[macavitysworld]

This was helpful but when I try to dump sam, security and system hive on metasploit I get an error "specify [-k]". Can anyone please help??

you already got elevated shell. if that not work why not just load mimikatz, lazagne, or other tools that able to backup SAM.....

I have a shell as jacob.greeny but still I can't dump SAM, SYSTEM and SECURITY. I loaded mimikatz and when I run privilege::debug I get an error again

You cant dump SAM from Jacob.Greeny, but you can overwrite standalonerunner.exe as Jacob.Greeny, use your imagination, get a meterpreter shell, them use "hashdump"

[macavitysworld]

HTB - Freelancer Writeup

https://katopia.me/HTB/Machines/Hard/axlle

Note: This is really a vague writeup, There are no passwords or hashes included.

Updated Writeup with Intended Root Exploit

[DoesntMatter123456]

Hi. Thanks for this great resource, I am trying toy execute this:
x86_64-w64-mingw32-gcc -fPIC -shared -o shell.xll exploit.c -luser32
but the error says cc1: fatal error: exploit.c: No such file or directory
Are we suppose to create an empty exploit.c file ?

[mxntysec]

Hi. Thanks for this great resource, I am trying toy execute this:
x86_64-w64-mingw32-gcc -fPIC -shared -o shell.xll exploit.c -luser32
but the error says cc1: fatal error: exploit.c: No such file or directory
Are we suppose to create an empty exploit.c file ?

make a file named exploit.c, and put the modified script in there

[macavitysworld]

Hi. Thanks for this great resource, I am trying toy execute this:
x86_64-w64-mingw32-gcc -fPIC -shared -o shell.xll exploit.c -luser32
but the error says cc1: fatal error: exploit.c: No such file or directory
Are we suppose to create an empty exploit.c file ?

Don't Ctrl+C & Ctrl+V Read, Understand and Do it!

[DoesntMatter123456]

Hi. Thanks for this great resource, I am trying toy execute this:
x86_64-w64-mingw32-gcc -fPIC -shared -o shell.xll exploit.c -luser32
but the error says cc1: fatal error: exploit.c: No such file or directory
Are we suppose to create an empty exploit.c file ?

make a file named exploit.c, and put the modified script in there

Thanks bro!

[gglanaya]

PS C:\Users\dallon.matrix\Documents> whoami
axlle\dallon.matrix
PS C:\Users\dallon.matrix\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State 
============================= ============================== ========
SeMachineAccountPrivilege    Add workstations to domain    Disabled
SeChangeNotifyPrivilege      Bypass traverse checking      Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\Users\dallon.matrix\Documents>

Now am at dallon.matrix, someone could spoil what enumeration process should i do? already doing powerup and bloodhound but nothing that valuable.

[macavitysworld]

PS C:\Users\dallon.matrix\Documents> whoami
axlle\dallon.matrix
PS C:\Users\dallon.matrix\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State 
============================= ============================== ========
SeMachineAccountPrivilege    Add workstations to domain    Disabled
SeChangeNotifyPrivilege      Bypass traverse checking      Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\Users\dallon.matrix\Documents>

Now am at dallon.matrix, someone could spoil what enumeration process should i do? already doing powerup and bloodhound but nothing that valuable.

Try winpeas!

[gglanaya]

Got it with BloodHound, WebDev member could resets passwords!

[blackito404]

Hey,

I cannot take the initial foothold, i tried with xll, but doesn`t works,