Official Love Discussion

After a lot of frustration (and hours of trying) I managed to get the root as well!!

The thing is that I actually happened to open a win priv esc website at the correct chapter, and after checking some registry keys I knew what to do. BUT… no matter what I did, it just didn’t work. Among others, I tried everyone’s favorite hacking console ;), which even said the target is vulnerable, but still wouldn’t give me a session. I tried via cmd and powershell, but the furthest I got was an error message stating “The Windows Ir Service could not be accessed. This can occur if the Windows Ir is not correctly installed.” I even started suspecting that someone is messing with this box, but a restart didn’t solve the problem.

After starting over from the very beginning I found out that there is actually another very different way to get in to the system as user!! This second route is a bit longer, but the correct one. Repeating everything here works like a charm. I can root the box using all of the above methods, which neither of worked when accessing the system differently.

So here is my question to you gurus: why don’t the e*****i command (the last command which gives the root) work on the same exact payload file planted in the system, when the system is accessed via winrm? I did some studying and learned that this method executes in session 0 where as the correct route executes in session 1. I am kind of guessing this relates to the explanation, as everything else looks the same (I have two meterpreter consoles open side by side and can not find any other differences). Is someone able to explain this? Would appreciate much, thanks :slight_smile:

ps. the rabbit hole was too deep!!