https://wearethebug.dev/tags/aspx/Recent content on WE ARE THE BUGTradecraften-usFri, 19 Jan 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-lock/Fri, 19 Jan 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-lock/Lock is an Easy-rated Windows machine that involves enumerating a Gitea repository to find a Personal Access Token. This token is then used to deploy an ASPX web shell on the server, which provides an initial foothold. A password is then decrypted from an mRemoteNG configuration file, providing access to a new user account. Finally, a local privilege escalation vulnerability in the PDF24 application is exploited to obtain a shell with SYSTEM privileges.https://wearethebug.dev/posts/vl-job/Sat, 27 Nov 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-job/Job is a Medium-rated Windows box. It runs an SMTP server and its website accepts LibreOffice-compatible documents, providing a vector to deliver a document with embedded macros that leads to remote code execution as user jack.black. jack.black is a member of the DEVELOPERS group, which has write access to the IIS web root, allowing files to be placed in the webroot and achieve code execution as the IIS AppPool service account. The IIS AppPool account has the SeImpersonate privilege, creating conditions that allow token-impersonation techniques to be used to escalate privileges to Administrator.