All Posts

Exploited a CVE in exiftool to get code execution, then privesc'd with neofetch.

SNMP enumeration to find credentials to gain a shell, which we then route to find Pandora CMS, which wa vulnerable to SQLi, to gain foothold. For root, $PATH was exploited.

This was an Active Directory Windows machine, started by finding credentials in an image on the website, then dumped information with LDAP for the domain to find a kerberoastable user, then enumerating more shares with cme, find which accounts were active, and then get foothold. For root, we pfx2john, and find a GMSA exploit on powershell, to reset a higher privilege user's password so we can authenticate with our new credentials.

Exploited a WordPress plugin that exploited Directory Traversal, then enumerated ports with Burpsuite's Intruder functionality. Then we find RCE on a GDB server, which gives foothold. For root, it was a simple screen exploit.

Exploited buffer overflow to gain foothold, and then cracked a .kdbx file to gain the root password.