4 privesc

powershell -c ". .\PowerUp.ps1"
. : File C:\Users\shaun\Desktop\PowerUp.ps1 cannot be loaded because running scripts is disabled on this system.

PEAS

[+] Interesting Processes -non Microsoft-
   [?] Check if any interesting processes for memory dump or if you could overwrite some binary running https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#running-processes
    mysqld(1616)[C:\xampp\mysql\bin\mysqld.exe] -- POwn: shaun
    Permissions: Authenticated Users [WriteData/CreateFiles]
    Possible DLL Hijacking folder: C:\xampp\mysql\bin (Authenticated Users [WriteData/CreateFiles])
    Command Line: mysql\bin\mysqld.exe --defaults-file=mysql\bin\my.ini --standalone

[+] Installed Applications --Via Program Files/Uninstall registry--
C:\xampp(Authenticated Users [WriteData/CreateFiles])

[+] Current TCP Listening Ports
Protocol   Local Address         Local Port    Remote Address        Remote Port     State             Process ID      Process Name
TCP        127.0.0.1             8888          0.0.0.0               0               Listening         7844            CloudMe
TCP        127.0.0.1             50119         127.0.0.1             3306            Time Wait         0               Idle

[+] Enumerating Security Packages Credentials
Version: NetNTLMv2
Hash:    shaun::BUFF:1122334455667788:82c51e794ecf6f8f2601e92f9f427604:0101000000000000f2a22adb5862d7018d58da0f88d54b4a000000000800300030000000000000000000000000200000809e2636c947a3055d0f688790b7439ceadd4b45d1e2e159332d222c915cfe400a00100000000000000000000000000000000000090000000000000000000000

XAMPP config file is at \xampp\phpMyAdmin\config.inc.php XAMPP default-passwords file is at \xampp\passwords.txt

CloudMe 1.11.2 is running on port 8888, has BufferOverflow Exploit We need to port forward using chisel

PreviousBUFFNext3 :80

Last updated