mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-24 21:03:07 +00:00
Add files via upload
This commit is contained in:
ARZ
GitHub
parent
d28008216c
commit
3405354cd2
1 changed files with 186 additions and 0 deletions
186
TryHackMe/Medium.md
Normal file
186
TryHackMe/Medium.md
Normal file
|
|
@ -0,0 +1,186 @@
|
||||||
|
# TryHackMe-Hacker Of The Hill
|
||||||
|
|
||||||
|
## Medium
|
||||||
|
|
||||||
|
### NMAP
|
||||||
|
|
||||||
|
```
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
80/tcp open http Microsoft IIS httpd 10.0
|
||||||
|
| http-methods:
|
||||||
|
|_ Potentially risky methods: TRACE
|
||||||
|
|_http-server-header: Microsoft-IIS/10.0
|
||||||
|
|_http-title: PhotoStore - Home
|
||||||
|
81/tcp open http Microsoft IIS httpd 10.0
|
||||||
|
| http-methods:
|
||||||
|
|_ Potentially risky methods: TRACE
|
||||||
|
|_http-server-header: Microsoft-IIS/10.0
|
||||||
|
|_http-title: Network Monitor
|
||||||
|
82/tcp open http Microsoft IIS httpd 10.0
|
||||||
|
| http-methods:
|
||||||
|
|_ Potentially risky methods: TRACE
|
||||||
|
|_http-server-header: Microsoft-IIS/10.0
|
||||||
|
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|
||||||
|
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-03-07 17:02:28Z)
|
||||||
|
135/tcp open msrpc Microsoft Windows RPC
|
||||||
|
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||||
|
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: troy.thm0., Site: Default-First-Site-Name)
|
||||||
|
445/tcp open microsoft-ds?
|
||||||
|
464/tcp open kpasswd5?
|
||||||
|
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
|
||||||
|
636/tcp open tcpwrapped
|
||||||
|
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: troy.thm0., Site: Default-First-Site-Name)
|
||||||
|
3269/tcp open tcpwrapped
|
||||||
|
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||||
|
| rdp-ntlm-info:
|
||||||
|
| Target_Name: TROY
|
||||||
|
| NetBIOS_Domain_Name: TROY
|
||||||
|
| NetBIOS_Computer_Name: TROY-DC
|
||||||
|
| DNS_Domain_Name: troy.thm
|
||||||
|
| DNS_Computer_Name: TROY-DC.troy.thm
|
||||||
|
| DNS_Tree_Name: troy.thm
|
||||||
|
| Product_Version: 10.0.17763
|
||||||
|
|_ System_Time: 2021-03-07T17:03:27+00:00
|
||||||
|
| ssl-cert: Subject: commonName=TROY-DC.troy.thm
|
||||||
|
| Not valid before: 2021-02-18T18:07:12
|
||||||
|
|_Not valid after: 2021-08-20T18:07:12
|
||||||
|
|_ssl-date: 2021-03-07T17:04:06+00:00; +35s from scanner time.
|
||||||
|
49668/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49669/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
|
||||||
|
49670/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49671/tcp open msrpc Microsoft Windows RPC
|
||||||
|
Service Info: Host: TROY-DC; OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||||
|
```
|
||||||
|
|
||||||
|
### PORT 139/445 (SMB)
|
||||||
|
|
||||||
|
<img src="https://imgur.com/jJQJmjr.png"/>
|
||||||
|
|
||||||
|
Didn't found any shares on the machine so now we have 3 http ports to enumerate
|
||||||
|
|
||||||
|
### PORT 80 (HTTP)
|
||||||
|
|
||||||
|
<img src="https://imgur.com/E8KPjxS.png"/>
|
||||||
|
|
||||||
|
I fuzzed for files and directory but found nothing interesting
|
||||||
|
|
||||||
|
<img src="https://imgur.com/iZWyLIQ.png"/>
|
||||||
|
|
||||||
|
We see a `sign-up` page
|
||||||
|
|
||||||
|
<img src="https://imgur.com/mNH5S7D.png"/>
|
||||||
|
|
||||||
|
On registering an account
|
||||||
|
|
||||||
|
<img src="https://imgur.com/3VQRg3W.png"/>
|
||||||
|
|
||||||
|
I uploaded an image having `.jpg` extension
|
||||||
|
|
||||||
|
<img src="https://imgur.com/HGsVv1m.png"/>
|
||||||
|
|
||||||
|
And could see full path of the image
|
||||||
|
|
||||||
|
<img src="https://imgur.com/o0AvsvE.png"/>
|
||||||
|
|
||||||
|
Also inspecting the source code we see that this using javascript
|
||||||
