| # https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ | |
| # https://twitter.com/richinseattle/status/1354296177743679489 | |
| # if true on powershell command or no error on reg query output you are infected ! | |
| reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig' | |
| reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig' | |
| reg query 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update' | |
| [System.IO.File]::Exists('C:\Windows\System32\Nwsapagent.sys') | |
| [System.IO.File]::Exists('C:\Windows\System32\helpsvc.sys') |
Let pwn the box Scrambled from HackTheBox using only NetExec ! For context, I was reading Scrambled writeup from 0xdf_ when I read this:
smbclient won’t work, and I wasn’t able to get crackmapexec to work either.
To be fair, at the time of his writeup it was true, but not anymore and it's pretty simple with NXC, 5 minutes and you get root :)
Note: I will pass the web part where we get one username : ksimpson
This writeup only highlights some part of the writeup of @0xdf that can be done with netexec instead of using another tool :)
This is not a full writeup of the JAB machine ! Bug fix on dcom is not fully merge into main !
Thanks to @ippsec for the bug report on mmcexec method !
