We're starting our end game run on this course here.
And like I mentioned right above,
you may have been wondering why I didn't start off
with operating systems directly right away.
And that's because we wanted to build up
to where we're getting to now.
Because a lot of the stuff that we do in this skill
may seem like a review,
while we're still bringing in new skills
and applying everything we've learned up to this point.
And as we start making our way
into the actual operating systems,
starting off with Windows in this skill,
we're gonna be doing a basic generalization
with six steps as a kind of a reconnaissance
based on that pen testing lifecycle
to get an understanding for where we're at
on the actual system once we make our way to it.
See, this is using all of the skills
as previously mentioned,
and we're inside of a unsuspecting Windows system.
So we need to have an understanding of where we're at.
And it starts out with the first step
of what we're doing, triage.
We're gonna be taking a look at the actual system itself,
getting an idea for who we are and what permissions we have
and where we need to be going next.
Then moving over to system configuration.
Understanding some of the things about the system,
such as like what patches are on the system
or more specifically what patches are not on the system.
Getting an idea of what version of Windows we have,
so that way we can look at potential exploits
to use against that system
and possibly others on the network.
Because just as a side note here,
if we're on a system that's domain controlled
and they have a WUSSIS server for updates
and everything like that,
if this particular system that we're on doesn't have it,
there's a high likelihood that others on the domain
don't have that patch as well too.
And it would be something to definitely take advantage of.
Then we move over to services and processes.
Understanding what's actually running on the system itself
and even behind the scenes.
Because as we know,
there can be a lot of different programs
that not only run in the foreground,
but behind the scenes where even the standard user
doesn't see what's exactly going on.
That's good for folks like us when we're doing our pen test,
because as we've seen,
we can run many different things in the background
and tie them to different services and such.
While we're on that system,
depending on the permission levels that we have,
we might be able to do scheduled tasks
and have the system perform certain applications
and duties for us,
instead of having to go in and do them ourselves.
Because let's say the system we're on
is restarting that day,
because they have a group policy
that states that computers must restart every so often.
You don't wanna lose access to that particular system
and you put a scheduled task on there
to be able to gain further access into the future.
And just like with old software and patches
that are on the system,
we also wanna take a look at the installed software,
what other applications they have,
along with the drivers.
Because just like with those system patches for Windows,
we could have a system that has older versions of software
because of easy use or maybe compatibility issues
with hardware on the system,
but there may be a flaw
that we might be able to exploit later on
and look up different versions of exploits for.
And that takes us into the last portion
of what we're gonna be covering in this skill,
and that are saved credentials and sensitive files.
See, we've mentioned in some of the previous skills
leading up to this,
there might be things like on the desktop
or hashed in files or hashed algorithms
that have been saved inside the actual SAM itself
for other users on that system.
So not only do we have access to the user
that we've already made our way into for their system,
but we might be able to gain access into other systems
using different user accounts as well too.
Basically making a way for ourself
to have continued access to the organization
that we're pentesting against
by creating different backdoors for ourselves to utilize.
We don't wanna just have that one method only
because if that user account gets deleted
for whatever reason or locked out,
then we're kind of left to go back to square one on this.
But it's just a general plot of how we wanna go through
once we gain access to the actual system
and also make an assessment
of the Windows operating system itself
before we start doing exploitation
a little bit more detailed.
So let's go ahead and do it to it.