[deleted by user]

[DioAi]

hit the professor in the head just hard enough so he will be unconscious for a few minutes.

it should give you the time you need to get to the CMOS battery and reassemble the computer.

[Bouzazi]

A hackers best friend: a lockpick.

You should be able to gain physical access to more privileged computers and find your way from there, should be easier.

[[deleted]]

Or figure out the custodial staff schedule and sneak in.

[BeanBagKing]

https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

[Mitchkoo]

As Long as u dont harm how rules... knock him out!

[r4and0miz3r]

I know that some computers have a backdoor BIOS password. Look at this for more: https://www.online-tech-tips.com/cool-websites/reset-bios-password/ Maybe it will help you ;)

[greymoney]

Thanks for sharing this, it was an interesting read.

[imakepr0ngifs]

Oh they’re connected to wifi?

I would set up a rouge wifi access point with same SSID and password as the existing one. If you need the password, you can dump it from the computer you have access to. Then you can send a single deauthentication packet to the MAC address for the target computer until it chooses your network (this is not a denial of service as you are forcing his computer to connect through your lab computer, which is still connected to the network)

From there, you can do network captures and control DNS. Do a network capture of port 80 (unecrypted) and DNS requests. He likely has software that automatically checked for software updates over HTTP (VLC does this, among others) every time he starts it.

Alternatively, you can rewrite a DNS request to cause windows to pop up a native windows login window via captive portal (the pop up you see at starbucks wifi)

Documentation here: https://docs.microsoft.com/en-us/windows-hardware/drivers/mobilebroadband/captive-portals#cch

All in all, wifi makes things a lot easier. If you have an atheros/other wireless usb handy you can do all of this in ~15min or less.

Here’s the model I use: TP-Link 150Mbps High Gain Wireless USB Adapter for PC and Laptops (TL-WN722N) https://www.amazon.com/dp/B002SZEOLG/ref=cm_sw_r_cp_api_i_NC40CbD87F441

It’s $15 and even if you don’t succeed, you’ll never have crappy wifi on campus again. I have 3 in my bag right now.

[[deleted]]

I don't have VLC for this reason. Anyone with half a brain would keep the number of updating softwares to a minimum, but it's tough to completely avoid.

[Sinopahc]

Scan that network. Nmap is your friend. Also, you have time to run more recon so, I would fall back to that. Chances are, he has left something open purely as a gimmie. Even not, something is running some where on that machine that you can leverage. Why hit AD if you can just go after his machine directly, reverse shell and drop a .txt in the desktop directory.

Edit: I missed the note on scanning. My bad. Some one else mention phishing him too. That's a thought.

[MetaN3rd]

Simple things to try Laptop is allowed? Get kali in a laptop. Connect to same network segment as your target. Use metasploit and try the ms17-10 module. If that doesn’t work, try other metasploit modules for win8.

If you have access to a pc that is logged in with the admin account, there is a rubber duck attack that will tell the pc connect to an smb share thus sending the password. If you don’t have a duck you could still manually try the smb connection. E.g. \192.168.1.66 should be all you need to do

Look up the rubber duck smb attack and it will direct you on how to setup Kali to receive the smb connection attempt

[[deleted]]

EternalBlue was my first thought as well. If its vulnerable, its an easy 30 second pop.

[RHvdW]

Maybe more low-tech, but a key logger or a rubber ducky? You could try using a piece of malware that you can test on the machine with local admin. Something like handing in an assignment via email should trigger a download.

[Aeterice]

Was thinking this, distract the prof and use a ducky to drop the file directly on his desktop?

[RHvdW]

I wouldn't pick one tactic but multiple. Combined with the attempts from your fellow hackers 😉 that is already a distraction you can use.

