1.3 KiB
1.3 KiB
Searching for password
- In Registry
# VNC reg query "HKCU\Software\ORL\WinVNC3\Password"
# Windows autologin reg query
"HKLM\SOFTWARE\Microsoft\Windows
NT\Currentversion\Winlogon"
# SNMP Paramters reg query
"HKLM\SYSTEM\Current\ControlSet\Services\SNMP"
# Putty reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
# Search for password in registry reg query HKLM /f password /t
REG_SZ /s reg query HKCU /f password /t REG_SZ /s
Port Forwarding
-
Use netstat -ano to see which ports are open !
-
Download the latest version of plink.exe for the correct architecture https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
-
Host it on attack machine, download with certutil on victim machine to a writeable folder (/temp/ or the user folder)
-
gedit /etc/ssh/sshd_config and set PermitRootLogin to Yes !
-
Restart and start SSH service !
-
Use the plink syntax for port forwarding !
-
Should bring us to "root" on our box - then we know it was successful !
-
Use winexe to get access to the machine again as administrator
- Hit enter a few times until you get a shell9.
!
- You are now root/system!
!
