search

TryHackMe Post-Exploitation Basics

hashtag
Enumeration with PowerView

controller\administrator@DOMAIN-CONTROLL C:\Users\Administrator>powershell -ep bypass
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\Administrator> . .\Downloads\PowerView.ps1
PS C:\Users\Administrator> Get-NetUser | select cn

cn
--
Administrator
Guest
krbtgt
Machine-1
Admin2
Machine-2
SQL Service
POST{P0W3RV13W_FTW}
sshd
PS C:\Users\Administrator> Get-NetGroup -GroupName *admin*
Administrators 
Hyper-V Administrators
Storage Replica Administrators 
Schema Admins
Enterprise Admins
Domain Admins
Key Admins
Enterprise Key Admins
DnsAdmins

PS C:\Users\Administrator> Invoke-ShareFinder 
\\Domain-Controller.CONTROLLER.local\ADMIN$     - Remote Admin 
\\Domain-Controller.CONTROLLER.local\C$         - Default share       
\\Domain-Controller.CONTROLLER.local\IPC$       - Remote IPC
\\Domain-Controller.CONTROLLER.local\NETLOGON   - Logon server share  
\\Domain-Controller.CONTROLLER.local\Share      -
\\Domain-Controller.CONTROLLER.local\SYSVOL     - Logon server share

PS C:\Users\Administrator> Get-NetComputer -fulldata | select operatingsystem 

operatingsystem
---------------
Windows Server 2019 Standard     
Windows 10 Enterprise Evaluation 
Windows 10 Enterprise Evaluation

hashtag
Enumeration with Bloodhound

hashtag
mimikatz

hashtag
cracking the admin hash

hashtag
Golden ticket attacks with mimikatz

Now you can access other machines in the network such as \Desktop-1\c$

hashtag
Maintaining access

create msfvenom payload, send it using scp, set up meterpreter listener, run shell.exe in windows

hashtag
Set up persistence

Background the meterpreter session

Run the persistence module

PreviousTryHackMe VulnNet: RoastedNextTryHackMe Lookback

Last updated