Blueprint—TryHackMe
Hello everyone. I have written this walkthrough to help you to complete this room. Link: https://tryhackme.com/room/blueprint
Overview:
Blueprint is an easy-rated Windows room on TryHackMe focused on web application exploitation and basic post-exploitation techniques. The primary challenge involves enumerating open network services to identify an unauthenticated remote code execution vulnerability in the hosted osCommerce application, leveraging it to gain an initial shell, and extracting local NTLM password hashes (specifically for the “Lab” user to decrypt the password) to fully compromise the host and retrieve the administrative root flag.
Task 1:
There is just one task to find both user and root flags. Let’s start with “Nmap” first.
- sC: Enables Script Scanning using the default set of Nmap Scripting Engine (NSE) scripts.
- sV: Enables Version Detection.
We can see there are so many open ports here. First we check the http (80) port. Open any browser and type the IP address.
As we can see, there is nothing. But in the Nmap scan there is another http (8080) port available. Let’s check that now. http://IP-Address/8080
Here we found one folder, “oscommerce 2.3.4."
If we search this name, we get to know that it’s a known vulnerability.
It’s a Remote Code Execution (RCE) vulnerability.
Let’s run ‘GoBuster’ to find different folders available inside this main folder.
There are so many folders inside the main folder. But after checking every single one of them, we found that ‘/install’ can be useful to create a backdoor.
Get Subrat Keshari Sahu’s stories in your inbox
Join Medium for free to get updates from this writer.
But now let’s try ‘msfconsole’ to exploit the page.
After all the basic configuration, as you can see in the images, we start a meterpreter connection.
After following so many steps, we finally found the root flag for our task.
Now we need to find the “Lab” user NTML hash to decrypt it.
We create a reverseshell command file using ‘msfvenom’ (which I forgot to take a screenshot of) to get the NTML hash of the user.
Now again we start a meterpreter connection and upload the reverse shell file.
After getting the meterpreter connection we upload the ‘shell.exe’ file into the system.
Now execute the file in the first meterpreter connection we got in the first place.
Here we can find the user ‘Lab’ and the NTML hash.
We can use crackstation to crack the hash and find out the remaining flag for this task.
Hope it will be useful to you. Thank you for using my walkthrough to complete this room. If you have any doubt, ask me below.
