[osamy7593]

i have already rooted,

after i ran bloodround i found easily the way, lorra199 have genericwriter exploit, click on right left mouse, you can use linux mode to exploit it.
every root you can use you kali machine. no need powershell.
just use impacket on all

but how do you guys got the lorra199 pass?

Bro how can i get liza password i stuck

C:\Users\lorra199\Desktop> Get-ADObject -filter 'isdeleted -eq $true -and name -ne "Deleted Objects"' -includeDeletedObjects -property *

Get-ADObject -IncludeDeletedObjects -Filter {isDeleted -eq $true -and Name -like "Liza Kazanof"} -Properties *

Restore-ADObject -Identity "ebe15df5-e265-45ec-b7fc-359877217138" -NewName "LizaKazanof_Restored"

net user will show you

i used net user can;t see it

[jj00]

make an acc as freelancer and go there freelancer.htb/accounts/recovery/ .. after that recover as employer and login as employer

can you explain how yourecover as employer from freelancer account ?

[Greder]

Could someone help me how to go from user lorra199 to liza

[osamy7593]

make an acc as freelancer and go there freelancer.htb/accounts/recovery/ .. after that recover as employer and login as employer

can you explain how yourecover as employer from freelancer account ?

After creating an employer user .. Click on forget password from login page .. Set the employer new password and login

[0xAnon]

Stuck inside lorra199, have restored lkazanof's info from bin. HTB reset me and thank god I saved credentials for lorra, but what is password for lkazanof?

[osamy7593]

Stuck inside lorra199, have restored lkazanof's info from bin. HTB reset me and thank god I saved credentials for lorra, but what is password for lkazanof?

also need to know its pass

[mongocrypt]

('42000', '[42000] [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]User does not have permission to perform this action. (15247) (SQLExecDirectW)')

select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name;

[imhitt]

Any hit for "Generic Write to DC" and "Dcsync to Domain" ?

[j868K3792]

Did someone get issue when secretsdump didn't show hash? Only shows:
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Cleaning up...

[daddybird]

write up - https://liquidrage.in/?p=1718

got both lora199 and liza, need a nudge for Generic Write to DC --> Dcsync to Domain

Why the fuck would you share a password protected writeup and not provide the password

If I have the password to the writeup, why would I still ask for nudge here?

0039318f1e8274633445bce32ad1a290