Deploy & hack into a Windows machine, leveraging common misconfiguration issues.This room is not meant to be a boot2root CTF; rather, it is an educational series for complete beginners. Professionals will likely get very little out of this room beyond basic practice as the process here is meant to be beginner-focused.
Introduction
https://tryhackme.com/room/bluehttps://tryhackme.com/room/blue
The virtual machine used in this room (Blue) can be downloaded for offline usage from https://darkstar7471.com/resources.html
Scanning & Enumeration
As soon as we deploy the machine, we are provided with the Target IP: 10.10.222.170
Nmap Scan
This nmap scan tells us that Samba service is running on the server and that the target machine’s operating system is Windows. We also observe multiple RPC services up and running. We also notice that there is a user named JON.
Service Enumeration
Since there are no other attack surfaces, we proceed with enumerating Samba.
We know from our Nmap Scans the specific version of Samba to be : Windows 7 Professional 7601 Service Pack 1 microsoft-ds
Let us enumerate the service
It takes a lot of time :P and we do not see a lot of results.
Let’s try to see if the service version is in itself vulnerable? Sometimes we may even get boxes that may not need a lot of enumeration. Let’s see if this is one of them
Vulnerability Analysis
Let us look up the version that we have for this Samba service.
A simple google search gives us the top two results that are really important
1. Exploit-Db — Has all the public exploits
2. Rapid7 is the company that has made Metasploit, that means that there should be a ready to use the module in Metasploit.
Checking exploit-DB tells us that this is the famous Eternal Blue exploit that was responsible for WannaCry Ransomware (https://en.wikipedia.org/wiki/EternalBlue).
We can do this in two ways:
1. Simply use Metasploit and get done.
2. The harder way of exploiting it manually.
Exploitation
Let us first go in the harder way, the exploit is python code.
When we try running the code using python3 we get errors like module not found, we can install those modules by simply using pip3 install <package_name> , except ‘mysmb’
So I started looking for ways if someone has any blog that has mentioned this, I found https://null-byte.wonderhowto.com/how-to/manually-exploit-eternalblue-windows-server-using-ms17-010-python-exploit-0195414/
The fix is simple, we need to download mysmb.py from github and keep it in the same directory as the exploit code. To download the file run
Once we have that, let us try to run without any parameters.
We get a usage message, saying that we need to provide an IP and a pipe name. Now we know the IP, but I am clueless about what this pipe_name is all about. Let’s google.
So far so good, now we know what a pipe name is, now we need to figure out how to get these names!
There is a Metasploit module that can help us, but we are trying the harder way, so let us try to use the first result.
Looks like even this new script uses Metasploit (in one way or another)
I am not sure if this is allowed in OSCP, so I tried a little more to find some other tool, finally found this(https://github.com/p33kab00/pipe-scan). At this point, I am not sure if this is going to work.
I know this could have been a lot simpler if I used Metasploit, but since I am learning and have ample amount of time, let’s do this !
I found no help with the script :(
So I started reading a little more, and I found this ( on — https://bestestredteam.com/2019/03/15/using-smbclient-to-enumerate-shares/).
Now it clicked, we saw so many RPC running on different ports, in the script as well we see that some 42 names were checked! I quickly open up the code and find this!
I am sure we might find a hit on some of the RPCs, let’s try that!
List of MSRPC Ports on the target machine: {135,49152,49153,49154,49158,49160}
Let us run the script against port 135. It feels like it is taking generations… Losing my patience 😠
So I thought of checking for pipe_names using Metasploit( what if the scans tampered the system, and it is not running properly ?)
Clearly, something is not right …
So I then thought of providing the names of all the 42 named_pipes that we had. Sadly, even this did not work out.
I finally recalled that there is a machine on HTB names Blue, and Rana-Khalil’s Blog must have a solution without using Metasploit.
After reading this, I thought of proceeding with the same approach.
I had only downloaded the mysmb.py, the rest of the two steps …
Let us generate the payload
Now we need to check for credentials - enum4linux -a <target-ip>
We did not get any info that would suggest that guest login is allowed, so I tried to manually add the user using the flag ‘-u’
Hence, we do not need to add a username to the script
I guess there is some error with the remote host. But before doing that, let us try and use Metasploit once, and see if we can get access.
Surprisingly, we get the meterpreter session!
Flag 1 — User directory
Flag2? *Errata: Windows really doesn’t like the location of this flag and can occasionally delete it. It may be necessary in some cases to terminate/restart the machine and rerun the exploit to find this flag. This relatively rare, however, it can happen.
A little bit of google and we find out that the directory is ‘C:\Windows\System32\config’
Parting Thoughts
I am not sure why the other methods did not work out. If I find another way, I shall update this blog, in the meantime, if I need to exploit Eternal_Blue ASAP, I would use Metasploit :P
P.P.S. If anyone of you who are reading this can help me out here, it will be amazing. Thank you.
Note to Beginners( like me): It is okay to keep trying, I am not blogging the perfect solution, I am blogging my experience with different boxes.