search
HomeGitHubPortfolio Twitter/X Medium Cont@ct

Eternal Blue

tryhackme.com - © TryHackMe

🔗 Bluearrow-up-right

hashtag
Task 1 Reconnaissance - Deploy the machine

hashtag
1.1 - Deploy the machine

🎯 Target IP: 10.10.33.26

Create a directory for machine on the Desktop and a directory containing the scans with nmap.

I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.

Sending these three ICMP packets, we see that the Time To Live (TTL) is ~128 secs. this indicates that the target is a windows system, while *nix systems usually have a TTL of 64 secs.

hashtag
1.2 - How many services are running under port 1000?

3 ports open under port 1000

hashtag
1.3 - What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)

This is an important info:

Microsoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010) https://www.exploit-db.com/exploits/42315arrow-up-right or we can find it with searchsploit (CLI).

MS17-010

hashtag
Task 2 - Gain Access

hashtag
2.1 - Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)

Start Metasploit

exploit/windows/smb/ms17_010_eternalblue

2.2 - Show options and set the one required value. What is the name of this value? (All caps for submission)

RHOSTS

2.3 - Exploit the machine and gain a foothold.

hashtag
Task 3 - Escalate

hashtag
3.1 - Convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected)

hashtag
3.2 - Select this (use MODULE_PATH). Show options, what option are we required to change?

hashtag
3.3 - Verify that we have escalated to NT AUTHORITY\SYSTEM. Run getsystem to confirm this. Feel free to open a dos shell via the command 'shell' and run 'whoami'. This should return that we are indeed system. Background this shell afterwards and select our meterpreter session for usage again.

hashtag
Task 4 - Cracking

hashtag
4.1 - Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

Jon

hashtag
4.2 - Copy this password hash to a file and research how to crack it. What is the cracked password?

We copy this hash and crack it using John The Ripper while using rockyou.txt wordlist.

Jon's credentials are jon:alqfna22

alqfna22

hashtag
Task 5 - Find flags!

hashtag
5.1 - Flag1? This flag can be found at the system root.

As we have a meterpreter shell we could search for a file on the system.

We start by changing our directory to C:/ (root of system). We find the flag1.txt in the system root.

chevron-right🚩Reveal Flag1hashtag

flag{access_the_machine}

hashtag
5.2 - Flag2? This flag can be found at the location where passwords are stored within Windows.

Check directories by using the “dir” command. Then I see the flag1.txt file.

chevron-right🚩Reveal Flag2hashtag

flag{sam_database_elevated_access}

hashtag
5.3 - This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.

After that you see the flag3.txt file, Then read it.

chevron-right🚩Reveal Flag3hashtag

flag{admin_documents_can_be_valuable}

PreviousRootMeNextVulnversity

Last updated