TryHackMe Post-Exploitation Basics

Enumeration with PowerView

controller\administrator@DOMAIN-CONTROLL C:\Users\Administrator>powershell -ep bypass
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\Administrator> . .\Downloads\PowerView.ps1
PS C:\Users\Administrator> Get-NetUser | select cn

cn
--
Administrator
Guest
krbtgt
Machine-1
Admin2
Machine-2
SQL Service
POST{P0W3RV13W_FTW}
sshd
PS C:\Users\Administrator> Get-NetGroup -GroupName *admin*
Administrators 
Hyper-V Administrators
Storage Replica Administrators 
Schema Admins
Enterprise Admins
Domain Admins
Key Admins
Enterprise Key Admins
DnsAdmins

PS C:\Users\Administrator> Invoke-ShareFinder 
\\Domain-Controller.CONTROLLER.local\ADMIN$     - Remote Admin 
\\Domain-Controller.CONTROLLER.local\C$         - Default share       
\\Domain-Controller.CONTROLLER.local\IPC$       - Remote IPC
\\Domain-Controller.CONTROLLER.local\NETLOGON   - Logon server share  
\\Domain-Controller.CONTROLLER.local\Share      -
\\Domain-Controller.CONTROLLER.local\SYSVOL     - Logon server share

PS C:\Users\Administrator> Get-NetComputer -fulldata | select operatingsystem 

operatingsystem
---------------
Windows Server 2019 Standard     
Windows 10 Enterprise Evaluation 
Windows 10 Enterprise Evaluation

Enumeration with Bloodhound

mimikatz

cracking the admin hash

Golden ticket attacks with mimikatz

Now you can access other machines in the network such as \Desktop-1\c$

Maintaining access

create msfvenom payload, send it using scp, set up meterpreter listener, run shell.exe in windows

Set up persistence

Background the meterpreter session

Run the persistence module

PreviousTryHackMe VulnNet: RoastedNextTryHackMe Lookback

Last updated