#junior-pentester-path | TryHackMe | Page 31

modest arch Jul 16, 2022, 5:25 PM

#

@idle bison thanks

next lanceBOT Jul 16, 2022, 5:25 PM

#

Gave +1 Rep to @idle bison

modest arch Jul 16, 2022, 5:26 PM

#

@steel nymph thanks

glad grail Jul 17, 2022, 1:27 PM

#

Hello

solid pollen Jul 17, 2022, 3:00 PM

#

HELLO

remote iris Jul 17, 2022, 4:00 PM

#

Hi.

drowsy tapir Jul 17, 2022, 11:54 PM

#

hey

uncut stone Jul 18, 2022, 3:04 PM

#

Hi guys. I don't understand a certain Windows Privilege Escalation technique. It is about "Unquoted Service Paths". As a negative example, a service
sc qc "disk sorter enterprise"
is listed. Since the name of the folder "Disk Sorter Enterprise" contains spaces, the command is said to be ambiguous.

#

#

The SCM tries the following 3 commands through. My question: Why is it ambiguous? After all, that is exactly why there are in quotes.

#

If I wanted to attach the arguments, I would have thought one would write it that way:
sc "disk sorter" enterprise
I'm a little confused by that.

#

sry, i dont understand your question

#

#

It is the service name

#

sry I haven't quite figured it out yet. So once we have the service path and the service name.

#

sc asks (to my knowledge) for the service name.

#

SCM is now trying to find the service path?
But based on the service names, right?

#

When I type sc qc "disk sorter enterprise", why would SCM look in C:\MyPrograms\Disk.exe?
I understood that pathname and service name are not the same. But then where is the connection between them?

#

omg, you just opened my eyes in something!

#

I thought it was the quotes in the sc qc command. It is the quotation marks in the BINARY_PATH_NAME.

#

i focused on the wrong quotation marks.

#

@steel nymph Thank you

next lanceBOT Jul 18, 2022, 3:35 PM

#

Gave +1 Rep to @steel nymph

tidal belfry Jul 19, 2022, 3:06 AM

#

just got my tryhackme Jr pentester certificate! course was great

#

Windows privesc was the hardest part but very important. I needed to do some windows fundamentals rooms first

uncut stone Jul 19, 2022, 1:10 PM

#

I am currently on the Windows privilege chapter "SeTakeOwnership" where utilman.exe is exploited. The following steps:

we take ownership of utilman.exe
we set the permission of utilman.exe to (F), Full Control, so that our user has full rights to it.
We overwrite (cmd-command copy) utilman.exe with cmd.exe.

Why did the overwritten utilman.exe (which is really the CMD) take the settings from the previous utilman.exe? The rights are (F). Shouldn't it normally have the permission properties of cmd.exe, because copy?

uncut stone Jul 19, 2022, 1:49 PM

#

I have a hunch. Copy creates a copy. However, if a file with the name already exists, then Copy overwrites the contents. Is that correct?

#

Because I thought that instead of overwriting the file contents, copy would delete the old file and then create a new file.

tidal belfry Jul 20, 2022, 8:05 AM

#

uncut stone ------------ I have a hunch. Copy creates a copy. However, if a file with the na...

if you copy cmd.exe to cmd.exe. then it overwrite

#

same with utilman.exe

#

i think Ease of Access button on Lock Screen starts Utilman service as the SYSTEM, so when you copy cmd.exe and replace it to Utilmain.exe you trick the SYSTEM to open cmd.exe as SYSTEM

#

and get all the Loot!

uncut stone Jul 20, 2022, 8:12 AM

#

tidal belfry if you copy cmd.exe to cmd.exe. then it overwrite

yes, thanks 🙂

next lanceBOT Jul 20, 2022, 8:12 AM

#

Gave +1 Rep to @tidal belfry

uncut stone Jul 20, 2022, 9:18 AM

#

tidal belfry just got my tryhackme Jr pentester certificate! course was great

I finished my Jr pentest path now, too. Incredible knowledge and mass of fun! ❤️

tidal belfry Jul 20, 2022, 9:21 AM

#

learned a lot from Jr pentester really cool path

uncut stone Jul 20, 2022, 9:44 AM

#

tidal belfry learned a lot from Jr pentester really cool path

What will be your next mission?

tidal belfry Jul 20, 2022, 9:49 AM

#

uncut stone What will be your next mission?

i did web fundementals path > jr pentester (just finished few days ago) > now starting offensive pentester path

