[taletUrLeyakUpAR]

frist think thz allot  i wanna sko how did u get the pass jdoe i only hace pass tec where did u findit

Pay attention to the output of winpeas, the password is mentioned in clear plain text

[DwightSchrute]

any tips regarding root?

[taletUrLeyakUpAR]

any tips regarding root?

this is a rabbit hole

(ANALYSIS\Administrateur) run_bctextencoder: C:\Users\jdoe\AppData\Local\Automation\run.bat

Pay attention to the snort

Snort(Snort)[C:\Snort\bin\snort.exe /SERVICE] - Autoload - No quotes and Space detected
Possible DLL Hijacking in binary folder: C:\Snort\bin (Users [AppendData/CreateDirectories WriteData/CreateFiles])

[raiderado]

frist think thz allot  i wanna sko how did u get the pass jdoe i only hace pass tec where did u findit

Pay attention to the output of winpeas, the password is mentioned in clear plain text

How do i login using the technician credentials ? I see people refering to webshell upload, but where do i login with that credentials to get reverse shell ? winlogon didnt work . I'm very bad with webapp,working on it atm.

[taletUrLeyakUpAR]

frist think thz allot  i wanna sko how did u get the pass jdoe i only hace pass tec where did u findit

Pay attention to the output of winpeas, the password is mentioned in clear plain text

How do i login using the technician credentials ? I see people refering to webshell upload, but where do i login with that credentials to get reverse shell ? winlogon didnt work . I'm very bad with webapp,working on it atm.

Login Page: http://internal.analysis.htb/employees/login.php

after that go to http://internal.analysis.htb/dashboard/form.php (SOC Report), upload the rev shell then to execute it go to http://internal.analysis.htb/dashboard/u...f_file.php

[xlr]

which revshells are working for you guys, the ones i'm using, including p0wny shell and meterpreter don't seem to be able to run the winpeas and meterpreter keeps shutting

[DwightSchrute]

any tips regarding root?

this is a rabbit hole

(ANALYSIS\Administrateur) run_bctextencoder: C:\Users\jdoe\AppData\Local\Automation\run.bat

Pay attention to the snort

Snort(Snort)[C:\Snort\bin\snort.exe /SERVICE] - Autoload - No quotes and Space detected
Possible DLL Hijacking in binary folder: C:\Snort\bin (Users [AppendData/CreateDirectories WriteData/CreateFiles])

there is a old CVE about Snort dll hijack but that doesn't seem to work, there is others dll but hijacking still doesn't seem to work for me

thats where i am stuck as well...

[U2t5d2lu]

It looks there are some misssing dlls, but didnt succesfully menage to exploit them

[SingaporeFriend]

Are we sure that it's not encoded.txt? If I enter any password I get: The password you entered is invalid. But if I enter jdoe I get "Errorin decoding text".

I'm only able to replicate some of this behavior if I change the cipher text, so that it's invalid, then the application will say "Error in decoding" before entering a password and not after.

Edit:

I checked the AD attack chain, it looks like we need access to wsmith, then we can escalate to soc_analyst.

[Alturis]

Can anyone help for what is correct password length?

97NTtl*4QP96Bv

Thats the password I arrived at as well. Havent been able to get it to work on anything though