I Can’t Even Say Less Chatting More Hacking Because Nah This Box Deserves Some Respect, Really Educational 🥸

I Advice You Give It a Go First Before Following The Steps Here There are Different Ways Of Getting Root, Two I Know Of 😎

So no futher ado let’s jump right into it 💨

Firing Up The Machine We Get An Ip address

ENUMERATION 🔍

• So many posts are open I cant’s start listing them but yh we’ll focus on the mains
• Port 139, 445 is Open that can be connected to with smbclient
  • smbclient -L \IP-Addy

• One share allows anonymous login, Connect to it and get the files
• What’s the file type ?
• What’s the file used for ?
• Can the file password be cracked ?
• What’s In the zip you cracked
• What’s the file ? Can it also be cracked ?

While cracking the pfx file if it shows no hass loaded there’s a slieght issue with your hash, remove any ‘, “b’ “

Extract the pfx file

• openssl pkcs12 -in [yourfile.pfx] -nocerts -out [drlive.key]
• openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [drlive.crt]
• openssl rsa -in [drlive.key] -out [drlive-decrypted.key]

Initial Foothold

Remember the zip’s name ? winrm ? Login via evil-winrm

So We’re in

You can run any enumeration script of your choice just run upload “script” (make sure it’s in the directory you’re running evil-winrm from)

run your sript, you’ll notice the powershell history is there, view it

So we can see a series of instructions

We repeat the commands, and we’re able to successfully act as the svc_decoy user

Privilege Escalation

So we see now have to think how to get root after all we have some credentials already Remeber in the smbclient folder there was a folder of Help blah blah it contained things about ldaps and we from our scans we have ldap3 open ports So we dump ldaps

We have admin password

So now you do understand

We have to change the commands in history

Copy the password from that dump (my pass is different cos i had to reset the machine half way)

Great we can run actions as admin we upload nc.exe through our evil-winrm Turn off win defend or whitelist the upload path (c:\users)

run netcat revshell

on your attacking machine you’ll catch a shell

AND WE ARE DONE

LOOK FOR FILES ON YOUR OWN, it’s your little task

Hit me up on Twitter if you run into any issues

Back To Home