Go show for example you can use many different scenes.
Let's call them and there is a great website.
SS Sixty-Four that accumulates a lot of different tutorials and manual pages for specifically for common
line interfaces like bash and bar show and see in the sex in some database administration to when we're
programming.
So despite my biased opinion it turns out there is a lot of things you can do with just common line
seen the OK.
But there are things you can not do.
For example
first of all you cannot extend that.
You have to upload your own binary to do something beyond this functionality.
But for example you cannot download a web link right you can download something just by referring a
you are l.
And let's see what we can do with partial partial we can do.
We can really do a lot.
OK so the right extensions beyond this set of S.M. that's OK.
But as you can see we can do some cycling right for each element.
We can do just simple for the same way we can do and seems easy we can get items right again WREFORD
to register or file systems and we can do that recursively by relatively setting this to some to some
route.
Yeah.
And then just doing the pulling is like that.
And there are really cool aliases for that.
Right so for example in
humper missions might still get to use or is use or a directory and here this type all doesn't mean
anything anymore.
Right so we can ls in power Rachele in Windows the same way we do that in
in bash.
OK.
So this seems to us they have these really nice system for example new item depending on the context.
Right.
Will either make make divisiveness make directory or create a new file or remove witen We'll of course
do that depends on the context that we remove a file or directory or something.
So let's let's pay more attention to this.
So BW Do you get a location.
Does it work for us.
I don't know.
Move of course works as well.
Select object that's more for W and my interfacing output to printer works the same way.
It doesn't.
Unix systems and many many more.
Right.
OK so are we going to sleep you can see so you can do very different things and there are some
really cool ones.
For example you can you can issue calls to Windows management instruments right interface.
That's that's quite interesting once you have an idea about what it is.
So basically everything is services in Windows interpretation of its architecture and you can it's somehow
obsolete because now it's all wrapped into these partial methods but all previously you could do that
from a visual basic for example you could write a console script in Visual Basic and do that WMI stuff.
Now it's more simple than just they just see some very basic things.
We can get out of a power source session.
So of course
let's try
let's try to see the event clock.
OK.
It's pretty simple.
Nothing is show y.
All we have is do something more to
when the name
is in our security or in
OK still don't have permissions.
There is not much you can do with the little permissions on the system let's exit partial shelterless
and our interpreter session is our expectation running.
No it's Kortes exploit this once again.
And let's go to our windows machine and Arirang up it's actually showing event log book not to the console
is showing the MSE environment that is set to browsing the blog.
So let's run this as administrator.
Is that OK we'll just Quest
rumbly just crash
now.
Yes.
Nothing is coming with a payload.
I start to worry.
No one is going back
job is there.
So is saying the right is a privileged user connection is not coming back.
What's the matter.
Funny
won't do it locally or.
Well yeah.
So certainly there is a policy that just prevents local there from running cold from shares in the network
or something.
So we have these sessions here.
Oh my kid.
But let's see what it is we are still the user but we arrive in the village or not I guess.
So let's get it interactive.
And now let's go see we're.
Yes.
So when we have the real administrator permissions we can now run power so of course more effectively
and get back to our friends.
So
we'll just search for user.
Right.
So the reason is get credential.
Very smart thing.
So what it does is basically indirectly asks user for the new credential that will be then provided
through your session.
Right.
So let's just do that.
OK.
So is doing something what the user sees at this moment.
Is this really a legitimate window he has to provide his username and password here.
And that happens a lot as you might know if you use Windows.
So they just give the username and password here.
And here you are so now your session credentials have this in their disposal.
So that's that's quite a cool thing.
And there are ways to abuse that of course.
So if you are like having some interactive access on a low level right just on the interpreter level
but want to get the actual credential so the user or you can do that by this way.
OK.
So yeah this is just a simple demonstration of what you can look please go to assess 64 and experiment
at home with the system you have.
There are different ways to operate with the output of different vamose.
For example we can convert that to see as we do X amount to your model and so on.
You can't convert from securest dream to an encrypted standard string and then decrypt that right you
get to the password reversed for example.
So all this is really really powerful.
For example it's that's true and this demonstration has showed some long low gantries can we do that.
Not exactly.
So listeners will just this will just show us
the director of environment and Misi again.
Right.
So this is not what we are interested in and getting on to low cost probably has to do that.
So the examples get to them.
Walk us globe name or application just copy and paste this.
Maybe we're just short on data for this to run.
Yeah of course.
So what we need most probably is security which is readily available where we are here.
So this is this escalation.
Yes this is where we have wronged the batch file.
We have more permissions here with the administer level permissions.
So OK I hope you get the idea of what the range and the spectrum of actions you can do and what you
can accomplish by that.
Yeah but just merely having access to the command line.
So get deep into knowing more about that.
Create your own offline scripts to automate as watch information extraction and other post exploitation
authorities as you can because in the wild most probably will have this one shot.
And after some period of time the machine will just reboot.
Or some security mechanism will drop your connection and you will have to really be fast on that.
Yeah.
Most exploitation should be automated as much as possible but not that much.
True but not at the level that will direct additional attention by increasing
the resource consumption consumption of the target system.
Right.
Because when the fans start to
go really really fast.
Yeah that means that something may go wrong and a educated user most probably will send another message
to their security operations team.
So let's wrap it up and get to another section.