All language subtitles for 4. Manual Exploitation

So we have gained root with Metis play.

But now we need to gain root with some manual exploitation.

So remember earlier we discovered that we had an exploit with our mod SSL and we're going to see what

we could do about it.

So we went to Google only research made SSL and we came up with something called open lock.

If you remember that.

So we clicked on this open lock here and this is the same as the one that is out there on X flight database

but it is fixed.

So remember the exploit database when it's broken so you'd rather use this one that is fixed.

So we're going to do is we're going to follow the instructions here.

And this is very well laid out.

So it tells you to get clone this we need to do an installment SSL Dev library.

We need to compile and then run the exploit.

So very very straightforward.

We're going to go ahead and do exactly what it says and let's go ahead and just copy this first line

here and I'm going to just make this little smaller go into a terminal and I actually have a folder

for the objects I'm going to see into it and then we're going to go ahead and just paste that line and

it will get and everything if we last.

Now we see that it is there.

So let's see the end of that folder.

The bad word folder will allow us and now you can see that there is just the c file here in the read

me.

So what we're gonna do is we need to install this live SSL Dev.

So we're gonna say app install and then live SSL that Dev like this hit enter and then just hit enter

because it says yes already this will take just a second to install and then once it does this we're

going to use a tool looks like call GCSE which GCSE is a compiler.

So if you've never used C or are familiar with C we have a c file but this isn't ready to use.

We have to compile that c file in order to actually use it.

So that's what we're doing here is we're downloading a little bit of stuff to actually build a compile

that GC C is built in.

And we just need some other things additionally.

So now we're gonna do is we're going to say GCSE and typically you say dash 0 for the output so we can

call it whatever we want we'll just call this open and then we'll just specify the file you can start

typing it and then tab out and then it says this L crypto which is important.

Hit enter.

OK.

And then hit LSI and you see now in pretty green green lighting up and saying hey we're executable we

have are our executable.

We have our script that we can run.

So we could say dot forward slash open and run it and you can see in here all the different options

that this runs again.

So remember one is brute forcing the last one.

When we saw the we saw the trans two open kind of doing brute force.

In theory this is what it could do as well.

But here we have to pick a return address based on our machine.

So we're going to look at the usage.

I always like to do the application without any usage to see what the usage is and we need to use target

box which is one of these down here.

We need to select a port maybe.

It says For SSL connection we're not going to be using and SSL connections.

Don't worry about that.

And then a dash see.

No.

And it says use range 40 to 50.

If you don't know.

So our syntax is going to look something like dot forward slash open one of these offsets that we're

gonna pick and then it's going to be a dash C probably 40 with the box IP address in between.

So how do we find what we're looking for.

Well I'm a cheat just a little bit until you guys to scroll down down down down down and if we look

at six b here remember we were up against a patchy one point three point two zero C enumeration comes

into play big time.

So Apache one point three point two zero.

Now there are two we can run against.

I'm picking this one I believe it's the more stable one so we could pick either one but I would choose

B I think a doesn't work all the time so let's choose B here and a patchy one point three point two

zero is the indicator and again Red Hat Linux that's another indicator.

So let's copy this so we don't forget it and we're just going to scroll down and we're gonna say hey

stop forward slash open and we're going to paste that 0 x 6 B and then we're going to run this against

the IP address because it said box was next.

So one thirty four and then remember we had to give a dash C of 40 so that is the syntax.

Sometimes you have to follow along and it's I don't I don't think most of them are as confusing as this

item when you say this is confusing I would say it's pretty lengthy for a exploit because you have to

go through all the different offsets here to find the offset and actually fire this off but you know

you have the opportunity here to actually be able to read usage and just understand your your way through

it.

So once you get this little syntax and all this part down it's really not that bad.

So to check off the list we've got the target we've got the box IP address we don't need the port because

we're not running against SSL we're just gonna run this against Port 80 and then we're going to run

dash C of 40.

So let's go ahead and try to fire that off and see what happens here

and this may just take a second

OK says it's finding a shell.

Now we wait for the SCADA let's scroll up just a little bit while we're waiting here to see so it looks

like it sent the shell code and its bond to shell.

It says hey we have no job control in this shell.

