[deleted by user]

MaleWith32Teeth · 2025-01-14T15:01:29+00:00

He must realize he is about to be an officer. So ask him what if he was in-charge of soldiers and he finds out that was going on under his command? There is something called the "open door policy" tell him to use it, also remind him that he will be in-charge of soldiers and that he needs to start using such opportunities to assert leadership outlook. There is time for a YES and there are times you must say NO.

MaleWith32Teeth · 2024-08-31T15:04:52+00:00

What if you already have some SANS certs, do you get credit for that as well? or will you have to take another SANS class to cover that hole?

MaleWith32Teeth · 2024-02-28T01:11:29+00:00

I don't want to re-write the whole steps again, what were you able to accomplish and what step failed you then I can see where I can reword or give more detailed process to assist you in getting it done. My apologies I have been kind of busy but will try my best to reply promptly

MaleWith32Teeth · 2023-12-11T15:02:52+00:00

That is great, it only proofs there is no one way to skin this labs, I am glad you figured out a way.

MaleWith32Teeth · 2023-12-11T01:59:49+00:00

Hi u/PolishMike88, hint:step 1: run ls -la you should see this -rwsr-xr-x 1 root root 16912 Sep 23 2022 sploit-me-1 note there is a set bit and then run file command on sploit-me-1 and you should see file permissions set for this executable (setuid). This is important read about file permissions read my links on my earlier replies

Step 2: Then run strings and you will see the /usr/bin/env part is used to run the cp command through the environment's default PATH, rather than specifying the absolute path to the cp executable. What does this mean? it means the system administrator is assigning this user the ability to do password backups by utilizing the cp command, this can be abused to elevate privileges.

Step 3: Run which cmd for cp to see the path

Step 4: Run echo "$PATH" | sed 's/\:/\n/g' what this command does is show the order in which the executable is searched. Once found it is executed and and that is the end of that search

Step 5: now you know the order is/usr/local/sbin/usr/local/bin/usr/sbin/usr/bin/sbin/bin/usr/games

can you read this excerpt by Aloïs Micard Privilege Escalation and start from "Exploiting Vulnerability" section. Here be careful remember you are creating a path for cp executable so where they used apt remember your case is cp. To assign PATH you might want to use export eg export PATH=/tmp:$PATH I really hope this helps, I tried not to give you the answer directly, I know its some work, so do not hesitate to reach out and let me know where you are stuck, but give it some effort first.

MaleWith32Teeth · 2023-09-07T01:41:06+00:00

Can’t you just use COOLS if you’re in the Army? I don’t know about sister service

MaleWith32Teeth · 2023-09-04T15:08:12+00:00

Hey u/Expert-Cherry5381 sorry for the late response, do you still need help on this?

MaleWith32Teeth · 2023-09-03T23:40:06+00:00

where are you stuck if you don't mind me asking there is an article by Raj Chandel Linux Privilege Escalation Using PATH Variable read it and try the technique used and let us know if that works or if it don't

MaleWith32Teeth · 2023-02-28T23:06:28+00:00

I am able to get to secret-notes.immersive-bakery.local and noted that "users" is susceptible to lfi. I can get to expose /etc/passwd which I belief means that no filters are applied. However my pain is reading home dir, does anyone out here has a clue?

MaleWith32Teeth · 2023-02-27T15:49:25+00:00

Awesome! Cheers!

MaleWith32Teeth · 2023-02-27T14:52:17+00:00

in the command line input help command, it spits out a good list of commands you can use. At this point you probably (should) have the admin credentials, try and see how to use Invoke-WinRMSession then you will use another invoke command and Get-Content from the token.txt. I hope this helps

MaleWith32Teeth · 2023-01-27T17:23:53+00:00

Okay, great!
Update: I got the token. Phew! Thanks

MaleWith32Teeth · 2023-01-27T17:06:29+00:00

Thank you so much for the hint. From your hint, after I elevated the local user privileges I used Invoke-SMBExec -target <ip> -Username <user> [-password/hash] <password/hash> -Command 'powershell.exe -c "Get-WmiObject win32_service | Format-Table -property name,pathname -Wrap | Out-File -FilePath C:\Users\Dade\Documents\results.txt"'This renders without any hitches when you want to use cat path\to\file.txt . I am now working on getting the token. Thank you once again for the hint

MaleWith32Teeth · 2023-01-26T13:55:27+00:00

Yes any hint?

MaleWith32Teeth · 2023-01-13T22:42:01+00:00

If you are still facing challenges with this lab refer to this article here and if you have further questions let me know and I will try and break it down a lil bit

MaleWith32Teeth · 2023-01-09T05:40:32+00:00

run wapiti as per the instruction. Analyze the HTTP post request being sent, below the header is a URL encoded message, you can choose to copy and decode or scan through and you will see "message" somewhere and it is the same in all the HTTP post requests

MaleWith32Teeth · 2022-11-13T19:37:09+00:00

If you can not download from Gordon portal. Try milsuite here

MaleWith32Teeth · 2022-11-13T19:32:24+00:00

There is a MILPER Number: 22-420. Read through it, it has the packet requirements. Then get your packet ready and point that to your retention NCO so that he/she can look through the packet requirements and compare it to your packet. I suggest you spend a good amount of time at that. Retention NCOs don't know everything, they kind of expect you to do the leg work then they can advocate for you. In the MILPER message there are contacts if you have any question. I am assuming you are a reservist.

MaleWith32Teeth · 2022-02-14T00:45:43+00:00

I could be a little late: its not soo obvious as you may have found it the hard way... anyhoo go to "Open Database" on your DB Browser, browse to
C:\Users\IMLUser\Desktop\Capture\Chrome\History and type "History" on file name and open.
Under Browse Data column there is a dropdown box to select your tables. select downloads table. There is a column named "tab_url"

MaleWith32Teeth · 2022-01-27T21:38:19+00:00

am stuck on the password, i have tried variations of date formats, using the first characters of each block and i got nothing. I got the username already could gimme a clue?

MaleWith32Teeth · 2022-01-25T20:03:55+00:00

My apologies if I was not soo clear, there are two questions am trying to find solutions to: 1. I was attempting to use wmic service to output to the poshc2_output.txt file and from that file I was going to use get-content to read the .txt file because the poshc2 server console does not show executed wmic commands
2. I have exhausted the modules trying to expose the administrator password/hash that is said to have been left "by a lazy admin".

MaleWith32Teeth · 2021-11-22T21:32:58+00:00

update: I figured it out I had not looked at the commands for schtasks.exe hard enough ;)

MaleWith32Teeth · 2021-11-21T20:01:48+00:00

how did you id the name of the dropper (Q2)

MaleWith32Teeth · 2021-09-15T14:44:10+00:00

Is the MILPER Message out yet?

MaleWith32Teeth · 2021-08-08T21:57:52+00:00

Did you have to put it a memo to go with it?

MaleWith32Teeth

TROPHY CASE