-: In this demonstration,
I've created a small lab environment with two machines
to show you how I can conduct a privilege escalation
against a victim.
My attacking machine is the Kali Linux machine,
shown here on the left.
This is going to be used to simulate
an attacker's machine for my example.
Kali is a commonly used version of Linux
that's focused on providing us with tools
that we use as a penetration tester or a simulated attacker.
My second machine, shown here on the right,
is going to serve as my victim machine.
This computer is running the Windows 7
64-bit operating system.
For this demonstration, I'm going to do a quick walkthrough of
how to find a target machine and attack it
using a known exploit.
In this case, the target is missing
an important Windows update, which contained the patch for
a vulnerability in the way Windows 7 conducts
its file sharing over a network.
This patch was named MS17-010 by Microsoft,
meaning that it was the 10th patch
released by Microsoft in the year 2017.
This patch addresses a security flaw
in the underlying Windows operating system.
The same flaw that was used by the WannaCry ransomware,
which was later codenamed EternalBlue.
In order to get started, I'm going to need to find
the IP address of my victim machine.
If this was a normal attack
and I was going over the internet,
I would have to perform a lot of reconnaissance
and research to figure out their IP.
But since I know that these two machines
are both on the same network, instead,
I'm just going to identify what the IP range being used is
on this network.
Using the ifconfig command on my Kali machine,
I'm able to see the IP address of my attack machine.
And this is 192.168.56.102.
Next, I'm going to look at the sub-netmask,
which is 255.255.255.0.
This means we're dealing with a /24 network,
which consists of up to 254 host IP addresses.
We know this based on our experiences in Network+.
So to perform my scan, I'm going to open up
a program called Zenmap.
And I'm going to do a search across this entire /24 network.
This'll help me to identify
what machines are on the network.
And in this case, there are only two machines,
my Kali machine and the victim Windows machine.
Zenmap takes a few moments to scan
every IP in the /24 network and their ports.
So I'm going to pause the video here
and come back when it's finished so we don't waste time
sitting here and watching it churn away.
Now that that's done, we can see the fact that
it found the Windows 7 machine,
which will be our victim for our attack.
This machine has three open ports: port 135, 139, and 445.
These three ports are used to allow file sharing
in a Windows system.
Based on my experience as an attacker,
I know that the EternalBlue exploit requires port 445
to be open for my attack to work.
This port is open by default
if you have file and printer sharing enabled.
If file and printer sharing aren't enabled,
port 445 will be closed and this particular exploit
won't be effective.
Now that we've found a possible victim,
let's look at what the target machine is
a little bit closer.
You can see that this is a Windows machine.
Based on the scans, Zenmap believes this is
a Windows Server 2008 machine,
instead of a Windows 7 workstation, which it really is.
This is because Windows Server 2008 and Windows 7
both share a very common code base
in their operating system.
As you can see, Zenmap is a little confused
on what operating system it is.
Under the host details, it showed it as Windows 2008,
but here under the ports,
it's responding as if it's Windows 7.
Now, we know the truth because we can see the machine
on the right side of the screen.
It is a Windows 7 machine.
So now that we've identified the target,
we're going to go into our exploitation.
First, I'm going to open up another terminal
and I'm going to load the Metasploit framework.
This is an attack program that has
lots of preloaded exploits,
including the one for the WannaCry ransomware.
To get it loaded, I'm just going to type use,
the exploit I want, which is
exploit/windows/smb/ms17_010_eternalblue.
From here, I'll set my options by saying show options.
You can see, everything's pretty much already configured.
All I need to do is set my remote host,
which is the victim machine I'm going to attack.
In this case, 192.168.56.101.
And then type run.
And at this point Metasploit is sending the exploit
over to the Windows 7 machine.
You can see that showing here in the logs.
Once it's done, it will give me a command shell.
And here I now have root access
or administrative access over that Windows machine.
I'm going to go the the root of the drive
by changing my directory.
And I'm going to create a directory
called "You've Been Hacked."
Notice, on the right side, "You've Been Hacked"
now showed up on the Windows machine.
I can do all sorts of things here
because I now have root access.
Here, I'm going to go and change directories
into the You've Been Hacked directory.
Notice, it's empty.
Well, now I'm going to make a file by echoing some text.
I'm going to echo "This works only on Windows 7 and 2008,
64-bit versions, of the OS."
and I'm going to put that in a file called Works.txt.
Now you can see, if I look at the directory,
Works.txt is there.
I can go to the Windows machine
and I can see that Works.txt is there
with the stuff that I just put in.
Now, at this point I can do whatever I want to this machine.
I have administrative rights.
I can install programs, I could put in backdoors,
I can make static connections.
Whatever it is I want to do, I now have
total power over this machine.
Hopefully this example shows you just how easy it can be
to do a privilege escalation
and how much power that person could have over your machine.
Now, to prevent this, we want to make sure that
we patch and update our machines.
If this Windows 7 machine had gotten
the patch that it was supposed to from Microsoft,
this exploit would not work.