With the provided credentials, access the file share. In the Logs share, we can view many log files, one of which contains additional credentials. However, we need to change the password a bit and cannot use it straight away. From there, we perform targeted kerberoasting on a service user and retrieve its TGT. We can use it to winrm into the machine. Moving on, we notice a scheduled task. We retrieve the executable to examine it. This allows us to hijack one of their DLLs to get a reverse shell instead. Finally, we combine WSUS, certipy and a method to dynamically update the DNS on a Windows server to get a SYSTEM shell. Yep, it ain't easy.
An exploration about malware based on VSC Extensions
An explainer of something I learnt in Cisco's SDSI course
First, fuzzing the web server reveals a virtual host. This virtual host is an application vulnerable to SQL injection. By dumping the database, we get the creds to SSH into the server. To escalate privileges, we leverage a vulnerability in MotionEye to achieve remote code execution as the root user.
My thoughts on security architecture after following Cisco's SDSI course.
