Record a breakthrough in dongle Privilege Escalation

.. Decisively lose the sword.

The FCK editor is relatively simple to use shell, which can be directly uploaded twice ..

After obtaining the shell, I checked that the permission is still very high, so I was prepared to raise the permission. Let's take a look at the components.

Wscript. shell is deleted. Check the Script test. Support aspx and change horses. Then a cmd is uploaded to C: \ RECYCLER .. See if you can execute the command,

You can execute commands. Ww.2cto.com, but the net user does not show back, it should be net disabled, decisive upload ms11080.

The user is added .. But this is the case during connection.

Try the second method .. Save the following code as 1.vbs.

Set o = CreateObject ("Shell. Users ")

Set z = o. create ("user ")

Z. changePassword "12345 ",""

Z. setting ("AccountType") = 3

Run the command with the system permission .. The password of a user is 12345 ,,

Executed successfully .. But it still doesn't work ..

 

 

Third-party software is probably blocked. Decisive tasklist ..

We used to have a dongle ..
I tried remote control ..

So we are going to hijack the shift backdoor and directly replace sethc ..

Check the connection .. 5 shift. No backdoor is found.

So I looked at the process .. Yes ,,

Replace MY_sethc .. 5 shift ..

Log on to add users .. Fruitless

Open the dongle .. Check it. It is intercepted.

Disable account protection. Because net is disabled, you can directly run ms11080 or 1. vbs to add users ..