Remote code execution after a valid SMB (net use) password in Windows?

Question

I am doing a capture-the-flag exercise in a Windows scenario.

It uses Windows 2016 server. I was able to find the password and I can access the files with a:

net use z: \\computer\C$  password /user:user

Now, I can read and write on the server. But I need to get code execution on it. This was what I tried:

• The server has a default IIS installation. Trying to upload .asp, .aspx and .php do not work. As I can see, the default installation is only able to store static pages. Is there a programing language it can run?
• Commands like net start look like to only start service in the local machine, not in the server I want.
• Maybe the way is to write in the Startup Folder, but the server will never restart
• I try to overwrite some .exe but it did not start

In Linux, I could simply overwrite the cron files to start a command. But in Windows I don't see how it can have the same result.

So, my question is: Is there a native way to run code on another Windows computer after you have a valid SMB (net use) password?

Answer 1

Modifying the IIS configuration to support ASP, ASP.NET, or some other server-side code (and then uploading a file containing such code and requesting it) would be one approach. It's somewhat surprising that the server is running but isn't already configured thus, but it should be possible to change the behavior if it's in a configuration file.

Windows does not have any file-based equivalent of cron; the equivalent Windows service stores its configuration in the registry. Still, you might be able to overwrite a file that the Scheduled Tasks service will execute periodically (as with cron), or alternatively overwrite the file for a service binary directly (if the service isn't already running but will soon).

Note that, by default, Windows opens files for exclusive access. That means you often can't open (or overwrite, or delete) a file that another process has open, regardless of your privileges. That's especially true for process images (executables and libraries).

There are many, many ways to remotely access a Windows machine if you have a username and password. Hopefully you already tried remote desktop, but did you try SSH? Recent Windows systems have an optional SSH server. Did you try Powershell Remoting?

Alternatively, there are options that don't involve shells. You mentioned that net start doesn't work for remote machines, but did you try sc.exe start? The command-line service control program (sc.exe; note that in powershell sc alone may be an alias to a cmdlet instead) is very powerful and supports remoting. Alternatively, you can use the Windows GUI tools; for example, services.msc - the Windows Service control GUI, a snap-in for mmc.exe (Microsoft Management Console) - can attach to either the local computer or a remote one. For general registry access, both the command-line reg.exe and the graphical regedit.exe support connecting to network machines.