SMBCLIENT
OFFSEC - Proving Grounds - LAZYSYSADMIN
·2133 words·11 mins
OFFSEC PG PRACTICE
SMBMAP
SMBCLIENT
WORDPRESS RCE
SMB share access revealed WordPress credentials. After logging into WordPress, we achieved RCE and initial access. Reused togie’s password to gain sudo privileges and escalate to root.
OFFSEC - Proving Grounds - ZINO
·2524 words·12 mins
OFFSEC PG PRACTICE
NXC SMB
SMBCLIENT
Access server with SMB file and use a Python exploit for PHP webshell in Booked Scheduler. Escalate to root via cronjob.