# Vulnerable Software
We want to load the machines with vulnerable software so we have pathways to exploit.

## Download
We are going to download this into our Kali VM as that is the only vm that should have Internet Access

### RemoteMouse - WC1
[RemoteMouse 3.008 - Arbitrary Remote Command Execution](https://www.exploit-db.com/exploits/46697)
Filters:
- Has App
- Platform: Windows
- Type: Remote


Download app:

### WiseCare (Unquoted Service Path Vuln) - WC1
[Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path](https://www.exploit-db.com/exploits/50038)
Filters:
- Has App
- Search: Unquoted Service

Download app:

### Webserver (XAMPP) - WC1
https://www.apachefriends.org/

### Autologon (Sysinternals) - WC1 & WC2
https://learn.microsoft.com/en-us/sysinternals/downloads/autologon

## Staging

We put all the files into a folder within our kali VM


We can get the files to the vulnerable client any way we want, but i'll be using Impacket's smb share.

## Download to WC1

Access the smb share server from vulnerable client by typing the ip address in the File Explorer bar

Make another folder in C: and paste the contents in there

## XAMPP
### Installation
- *[Always a good idea to bypass or disable UAC, best security practice ever.](https://www.blackhillsinfosec.com/why-you-really-need-to-stop-disabling-uac/)*

We won't need most of the following

If we open the control panel after installation we see that we don't have authorization to change or start anything

We need to open it as Admin for the options to be availabke to us
### Setup
Click the Red X, then Yes

We will need to allow access - otherwise we would then have a webserver which is only available on the local machine

When we press start, we can see that it runs
We can also access the webserver via the browser
### Housekeeping
We can delete the installer file after

## Autologon
***This will be transferred to WC2 later on***
### Prep
We can delete the ones we don't need

### Housekeeping
We can delete most of the files except for the Autologon64.exe 64-bit installer

## Remote Mouse
### Installtion
### Housekeeping
Rename the installer to something more ambiguous
Maybe we can leave just the hash
Create a folder in the webserver folder called "uploads" - `C:\xampp\htdocs\uploads`
- Uploads is a common word found in wordlists when doing directory enumeration

And we paste it there as part of our dioscovery process

## Wise Care 365
### Installation
Choose Custom install
Change this
to this
By putting it in the apps folder, it's even easier to take advantage of and exploit - because it is more open on permissiong. This will also demonstrate why we shouldn't be installing in non-default locations (like the Programs directory for programs).
After install, we can launch it to check it's there

*WOW! What a secure looking app!*

#### YO, WTF is this?! LOL.
This appeared after I rebooted the computer at some point. Hilarious.

### Housekeeping
We can delete the installer after

For reliability when interacting with machine using a VPN