Total OSCP GuidePayloads All The Things

Heist

8080

Now visiting our ip: while running responder: We can crack it: Now logging in with evil-winrm:

evil-winrm -i 192.168.180.165 -u enox -p 'california'

Found a todo list: Could do something with gMSA

gMSA

Now to find gMSA:

Web Admins are allowed to retrieve the password: We belong to Web Admins.

To get password blob:

Now using DSInternals

Now store the password as PSCredential object:

Now login as svc_apache using PSSession:

We can also get NTLM Hashes with:

SeRestorePrivilege

Now logging in with winrm with the hash:

We have SeRestorPrivilege

Now using this page: https://github.com/gtworek/Priv2Admin

Now we can get to the lockscreen with rdesktop:

Now press win + U We can transfer rcat and execute to get a proper shell:

PreviousExfiltratedNextHelpdesk

Last updated

Was this helpful?