|
|
||||||
|
<img src="https://imgur.com/y1fULEC.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/IO555bb.png"/>
|
||||||
|
|
||||||
|
Now I used burpsuite to send this request to intruder so I could test for command injection but before doing it we need to block the javascript file which is filtering
|
||||||
|
|
||||||
|
<img src="https://imgur.com/4dAkyZy.png"/>
|
||||||
|
|
||||||
|
Make sure to check tick on `Disable Cache` and right click on `script.js` and select `block url` and refresh the page you will be able to use spaces in text field
|
||||||
|
|
||||||
|
<img src="https://imgur.com/IM06xcD.png"/>
|
||||||
|
|
||||||
|
We can now use ping command to verify command injeciton
|
||||||
|
|
||||||
|
<img src="https://imgur.com/0b4vg41.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/nsI8Z7J.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/LOEMxNw.png"/>
|
||||||
|
|
||||||
|
Using a powershell reverse shell I got rce to the machine
|
||||||
|
|
||||||
|
<img src="https://imgur.com/n5Kw9gG.png"/>
|
||||||
|
|
||||||
|
For convinince I generated a payload for getting a metepreter session
|
||||||
|
|
||||||
|
<img src="https://imgur.com/44gJFAG.png"/>
|
||||||
|
|
||||||
|
Ran `winPeas` but nothing interesting
|
||||||
|
|
||||||
|
Also I tried to upload `BloodHound.ps1` to gather information about active directory
|
||||||
|
|
||||||
|
<img src="https://imgur.com/9SHL7Q8.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/OvOFOmV.png"/>
|
||||||
|
|
||||||
|
`Invoke-Bloodhound -CollectionMethod All -Domain troy.thm -ZipFileName loot.zip`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/zM1ZRfA.png"/>
|
||||||
|
|
||||||
|
Now I want this zip archive on my local machine so I could see what information it found
|
||||||
|
|
||||||
|
<img src="https://imgur.com/NWTkMMS.png"/>
|
||||||
|
The reason why I used metasploit : )
|
||||||
|
|
||||||
|
After having the zip archive on my local machine I started `bloodhound` and `neo4j`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/9Oae3ah.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/TH6RsdL.png"/>
|
||||||
|
|
||||||
|
Now simply drag and drop the zip archive it will automatically extract the archive and then you can run quries
|
||||||
|
|
||||||
|
On running the qurey `Find All Domain Admins`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/WdrVCWj.png"/>
|
||||||
|
|
||||||
|
Then running `Kerberoastable accounts`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/yYOhN4C.png"/>
|
||||||
|
|
||||||
|
`Kerberoastable accounts of high value`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/ccJTHw9.png"/>
|
||||||
|
|
||||||
|
Download `rubeus.exe`
|
||||||
|
|
||||||
|
https://github.com/r3motecontrol/Ghostpack-CompiledBinaries
|
||||||
|
|
||||||
|
<img src="https://imgur.com/PI4VaT4.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/xMayFl4.png"/>
|
||||||
|
|
||||||
|
On running rubeus we will immediately get a hash
|
||||||
|
|
||||||
|
<img src="https://imgur.com/sFq3gIX.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/pmT0uS8.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/uNPeqtO.png"/>
|
||||||
|
|
||||||
|
Now we need to run hashcat against it and we are done because `achilles` is an administartor
|
||||||
|
|
||||||
|
<img src="https://imgur.com/mkDBbiX.png"/>
|
||||||
|
|
||||||
|
<img src="https://imgur.com/4CXNo89.png"/>
|
||||||
|
|
||||||
|
It cracks the hash
|
||||||
|
|
||||||
|
<img src="https://imgur.com/WQcdy6a.png"/>
|
||||||
|
|
||||||
|
Now we could either login with `RDP` ,`psexec` or with `evil-winrm`
|
||||||
|
|
||||||
|
### Evil-Winrm
|
||||||
|
|
||||||
|
<img src="https://imgur.com/Ke6ov5d.png"/>
|
||||||
|
|
||||||
|
### Psexec
|
||||||
|
|
||||||
|
<img src="https://imgur.com/ymx40bN.png"/>
|
||||||
Loading…
Reference in a new issue