I am doing a capture-the-flag exercise in a Windows scenario.
It uses Windows 2016 server. I was able to find the password and I can access the files with a:
net use z: \\computer\C$ password /user:user
Now, I can read and write on the server. But I need to get code execution on it. This was what I tried:
- The server has a default IIS installation. Trying to upload
.asp
,.aspx
and.php
do not work. As I can see, the default installation is only able to store static pages. Is there a programing language it can run? - Commands like
net start
look like to only start service in the local machine, not in the server I want. - Maybe the way is to write in the Startup Folder, but the server will never restart
- I try to overwrite some
.exe
but it did not start
In Linux, I could simply overwrite the cron files to start a command. But in Windows I don't see how it can have the same result.
So, my question is: Is there a native way to run code on another Windows computer after you have a valid SMB (net use
) password?