It's time to triage. Much like when we take a patient to the ER for the very first time after a
slight accident, we need to get all the information about that patient that we can get
and be as polite as possible. And I bring that up for a very good reason, because you're going to
see a couple of examples in this particular portion of the skill to where some of our
information or fact-finding processes might get discovered accidentally if we don't know exactly
what it is that we're doing. But thankfully we have a full demonstration in our ADEPT labs that
we can make use out of. Now that being said, we are here to find out the five W's, like that
mysterious patient in the ER who was playing with too many fireworks in March. So who are you?
Why are you here? What are you doing? Tell us everything about you. And we need to get that
patient history as well too. And in the world of Windows, that's just understanding what system we
have and potentially going into what patches are on the system or may or may not be. Right now we're
going to start with the five W's and slide on over into our lab. Now as you can see here, I have MSF
console opened up with MetaPredator. And I will have the commands below, and specifically I do
want to add that I will be putting the connection commands for MetaPredator below as well, because
we're going to be relying on some of the previous skills that we've had in this course to be able to
set up to this point. We're using dummy EXE on our Windows 10 system. That's right, I have Windows 10
opened up as well too. And as you can see here, as I zoom in for you, I have dummy EXE from the
actual Windows server. I have also put a copy on the desktop for you as well. So if you want to run
it and be able to connect the two together using that particular skill by all means, or if you want
to create your own, do that too. So inside of MetaPredator, we've been here before and we said
we would actually get here in terms of figuring out who this is and what we're doing here.
When you're looking at it inside of Kali and Metasploit, this is exactly what you're seeing
up here. And I keep looking back and forth because I'm wanting to make sure that my screen is still
being captured here, because this is all we see. Now there are ways to see more and we will get
into that momentarily, but this one in particular, I just want you to know that this is the beginning
of what we're going to be taking a look at. So first and foremost, we need to know who we
logged in as, and we're going to be doing the first few commands inside of MetaPredator and
then expand outward into things like Command Prompt and PowerShell. So first, who are we is
something as simple as get UID. And then when we zoom in, you can see that we are on that computer
with the user of learner. Now at this particular point, do note that when it says desktop dash
blah, blah, blah, blah, that's a workstation or we're logged into the actual workstation account.
This system could be on a domain, it could not be. But what we know for sure is that the user
we're logged in as is a local account. Otherwise, that desktop blah, blah, blah, blah would be
filled in with an actual domain name. And this has just given us the actual username of who we're
logged in as and nothing more. To go a little bit further, we have get SID. And this could give us
a bit of more information as well too, because I know here on CBT Nuggets, that there are Microsoft
Windows courses specifically in server, all variants of server that go into interpreting
this wonky donkey SID here. Because depending on how you read the SID can tell you whether they're
on a local system or a domain environment. Well, guess what? This one's a local environments,
not on domain. And you would know that if you took that course in skill here at CBT Nuggets.
Now, there's also some other questions that we have. How many types of permissions do we have
on this particular system as the actual learner? Now, again, we're just taking a look at this in
raw form first, and then we'll get into it because we know, but while not knowing at the same time,
that learner is actually an administrator on that Windows 10 system. And again, in Meterpreter,
we don't know that yet. So, we want to say, get priv S, and I'll have these commands below,
don't you worry. And this will tell us just the basics of what we're allowed to do. So, we're
allowed to shut down, set the time zone, undock, increase working set privileges, and change
notify privilege. So, that in itself may not tell you much unless you're like really experienced
with Meterpreter, and don't you worry, I have ways to be able to get this in more understandable
form momentarily. And also, we have what directory are we in? Where are we on the actual system
itself? And that's where we get, get LWD, did I type, yeah, get local working directory. That's
not at, that's where we're at on the actual Kali box. We need to be PWD, so that way you can see
where we're actually at on the target system. I did this on purpose to show you where we're at
on both systems, because you could copy files back and forth. You just need to know where you're at
on either one of them. So, the get LWD is local working directory, and that tells you where you're
at on the Kali system. And the PWD is present working directory for the target system, and
tells you that we're on C drive, users, learner, desktop. So, if you put a file on there, it will
populate on the desktop and they will see it. Now, this is a bit of kind of the getting into the
five W's real quick. And we need to know a little bit more about the actual system itself. Sorry,
I had a slight hiccup with OBS there, but we're taking a look at sysinfo. And this will give you
basically everything you need to know about that operating system right out the gate. As far as
what the computer name is, what operating system we have, what version of the operating system we
have, and all sorts of other wonderful information like how many people are logged in, what's the
worker or domain that we're in. And also that meterpreter portion down there tells us the
architecture type. So, this is a X64 compatible system, meaning that it could be AMD64 or other.
We just know that it's not X86. Now, well, you could also tell by the architecture of type. I
totally missed that, but you could also see the most important thing for us right now is Windows
10 22H2 plus 10.0 build 19.0.4.5. While this may not tell us all the details about every patch
installed on this system, this does give us a working baseline to understand where we're at
in terms of versioning of the operating system. We know that nowadays those build numbers are
kind of like service packs where they would take all the previous patching
for Windows in that version and compile them into one package. So, whenever this is released,
every other patch or security flaw that they found was fixed and rolled up into this one
that was found prior to its release. In the old days, like I said, we did service packs. So,
you would see XP service pack one, two, three, four alpha, and all that other great stuff.
NT had a few that actually came out on their own disk. That's how bad they were. And service packs
went all the way up until I believe Windows Vista. And I only bring that up because it's
something that you need to be cognizant of when you start exploring these systems and understanding
the difference between when you see SP2 or build number so-and-so.