[UVB76]

Constant broken ssh pipe errors man, hard to get this Chisel up and secure ffs.

[ir0nman4l1f3]

Can anyone provide nudges for the following flags? I have access to the 200.a and 300.a AutomationX web apps using the creds found in the PDF, but not sure what is supposed to be done from here?

1. There is always another way
2. The secret is out!
3. The secret recipe.. Part 2
4. Who turned the heat up?!
5. The secret recipe.. Part 1
6. This didn't age well..
7. What a waste of good beer!

[roboot]

hi anyone help web01 me to rope rusty i don't found creds

[UVB76]

Still encountering friggen broken pipe errors messing up any kind of persistence. Cannot tell still if this is design or something actually going on.

I am sure using Chisel etc is the way to tunnel further to find IPs on bacnet - any suggestions for this part?

(Have logged on to the SSH account using creds obtained)

[a44857437]

Still encountering friggen broken pipe errors messing up any kind of persistence. Cannot tell still if this is design or something actually going on.

I am sure using Chisel etc is the way to tunnel further to find IPs on bacnet - any suggestions for this part?

(Have logged on to the SSH account using creds obtained)

have you tried ligolo-ng? works better for me... run it as a background job with nohup

[bl4ckf0xk]

Anyone can give me a hint on How to escalate my privileges on DC. I have logins for two users. But I can't get Admin privileges from any of them.

[roboot]

Anyone can give me a hint on How to escalate my privileges on DC. I have logins for two users. But I can't get Admin privileges from any of them.

look bloodhound and enumeration directory

[bl4ckf0xk]

For the PLC part how to find the PLC port. started in .14 but nmap scan shows 502 is closed and how to start the process of compromising it

[UVB76]

Still encountering friggen broken pipe errors messing up any kind of persistence. Cannot tell still if this is design or something actually going on.

I am sure using Chisel etc is the way to tunnel further to find IPs on bacnet - any suggestions for this part?

(Have logged on to the SSH account using creds obtained)

have you tried ligolo-ng? works better for me... run it as a background job with nohup

Will give this a try - thank you!

[Sqweez]

Guys, i need help please. I have no idea how to do eternal blue to EW through proxy. Can someone give me a hint how to do it?