Heist

There’s a ruby module that works just fine to interact with Wi***

How is the credential working on one port and not the other. If you have an idea of what I may be doing wrong kindly pm me.

3 usernames and 3 pwd and none of them works with that rb exploit, ■■■■

Got user, PM in Telegram (@jorgectf) if you need help ?

@MinatoTW thanks for the adventure! sunday in bed with a new machine + jetlag, great combi

*bedtime now, i will help out tomorrow morning (6 hours from posting this) if anyone needs help.

good, solid fun box! thanks @MinatoTW

I’m having issues and can’t figure out what to do next. I have 3 creds and have figure out you have to use W**** in rb but auth error with the creds. Any help would be appreciated through message.

@Sameasname im right there with you at the minute, i can authenticate using the credz to a lower service but not to win** using the ruby library, also tried it using the python module

@badman89 and @sameasname you have to find the user for the pass you got from attachment. there is an impacket script that will help with that…

@gexus makes sense relooking at the .txt. thanks

Thanks guys! Glad you had fun.

Hi, I saw some people asking for a tool to connect to W***m. Ok I can recommend this tool on which I’m collaborating.

Easy to install via git clone or via gem install (this is even easier). All needed is in the documenation at readme file: GitHub - Hackplayers/evil-winrm: The ultimate WinRM shell for hacking/pentesting

Hope it helps!

Need some help, is it required to get the plaintext password to move forward. None are working on the higher password.

Spoiler Removed

Type your comment> @Seepckoa said:

Type your comment> @Ev1ld3v3l0p3r said:

Need some help, is it required to get the plaintext password to move forward. None are working on the higher password.

Yes you have to find a way to see the password in clear to go further. :wink:

what about the correct user ? none of them works with that ruby exploit

Type your comment> @OscarAkaElvis said:

Hi, I saw some people asking for a tool to connect to W***m. Ok I can recommend this tool on which I’m collaborating.

Easy to install via git clone or via gem install (this is even easier). All needed is in the documenation at readme file: GitHub - Hackplayers/evil-winrm: The ultimate WinRM shell for hacking/pentesting

Hope it helps!

This was my first choice, but didn’t know what to enter for -s and -e, so I finally opted for a different winrm tool:

https://alionder.net/winrm-shell/

Works smooth like silk.

@OscarAkaElvis what am I missing with evil-winrm?

Am stuck on how to find alternative usernames. Have got the 2.5 credential sets okay & have been looking at username enumeration options (including playing some some of the impacket scripts). So far not having much luck.

EDIT - user.txt owned, onto root

-e and -s are to set a local dir containing executables and powershell scripts. Let’s suppose you want to launch a Sherlock.ps1 . Ok, put that powershell script on your local folder, set it using -s and once connected you can launch “menu” command. You’ll see some stuff but not Sherlock stuff (yet). Then, type “Sherlock.ps1” ← it autocompletes using tab, and after pressing enter, Evil-WinRM is loading the powershell into memory. If you launch again “menu” command you’ll see all the available Sherlock commands including the Find-AllVulns command.

someone could send me a PM I tried all combinations of credentials without success. voelvo understand where I’m wrong

oof, i wish there were “hack-alongs”. being a noob is headaching…