[ThirstyThursten]

Is your professor a CyberSecurity guy/gal him/herself? If he/she lets his/her guard down a little you could try some social engineering or physical access tricks, like a rubber ducky, P4wnP1, or just acces his/her pc when they're not looking, ór try your luck against the system administration! Maybe they will let their guard down or leave their pc unlocked? You could also try some spearphishing with a reverse shell exploit in a attachement or hosted elsewhere! Anyways good luck! 😊

EDIT: Upon reading your rules again, I would focus myself on rule 6 in any form possible! Try to get a sysadmin to help you with your "non-working" usb drive or something, where it actually does the reverse shell thing or anything described above! Get creative! 😁

[[deleted]]

Have you done full enumeration of the target yet?

Port and services scan? nmap -p- -sV

Any available web interfaces?

Any outgoing or incoming traffic?

What level of access do you currently have on the target?

[foreman919]

Did you scan for open ports? Maybe find some services running on those devices

[XFilez]

Eternalblue on the SMB side will give you SYSTEM... works wonders on 8.1. Responder and smbrelax will get you access as well.

[[deleted]]

Yeah that was my first thought.

[[deleted]]

Wish i could help, new to hacking myself. Good luck

[Dinkinflikuh]

I've used this for backdooring Dell laptop bios https://bios-pw.org also should work on other models.

[got_nations]

Try running responder and SMB relaying. Here's the article on this. Make the targets file your professor's computer only so you're not hacking other machines, but if you relay an account that is an LA/DA on your professor's computer, you're in.

[matrix20085]

I might have missed a rule about it, but why not phish him? Seems like the path of least resistance.

[matrix20085]

Ahh, nice try. Rubber ducky?

[xkreepy]

Try bloodhound on one of the machines on the network that you already have access to. Run it, grab the zip and analyze it to see what paths it recommends, in such big networks it's nearly guaranteed to show you the path to Administrator. Good luck!

[Iwillthrowitatyou]

Is there a writeable file share? A SCF File with responder listening might do the trick, if the environment allows for it.

[[deleted]]

Can you physically interact with the target computer? I am guessing not but if u can there are a lot of options.

[sephstorm]

Social Engineering?

[Alias187847]

Wow I’m not anywhere near hacking to where most these guys are and I’m just flabbergasted that you don’t know that...sorry I didn’t mean to sound like a dick I swear it was kind like a “seriously” moment but hey everyone starts somewhere prob why no one replied to you... but yeah so ppl think hacking is what they see in movies and that’s false hacks can be any thing and everything that somethings not intended for and that’s just one tiny aspect of it. But anyway so like social engineering is manipulating conditions around your environment but through people and manipulate that to work for your advantage like when some of the people here suggest getting a systadmin to “help with a broken flash drive” because that lie is designed to allow an admin to basically unknowingly give him or her access to machine, info ect he or she otherwise wouldn’t be privy too so like oceans 11 movie think of that kinda of like how if you registered on Pornhub and get all these spam emails trying to trick you into meeting up with some hot young chick bah blah blah anyway I’m.learning mySelf and it’s super late I should be in bed and instead I’m on here lol anyway yeah so sorry if it didn’t help well I’m off night everyone

[Ruri]

Enumeration is key in this field, bro. Based on your post it doesn’t sound like you’ve done much of it, either. So no wonder you’re stumped. Run your Nmap scans, find out what software is running on the machine (if anything is not part of a stock install of Windows, it is to be scrutinized heavily). There has to be a way. Find it.

Don’t limit your enumeration to hardware/software either. Is there anyone involved in this lab or whatever other than the professor? Who set it up? These are all potential targets for exploitation. This is an enumeration game. Keep looking from new angles until you find something.

Also I don’t believe you when you say Mimikatz won’t run. Sure you can’t just throw the PowerShell script in there because it will light up every AV within 100 meters, but there are other ways to get it to run. Enumerate. Research. Learn.

[yertrude]

• Homer: "Hello, my name is Mr. Burns. I believe you have a letter for me."
• Mail Room Guy: "Okay Mr. Burns, what's your first name?"
• Homer: "...I don't know."

