Enumération
Énumération rapide sur tous les ports TCP
nmap -T5 -p- 10.10.112.194
Il y deux ports qui sont ouverts :
- 80 http
- 3389 rdp
En résumé, il faut trouver des identifiants sur le site WEB pour ensuite se connecter en RDP.
Enumération Web
Avec Gobuster :
gobuster dir -u http://10.10.112.194 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
Dans le répertoire /retro, on peut récupérer deux choses. Le nom d’utilisateur Wade et son mot de passe. Ce dernier se trouve dans les commentaires « Ready Player One« .
Accès initial
Avec les identifiants récupérer, on peut se connecter sur le port 3389 via xfreerdp.
Commande :
xfreerdp /u:wade /p:parzival /v:10.10.138.95
Escalade de privilège - CVE-2019-1388
Sur le bureau se trouve une application nommée hhupd.exe. En l’ouvrant, Windows nous demande d’authentifier un compte administrateur.
En cliquant sur « Show information about the publisher’s certificate« , la fenêtre suivante s’ouvre.
Il faut cliquer sur « VeriSign Commercial Software Publishers CA« . Il ne se passe rien. C’est normal. La fenêtre d’Internet Explorer s’est ouverte en arrière-plan. Il faut donc fermer les fenêtres que l’on vient d’ouvrir.
Sur la fenêtre d’IE, il faut enregistrer la page, soit en passant par le menu, soit via crtl + s.
Une fois la fenêtre de l’explorateur Windows ouverte, il faut se rendre dans c:\windows\system32\ puis sélectionné cmd.exe dans la liste pour ensuite l’ouvrir.
Dans le cas où les .exe ne s’affiche pas, il est possible de rentrer directement le chemin vers cmd.exe.
À savoir : c:\windows\system32\cmd.exe
L’interpréteur de commande qui s’ouvre a des droits nt authorit\system.
Explication.
L’ouverture du lien de Verisign est gérée par en amont par la demande d’authentification, donc par le système. C’est donc avec des droits système que l’on sauvegarde la page et par conséquent l’ouverture de cmd.exe est aussi faite par le système.
Task 2 Activate Forward Scanners and Launch Proton Torpedoes
Answer the questions below
- How many ports are open on our target system?
2
- Looks like there’s a web server running, what is the title of the page we discover when browsing to it?
IIS Windows Server
- Interesting, let’s see if there’s anything else on this web server by fuzzing it. What hidden directory do we discover?
/retro
- Navigate to our discovered hidden directory, what potential username do we discover?
wade
- Crawling through the posts, it seems like our user has had some difficulties logging in recently. What possible password do we discover?
Redacted
- Log into the machine via Microsoft Remote Desktop (MSRDP) and read user.txt. What are it’s contents?
THM{HACK_PLAYER_ONE}
Task 3 Breaching the Control Room
- When enumerating a machine, it’s often useful to look at what the user was last doing. Look around the machine and see if you can find the CVE which was researched on this server. What CVE was it?
CVE-2019-1388
- Looks like an executable file is necessary for exploitation of this vulnerability and the user didn’t really clean up very well after testing it. What is the name of this executable?
hhupd
- Research vulnerability and how to exploit it. Exploit it now to gain an elevated terminal!
No answers needed
- Now that we’ve spawned a terminal, let’s go ahead and run the command ‘whoami’. What is the output of running this?
nt authority\system
- Now that we’ve confirmed that we have an elevated prompt, read the contents of root.txt on the Administrator’s desktop. What are the contents? Keep your terminal up after exploitation so we can use it in task four!
THM{COIN_OPERATED_EXPLOITATION}
Task 4 Adoption into the Collective
Return to your attacker machine for this next bit. Since we know our victim machine is running Windows Defender, let’s go ahead and try a different method of payload delivery! For this, we’ll be using the script web delivery exploit within Metasploit. Launch Metasploit now and select ‘exploit/multi/script/web_delivery’ for use.
- First, let’s set the target to PSH (PowerShell). Which target number is PSH?
2
- After setting your payload, set your lhost and lport accordingly such that you know which port the MSF web server is going to run on and that it’ll be running on the TryHackMe network.
No answer needed
- Return to the terminal we spawned with our exploit. In this terminal, paste the command output by Metasploit after the job was launched. In this case, I’ve found it particularly helpful to host a simple python web server (python3 -m http.server) and host the command in a text file as copy and paste between the machines won’t always work. Once you’ve run this command, return to our attacker machine and note that our reverse shell has spawned.
No answer needed
- Last but certainly not least, let’s look at persistence mechanisms via Metasploit. What command can we run in our meterpreter console to setup persistence which automatically starts when the system boots? Don’t include anything beyond the base command and the option for boot startup.
run persistence -X
- Run this command now with options that allow it to connect back to your host machine should the system reboot. Note, you’ll need to create a listener via the handler exploit to allow for this remote connection in actual practice. Congrats, you’ve now gain full control over the remote host and have established persistence for further operations!
No answer needed