SMBCLIENT
OFFSEC - Proving Grounds - CASSIOS
·2757 words·13 mins
OFFSEC PG PRACTICE
SMB
SMBCLIENT
NXC
YSOSERIAL
PWNKIT
SMB share exposes recycler.ser; app source reveals credentials. Login enables ysoserial RCE, then PwnKit (CVE-2021-4034) escalates to root.
OFFSEC - Proving Grounds - LAZYSYSADMIN
·2133 words·11 mins
OFFSEC PG PRACTICE
SMBMAP
SMBCLIENT
WORDPRESS RCE
SMB share access revealed WordPress credentials. After logging into WordPress, we achieved RCE and initial access. Reused togie’s password to gain sudo privileges and escalate to root.
OFFSEC - Proving Grounds - ZINO
·2524 words·12 mins
OFFSEC PG PRACTICE
NXC SMB
SMBCLIENT
Access server with SMB file and use a Python exploit for PHP webshell in Booked Scheduler. Escalate to root via cronjob.