I could however import the registry settings or deploy them in a. I quickly looked up to see what I could do with this and I found out it’s not much. I noted in the backup there were things like OptionsPasswordAES or SecurityPasswordAES. We came across a backup of TeamViewer registry keys. We were able to find a few open shares and connect to them. Even the network admin did not have local admin on any windows machines nor did they have RDP rights anywhere either. After finally cracking one we quickly found out this place was very locked down. They were unaware of mimt6 and that’s how we started getting some hashes rolling in. They fixed absolutely everything from the report last year. I was on-site at a client and these guys were good. TeamViewer also lets you copy data or schedule tasks to run through their Service, which runs as NT AUTHORITY\SYSTEM, so a low privilege user can immediately go to SYSTEM with a. If you do not have RDP rights to machine but TeamViewer is installed, you can use TeamViewer to remote in.
If the password is reused anywhere, privilege escalation is possible. This was a crazy ride and I learned a ton along the way. Oh man where to even begin with this one.
0 kommentar(er)
