Our channel is pretty straightforward. We're attacking or basically trying to
get a copy of
that VM information.text that's sitting on our desktop. What I mean is that
under this folder right
here that is the share, if I minimize that, you'll see as I zoom in here that
we have VM
information.text. Now the reason that we're targeting this one is I want you to
get used to
the fact that there are users out there within organizations that go pint us
that do keep information
files like this on their desktop. And while ours is for the purposes of
education and lab environment
in what we're doing here to learn, really, as a security practice, what I did
here was a no no.
Because the file, if I open it up here inside of Windows, contains a subnet for
the entirety of
our VM lab, username and passwords for the different VOs that are within our
lab environment. And it
could very well be like one of them, the BWAP system, the Windows 10. See, that
's actually a web
server. So theoretically, having this file on here allows attackers like us to
go in and see what
the username and password is for that actual web server now that they're inside
the actual
internal organization network. And that's that's bad. Right. Now we already
know how to search for
it. Let's go ahead and work on downloading it. But I do want to kind of show
you here real quick
that I did a DIR and a PWD. And the reason I did that was to kind of show me
where show me where
I was here. And if you look that we're in the desktop slash shareholder, the
reason is is the
connection was made with dummy.exe. And that works out of that desktop
shareholder. So just like when
you use meter, when you use MSF consoles, connect to a target system. If you
make it in because they
use dummy.exe, you're in is that user and not necessarily as yourself on the
from the Kali box,
right? So and you could prove that here with the who am I? Sorry, that's a
PowerShell, I guess.
But we know how to load PowerShell and go into PowerShell. But we are in the
current directory
of desktop slash share. And I would need to actually go to desktop. So that's c
dspace.dot. And now I
can do a PWD and show that I'm actually in the desktop. Now when I do a DIR, I
can see that there
is that VM information.txt file right there. And I can go ahead and select that
for download.
I can say download see I need to use quotations because I have a space in that
file. And I also
need to use the double slash sorry, head of brain fart there for a second. And
I need to use the
actual directory path. So c drive users slash and the tabbed this neat, but I
still need the
double spaces users slash learner slash desktop slash VM information of txt
quotation mark. Now,
as I go through and connect, correct my mistake here, I do want to point out to
that this is
still downloading to our desktop, which is something to remember. So I went
ahead and downloaded it
here. And I'm going to move it over and show you that it's right here. And if I
go ahead and open
that up, and it may take a second to open up to give me just a second. Oh,
there it is. For some
reason it opened up inside of notepad QQ and I opened up to that's okay. But
you can see that
the contents of this file are exactly the same. And it was pretty
straightforward to be able to
download that file. And how you may have gone about it a different way you
could have downloaded
the entire folder with the dash R command that I had previously in the previous
section of the
skill in the code box. But this is all good information, no, and also a key
part of what you do once
you've made it inside an actual system for post exploitation. Now, once the pen
test is over,
you need to reveal all the stuff to the organization. So that way they can
eradicate it. But during
the scope of that actual pen test while it's going, these are things you need
to consider so you can
get into as many systems as possible. Because different systems have different
permissions,
different users have different levels of access. I hope this has been
informative for you. And
I'd like to thank you for viewing.