Rfi

Overview StreamIO is a Windows Active Directory box (domain streamIO.htb, hostname DC) running IIS + PHP with MSSQL as the backend database. The foothold chains a UNION-based SQL injection on a streaming subdomain into credential recovery, a hidden debug parameter that exposes a local file include, and finally a remote file include that reaches a raw eval() for code execution. From there the path is pure credential reuse and Active Directory ACL abuse: database credentials pulled from the web root unlock a backup database with fresh hashes, saved Firefox logins hand over a domain user, and a WriteOwner/Owns edge over a group with ReadLAPSPassword lets us read the LAPS-managed local administrator password and log in as administrator. ...