#

what you doing next boxes or taking a path

uncut stone Jul 20, 2022, 9:54 AM

#

I will harden my previous knowledge. I have made my own notes on each module. Repeat and crack machines at my level.

lean moat Jul 20, 2022, 4:06 PM

#

Added the shebang, still the reverse shell won't execute

shadow echo Jul 20, 2022, 4:07 PM

#

lean moat Added the shebang, still the reverse shell won't execute

What are the permissions of the file you want cron to execute ?

lean moat Jul 20, 2022, 4:08 PM

#

shadow echo What are the permissions of the file you want cron to execute ?

it's antivirus.sh. I did do chmod +x to it

shadow echo Jul 20, 2022, 4:09 PM

#

lean moat it's antivirus.sh. I did do chmod +x to it

Where is your antivirus.sh located ?

lean moat Jul 20, 2022, 4:09 PM

#

shadow echo Where is your antivirus.sh located ?

/home/karen

shadow echo Jul 20, 2022, 4:10 PM

#

lean moat /home/karen

Then check the crontab again, /home/karen is not in the PATH variable for the crontab

#

Thus it's not looking in /home/karen for it for the cron job that hasn't specified a path for antivirus.sh

lean moat Jul 20, 2022, 4:15 PM

#

shadow echo Then check the crontab again, /home/karen is not in the PATH variable for the cr...

but then I don't have the permission to create an antivirus.sh file in the root, where the cronjob would run. Unless we're talking about another fi....ouuuuh! Got it. Thanks star!

next lanceBOT Jul 20, 2022, 4:15 PM

#

Gave +1 Rep to @shadow echo

pliant river Jul 20, 2022, 4:52 PM

#

Hello

#

any body knows if the jr pentester path gives you the skills for the ejpt certification?

narrow rover Jul 21, 2022, 12:01 AM

#

Hi
I'm on the linux privesc part and noticed that in the PATH section when the gcc is done, the user doing it is root. but unless I'm mistaken we're trying to get root access at this point.
So am I missing something or is this part a bit misleading ?

narrow rover Jul 21, 2022, 1:01 AM

#

Ok, ok. no problem. I was still able to do it. I'll try my hand at the Capstone Challenge now

halcyon python Jul 21, 2022, 8:36 AM

#

hi

#

i'm confusing the difference between search and searchsploit in metasploit

#

what do they each preference to?

maiden stratus Jul 21, 2022, 8:38 AM

#

searchsploit is a cli tool which can be used without msf, search is specific to the msf console

halcyon python Jul 21, 2022, 8:40 AM

#

so they are the same if i used in msf console, right?

maiden stratus Jul 21, 2022, 8:42 AM

#

probably 🤷‍♂️

halcyon python Jul 21, 2022, 8:43 AM

#

😂 ok

#

thanx a lot

midnight shoal Jul 21, 2022, 3:17 PM

#

halcyon python so they are the same if i used in msf console, right?

searchsploit searches for the vulns and shows the asociated script that you can use. so IE you can search for CVE xxxx and it will give you something like 6574654.py then youd do like searchsploit -m 6574654.py to download and use

#

SEARCH is for msf just searches the CVE and is an injection for vulns telling you what it does

#

so youd search "blue" or "apache 2.x.x" and itd list all the vulns and what they do and allow you to set up options instead of using the py scripts

halcyon python Jul 22, 2022, 2:17 AM

#

ohhhh i got it

opal hawk Jul 22, 2022, 10:18 AM

#

Can any one help me with jr penetration testing rooms > windows privileged escalation> task 6 abusing dangerous privileges

How to deploy this machine as the task is related to windows but when i am starting the machine in that room and start attack box it gives me linux machine

idle bison Jul 22, 2022, 10:27 AM

#

opal hawk Can any one help me with jr penetration testing rooms > windows privileged escal...

The attackbox is not the target

#

Not all rooms have in browser access

opal hawk Jul 22, 2022, 10:29 AM

#

And in task 7 of the same i am not able to run the script after adding the user pwnd

net user pwnd SimplePass123 / add & net localgroup administrators pwnd /add

#

I am using this command in powershell

idle bison Jul 22, 2022, 10:30 AM

#

-warn @opal hawk Do not send unsolicited direct messages, it is against rule 1 of the discord

next lanceBOT Jul 22, 2022, 10:30 AM

#

⚠ Warned Akbar Khan#6138

opal hawk Jul 22, 2022, 10:31 AM

#

Ok sorry i wasnt aware