And then it has a shell here bash 2.0 Fi.

That is a shell and then it's going in and it's doing it's doing some w gets.

Now if this is able to get out to the Internet it's going to go ahead and try to do w gets against these.

It's going to keep downloading and it's going to get the response here OK.

And now it's as we wait for the shell because it saved this dot c file here.

And let's see if maybe we already have a shell.

Who am I.

Root.

Look at that.

So it looks like it downloaded something and allowed us to maybe privilege escalate here and let's say

hostname.

OK.

So we've gone through and we've routed this machine with medicinally and now we've gone through and

routed this machine with the manually downloaded exploit.

So there's two options you're going to find out that Metis flight is a more robust and popular option

especially as a penetration tester.

Now there is a common misconception or thought process put out there by certifications the OSCE for

example doesn't let you use a lot of.

Boy only one instance of Metis play on their exam.

So everybody thinks Man I really shouldn't use medicinally but you're going to see in this course how

useful it really is and how robust it is and if you talk to a penetration tester they're going to use

the best tools available to them.

The certifications out there that do that are just making it harder to pass the exam intentionally than

they are you know for practicality.

This course is all about practicality.

So from here now we can exploit it manually let's talk about a couple of things that we look for in

post so post being post exploitation and we're going to cover this over and over and over again.

We're not going to get into it fully right now I just want to give you an idea as to the thought process

so the first thing to think about is what is our IP address.

We could say I have config if it'll allow us to.

It just depends on what kind of shell we're in and see this one is is a weird shell we could try IPA.

It's still not going to be found if we try some some commands like r or root.

I doubt they're going to be found right now either but we want to look at the routing table the ARP

table we want to see if this machine is what's called dual homed and you're going to learn more about

that when we get into the pivoting.

But if this is this has to nicks and we're on one network in the nick is on a second network that we

never saw before then maybe we can do something called pivoting and move into that new network.

But we would be able to identify who the machine's talking to with an arc table or a route.

We could also look at like sudo privileges so we could say things like sudo dash L but we are route

so we can run as everybody so a pseudo user as we talked about in Linux.

Linux lessons pseudo user is able to run commands as a elevated.

But here is rule where are we obviously already elevated.

So other things that we can do we can cat what's called the FC password file.

Now this is very misleading because the FC password file used to be the password file.

Now it just holds a place holder so you could see all the users that are on this computer route being

this one.

There's a lot of built in users here but if you always scroll down to the bottom and you start the five

hundreds.

That's where your user start.

So there's actually two users in this computer as well one's named John.

The other is named Harold.

So we look at these users and we say OK well there's no password in this password file but there used

to be back in the day there used to be that's why they called this.

And now they moved it to this place holder of an X.

And what we can do is we can come in here and we can say Hey cat Etsy shadow

and now you see the hashes are in here.

So these hashes are what the X is place holding for we can actually combine both of these files with

the tool and go off line and try to crack these.

We'll work on that later on in the course.

But just for now like getting your wheels spinning as to what we can do with root level access we need

to start enumerating again looking at files on the computer seeing what what's out there and what we

can do with it.

But we'll get into post exploitation techniques and thought process as we go through the active directory

portion of the course because I think it plays hand in hand and we could talk about password cracking

there and how to attack some of this stuff.

But there will be a password cracking video on on the Linux as well when we get into the post exploitation

phase of this.

But that's really it for now.

So we've got the we've got the shadow.

We can take this off line try to crack it.

We can enumerate files.

We can try to you know break into user folders and see what they've got in there maybe they've got password

files stored in there et cetera.

So from here we have routed this machine twice.

We've routed it with split we routed it manually and now we can start moving on.

I do want to show you a few more attacks so here's what's going to happen over the next few videos we're

going to talk about brute force attacks really quick on SS H.

We're going to talk about credential stuffing we're going to revisit that concept that we talked about

in information gathering and then we're gonna look at our notes and we're just going to compare notes

and see where we're at with findings and everything else after that we're gonna get into what I like

to call the mid course Capstone which is going to allow us to do a bunch of exploitation against a bunch

of machines and it should be really fun.

So Andrew spiel again I will catch you over in the next video as we talk about brute force attacks.