N-point virtual machine elevation

A friend lost a virtual machine and said he wanted to raise the privilege. The execution of 0DAY EXP on a third party cannot be mentioned. All have been patched ,. Okay. Not to mention nonsense. Next let's look for available things that the virtual machine supports

ASP ,. NET, PHP
Upload An ASPX Trojan to list IIS files

Found. The assigned permissions are not very dead. It can also span directories ,. Virtual Machine Management directory found

N point virtual machine. I flipped through the contents in the directory. He found his database. Download and view. Encrypted account and password,
SA and ROOT. Is encrypted. I thought about it. It seems that Baidu has an article saying that the decryption of the VM at was reversed. I went to Baidu for a moment and finally found it after wandering for a long time.
<! -- # Include file = "conn. asp" -->
<! -- # Include file = "siteinfo. asp" -->
<! -- # Include file = "char. asp" -->
<%
Set iishost = server. CreateObject ("npoint. host ")
X = iishost. Eduserpassword ("RNTYQ @ DLLDDNEKFLK @ EKHHMCGBFCDDFEBKFNDM @ MHKBIJIPDMJ @ B", 0)
Response. write x
%>
I think you can understand it, but you must put it in the program directory. But no write permission. You can only download one set of programs by yourself.
Then install and place the file in the INC directory. Inc/111.asp

Replace ciphertext first
<! -- # Include file = "conn. asp" -->
<! -- # Include file = "siteinfo. asp" -->
<! -- # Include file = "char. asp" -->
<%
Set iishost = server. CreateObject ("npoint. host ")
X = iishost. Eduserpassword ("LJDNI @ OFHMOCBFKEAAINJOADHMNEKIODCHMONHMI @ E", 0)
Response. write x
%>
Then, access the WEB directory of the ndian virtual machine on the local machine

Plaintext is successfully solved.

Now that the plaintext is resolved, Let's connect and see if this civilization is MYSQL.

Put a trojan connection,

If the connection is successful, I will not talk about the method of elevation of permission. It is estimated that we will continue smoothly and solve SA. It is also convenient to raise the right.
Here is a MYSQL permission escalation method.
This article is from: www. hake. cc/