Doing initial nmap recon, we get some lengthy output:

So it looks like it’s a Windows box with quite a lot of ports open. My eye first caught Ports 139/445. So using enum4linux against resolute, we get some interesting information. I missed this the first time, but looking back over everything line-by-line, I was able to find some really juicy info:

Okay so we see Marko Novak’s password is set to Welcome123! Trying this with evil-winrm to login, we get an authentication failure. However, let’s think this through. This looks like the default password created for new users. Running down the list, we try this with the user melanie

So from here, I actually used Powershell and uploaded nc.exe to get a more stable shell. Call me old-fashioned, but I just don’t like the Evil-WinRM shell.

I don’t remember quite why, but I ended up using Evil-WinRM’s shell anyway. It’s good to have a backup.

Looking around, we find an unusual file under C:\ called “PSTranscripts”. We enumerated hidden files with dir -FORCE from the PowerShell prompt to find PSTranscripts.

Did you see it? ryan’s password is in the other transcript file! Password: Serv3r4Admin4cc123!

Let’s try these creds with ryan:

Alright, time to look around. We enumerated around, looking at basic stuff like whoami /groups

After a while, I came up with nothing. I used PowerUp.ps1 to find an interesting potential exploit:

This link actually helped me out a lot in understanding what to do next.

So, I created a malicious DLL:

Then I served it up on SMB:

And I injected the DLL remotely (really cool new trick I didn’t know before):

I then started the DNS process as seen above. With the listener on port 443, I caught an NT AUTHORITY\SYSTEM shell: