Well, now things start to really get ugly on our test system inside of Bwap.
Let me show you what I'm talking about here.
I have on our Cali side the actual same window that I opened up in the previous
portion of the skill running that not.exe.
And right below it, I have a continuous ping going on with the Bwap.test server
itself.
Now you may also notice that I have the original and I'm going to zoom in for
you
real quick the processing monitor or performance monitor on that IIS system
because the original not.exe is running.
Now inside of our Cali box here, we ran not.exe remotely using command
injection,
not.exe bad.php.
IIS running as that service account on the system itself.
Well, what if I refresh this again?
And I go ahead and refresh the system and you'll notice that on the right,
you can see that we had and I'll zoom in for you here.
Right here that now we have 100% processing on that Windows 10 target system.
It's running the file twice.
And if we go into details, we can even see right there that not is opened up
twice
with two different processing IDs.
This is where it gets ugly because we can actually use this to toss that system
.
And that's exactly what we're going to be doing here because if we go back to
into performance and leaving that.
Ping open for us, we're going to run this a couple of more times
and crash that system out.
Now I'm going to kind of skip ahead in this because now I'm running it four
times,
I believe.
Let's double check over here in details.
Yep, right there, you can see that I'm running it four times right there.
I'm running it four times.
And if we go back and take a look at the Cali box,
you may start to notice that our time and response is variant as well, too,
meaning the system might not be able to keep up with this.
I'm going to move this over here to see us open more of these knobsleds
that we wrote as an example.
There's another one.
And I'm just going to do this until the system crashes.
Now I'm going to open up another tab and see if we can go over to be
WAP.test real quick.
And as you can see, it's not loading up as quickly as we want, right?
That's because we have completely disabled the remote system or our target.
Be WAP.test.
And it's now in a D.O.
It's in the back end of a DOS attack.
Now a service has been achieved using command injection and also some other
exploits that we did through the processing with that knobsled.
And this may be the target of disruption and chaos for some attackers,
but could also present the target being in a failed open state.
We see that the ping is still going with some erratic responses as far as
the pings are concerned, which may indicate that we can still target the
system for other stuff and bypass security measures because processing is out
of control.