.
So and here
as you can see here, after loading the mimic Cats model,
we can utilize one of its specific commands here, which is Kerberos, Kerberos
or the so how
how and the we have lists all Kerberos tickets.
We have all of these commands here, hash dump
play.
Let's actually
we let's actually get the screenshot here
screen so
let's see that screenshot.
And as you can see here,
we got the screenshot here and we can also play this.
This is fun.
Actually this so we can
let's see what we can do.
As you can see, we have a bunch of actions
we can do here for the system command so we can read the contents
of a file to the screen, the corporate working directory and so on.
We can also set the display interfaces, display the network connections.
We can we have the system commands, we can clear the event log.
This might be useful in some cases
and we can go to get the system assist info here.
This will give us the system for the interpreter,
Windows, Windows version and computer name
and the quick commands.
We have the TV commands or three of our credentials use Kerberos
ticket purge and the In-Use Kerberos tickets.
There are three user account information in it.
We have DC as here
credit retrieval credentials.
Let's actually use the scripts all change.
We can also change the password or hash of the user.
Kerberos kick
kerberos ticket.
The list
we have not kerberos tickets for now
hashed on.
We we now we have the hashes
of administrators guest and the help, assist and support.
So if we are in a newer systems, you might
like Windows ten or 11,
there will be problems for getting
the plaintext password from the system.
In this case, we can also get the passwords completely
because it's an old and vulnerable machine.
In today's world.
But however it doesn't we haven't modified this specific Windows XP here,
but it's old and it hasn't
had security patches like more than ten years.
So as you can see, we have the hashes of an administrator guest and support here.
We can also get another here so we can also brute force
this hash hashes with John the Ripper, which we will do that
in the next section of our course.
We can upload a file or a directory.
We also have the networking commands,
we have the system commands,
we have the user interface commands, remote user in the real time.
Yes, let's actually use the screen share.
Let's see what it will give us.
And here, as you can see here, let's
can you see on the screen.
Yeah.
Now let's see what will happen.
And as you can see here, we can see this screen
real time here.
Google dot com.
And this you can see here we have
we can do all kinds of things here and that's it.
That's good exploitation here. Right?
So by following this steps, we can effectively load
the mimic hats model and use models.
All of the models here almost.
We can also go like, you know, you can stop it now.
Yeah.
So as you can see
here, we can uncover the system plaintext passwords, also
electronic and cover these passwords with Kerberos here.
I think we missed something here now
so we can get disk variables.
Creates all rights, all here.
Now you can see them D here.
Kretz Marble
y files.
We don't have wi fi on this specific system.
Cat use whose Kerberos ticket
retrieved Elm
creds.
Let's see
what's
this be?
And so on.
You can also have another
means here get elevate your push yet system
you can go to show.
And as you can see here now we are on the window system
simply here
that's it.
We have successfully
hacked the system and here
we now don with this lecture.
In next lecture we will have more specific and comprehensive
penetration testings from now.
So I'm waiting you in next lecture.