All right.
So let's see how we can buy that pivots.
What's the right spelling for that so how can we do some lateral movement over the system and the network
using the legitimate third rail ball on the compromised machine.
So for this demo to be more a little bit more realistic I will use the batch file.
Yeah the power show batch file that I've created using real invasion framework I will.
You will see the demonstration to separate them for antivirus evasion section dedicated to social engineering
hacking.
So you will see in detail how to do that.
But in here we'll just focus on using Meadows Floyd in the background and connect intercessions and
seeing what we can do without loading any additional software by using only the seen the shell on the
drilling machine.
OK.
So for that of course we will use
Amanda's Sports Final console
from there we'll just select the inverse on multi-headed lower and we'll use interpretor reverse DCB
as the payload and this payload on the stage are for this payload is encoded in these Bedwell.
Right.
Right but very very elevations that just the repr that makes it being visible to most antivirus products.
So here we are we are still in assembly and shares right.
So this is what save common gives us which is seeing that the auctions some of them at least that we
have said in previous session are here.
So I'll go back and use
Monte handler and yes is the right name right.
It doesn't have many options.
We have to put payload first here so we don't set the payload to Windows
interpreter
I said interpreter.
Yeah.
To complete this really slow because there are a lot of different ways you can get.
So here we will.
Paul
what's the IP address we'll call
you.
Bogle calls to our IP address
and.
OK.
Let's exploit with base.
J right.
Or on a context in the context of a joke.
OK.
So we have our consul here working on either handler or some other ports for example.
Ok so someone is already connecting.
So the trick is that this payload has been already run on the system.
OK.
So it's somewhere somewhere here in the Task Manager
right.
Well it's final.
Shouldn't there own
it should be around somewhere.
Yeah that's it.
OK.
So it's it's a process that is somewhat persistent in memory and we have to connect to the session that
we initiate from the target machine and you have to imagine that as the payload that you press during
the machine does not contain all the functionality of an interpreter.
So with this message sending stage right around 1 megabyte
means that the only thing that is coming back to our machine with MSF running is like the request for
further actions.
Right so we are sending there only the stage for something that will connect back and then receive the
rest of the code in this manner.
We do a good job avoiding antivirus.
First of all because yes still we have to make it really minimal.
Right.
Really small.
In order to pass through any means of any media of communication we use in order to deliver the payload.
But making it this simple just connect back to a well-known port.
Not not as in this case but to actually dubious port for example and just get something and we will
show you we'll tell you what to do next.
OK so now we have some sessions running.
Yeah.
So we see that it originates from something this we loose a bridging system and that lets connect to
the session right there.
I think let's make the session direct.
Right.
And here we are
right.
We are on the system with the user role.
He is the local administrator I guess.
So let's do some normal post exploitation overview of what we have here where we are.
Let's see.
See you and those in those THEM.
We don't have access rights and we are administrator but we are on the local system.
So we have to squat to do that.
And we are fortunate there is no publicly known local religious coalition exploit for that.
So let's see what we can do.
First of all let's.
R t.
What we can do with the system overall.
Right.
So our system comments are like this.
We of course executive commande Yeah this is really important.
We can queue a process right.
This is really very very important once we spread our influence and we have to keep it low profile we
have to kill some things we run on the background and we can modify the register right from here.
Right.
But the registry is is a well-documented thing and you can do from the common line once you executive
seeing the shell by exec you for example.
So lets see how to do that.
So that just see what are possible options for exit queue.
So remember that without these Desch I will just create a process that won't be indirect like exec who
called exec OK up has to put this F in order to specify exactly what the executive will come in.
So this is also important but if we run it we just run it.
So its not in B-S somewhere right.
Where is it.
We have seen the
it shouldn't be running as a user right.
So
is ranked No.
Yeah.
So we have Coquito popping up but
I can't really see them.
So up here it is.
OK.
So with this new Sawston submission model in Microsoft's Windows it's not clear yet where a calculator
comes from or previously has been somewhere in Windows directory in our design.
So let's let's just get it right.
OK here we're not going to let you.
OK so this is what we do.
But our ultimate goal is to get to a legitimate shell right in order to do things as we would do in
Windows normally to keep its very low profile and avoid any attention from system in Australia.
So for that we will use see in the Z Force and we will do it directly.
That's important.
OK.
And we will make it hidden from the view of the current user.
Right so it won't appear in this window the user is seeing on the monitor.
OK.
So here we are is it visible.
No it's not.
OK.
That's kind of cool already.
So our we still do not have access to the directory.
OK.
So let's CD to our users user for example.
Right.
See what's there.
A lot of different stuff.
So we already can do something here.
But as you saw in Kambal demonstration we can use legitimate comments to try to create some anchors
for persistence.
Right.
So there is this very multi-purpose tool that is going back to him as those saw.
And that is
really useful when it comes to post exploitation movements.
And we of course can attempt to add a user
right we're the best for
and most probably we will fail right because we don't have access.
But still we can see
what local group this is.
Right.
So it's pretty difficult.
Nothing custom has been added both by system administrators.
And I think that is what you do in order to add the user and then put it to some group and then everything
else has to be done and directly there is not much.
There is no enjoyment you can get.
Right.
So it's not very pleasant to operate from.
This really cuts in functionality too.
But there are things that are really really interesting and efficient in the Windows world and I'll
show you one of those.
Most of you probably are already familiar with the power shell which is quite quite cool.
And
the bad the worst and the best thing with the Power Shell is depending on what's your perspective on
the matter is that it's virtually everywhere and it's not really used much for legitimate purposes.
OK so by default Microsoft puts it in every Windows distribution.
However our system administrators do not use it very much.
Right.
So but penetration testers do OK.
So you can expect that to be present in many remote target system you compromise.
So let's surge first do this OK.
I'm not sure whether it's on my target machine but it's installed from the Bhushan by default are actually
it's it's a witness from a previous version but still I think some kind of power show has to be proud.
And it is.
OK.
So your show is much more interesting in many ways.
For example in directed not if he has this other completion functionality you will feel very comfortable
if you are familiar with Linux or Mac OS command line.