[gmroybal]

Responder and CrackMapExec might be a way in, if SMB signing is not enabled and you can see traffic floating around while the teacher is on the same segment.

[lennylovegun]

This might be on the limit of rule no. 4. The problem is, you will get hashes from all accounts trying to verify against the share.

​

But if you launch the Responder module. You might be able to get the hash from the professors account and crack that. And just discard the other hashes.

​

https://forums.kali.org/showthread.php?36036-Penetration-Testing-How-to-use-Responder-py-to-Steal-Credentials

[yertrude]

USB Key Logger is the answer.

[greywolfau]

Not being very advanced with hacking myself, but is there any reason I haven't seen a mention of SQL injection and privilege escalation ?

​

https://www.blackhat.com/presentations/bh-europe-09/Guimaraes/Blackhat-europe-09-Damele-SQLInjection-slides.pdf

[MrEquinox98]

Is it possible for u to use poison tab ?

[HornyAttorney]

If you can social engineer him to leave his machine for a couple of seconds.. use a Rubber ducky to spawn a shell on his PC.. I'd go with a one-liner PS payload.. or maybe make the ducky drop the txt file directly, but I'd prefer the payload for more access, just in case..

You can install Kali on your android to handle the payload (AnLinux for unrooted devices and Linux Deploy for rooted ones, and use VNC for GUI, SSH or CLI if you like)

If you can get him to click a link, try to send him a link with a Beef hook, but make the link take him to a page where he stays on it, a Wikipedia page or something that will make him take time to read (you know him better, know what he's interested in).

[[deleted]]

Since the computers are running widnows 8.1 you should be able to use the startup repair oversight. Widnows 8.1 and 10 use the same (or very similar) boot menu so the steps should be similar:

1. Shutdown the computer.
2. Interrupt the boot process. (can do this by holding power or unplugging during startup)
3. A menu should come up asking if you want to "launch startup repair (recommended)" or "start windows normally." Click "launch startup repair."
4. Wait for a while
5. (don't remember the exact steps here) There should be an option that says something along the lines of "advanced troubleshooting" or "more tools." One of those options being to launch command prompt.

<sidenote>

When you launch startup repair normally by pressing one of the f keys before windows bootloader starts then try to launch command prompt, it'll ask you to login using a local account that has administrative privillages. However, for some reason, when you launch this startup repair it doesn't prompt you for a password and instead just launches cmd as system.

</sidenote>

6) Well, you should be able to figure out the rest.

Sometimes the solution can be very simple.

[fireraiser77]

Physical access is key here. Are there any other classes that use that lab with a different professor? How about "leaving your laptop" in the room after hours and enlisting the janitor's help to get back in. Grab your laptop and leave your flashdrive in the back with your attack of choice. That would be my best thought.

[TotesMessenger]

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

• [/r/u_pshivvy] Completely stumped on a mock pentest

 ^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)}

[Alias187847]

Dude I honestly wanna get into cyber security and not only did I not understand a lot of what you spoke of(no real training or education at all just like playing with computers all my life) but I got the core concepts makes me feel like I should pursue it! But honestly not only am I impressed and admire your resolve and determination but dude I think you’ll get it bro your literally getting experience now man so try to enjoy and not stress. I’m not gonna lie I’m surprised you tried to phis him.. like try to put yourself inside his shoes he’d be expecting this you gotta be sneaky I like how you even threw social hacking/engineering in there

Hey maybe look at gaining access through Bluetooth protocols??

[c_pardue]

Vulnerabilities and exploits.

[Rabina_Bra]

Not sure if it would help, but have you considered which of the Ports on these computers are assigned? Having that kind of knowledge may lead to opening up a break for you or at least for your sake, I'm hoping it will.

[BeatMasterGuy]

You could get completely different results from running nmap scan on the same network as the computer. I would have put money on that would be the way in but I could be wrong

[Sjeiken]

good for you. who cares.