🏠 Home BlogGitHub📚 Buy Me a Book
Edit

Capstone Practical Labs

Import all the VMs into VMWare Workstation Pro (free) or Virtualbox and change Network adapter to NAT.

Blue

O.S. - Windows 7

Credentials:

  • user:Password123!

  • administrator:Password456!

mkdir -p ~/tcm/peh/blue/
cd ~/tcm/peh/blue/
sudo nmap -p- -A -T4 192.168.31.132 -oA blue
PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Ultimate 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49156/tcp open  msrpc        Microsoft Windows RPC
MAC Address: 00:0C:29:33:BE:EE (VMware)
Device type: general purpose
Running: Microsoft Windows 7|2008|8.1
OS CPE: cpe:/o:microsoft:windows_7::- cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_server_2008::sp1 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_8.1

OS details: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows Server 2008 R2, Windows 8, or Windows 8.1 Update 1
Network Distance: 1 hop
Service Info: Host: WIN-845Q99OO4PP; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-07-13T20:57:32
|_  start_date: 2024-07-13T20:49:44
|_nbstat: NetBIOS name: WIN-845Q99OO4PP, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:33:be:ee (VMware)
|_clock-skew: mean: 1h19m51s, deviation: 2h18m33s, median: -8s
| smb-os-discovery: 
|   OS: Windows 7 Ultimate 7601 Service Pack 1 (Windows 7 Ultimate 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1
|   Computer name: WIN-845Q99OO4PP
|   NetBIOS computer name: WIN-845Q99OO4PP\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-07-13T16:57:32-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

TRACEROUTE
HOP RTT     ADDRESS
1   0.68 ms 192.168.31.132

Exploit MS17-010

CVE-2017-0144 - MS17-010

Microsoft Windows 7/2008 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010) - Windows remote Exploit

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

Metasploit

Manual exploit

❗ The machine can crash with this attack.

Blue VM BSOD

Academy

O.S. - Debian 10

Credentials:

  • root:tcm

  • Consider first attacks to ports 21, 80.

    • Brute-forcing port 22 (SSH) can be used to check if network detection is applied at client side, and for testing some default/weak credentials.

Port 80

Visit 192.168.31.128

  • Debian

  • Apache 2.4.38 Server default webpage

    • poor hygiene, etc

  • http://192.168.31.128/phpmyadmin

FTP - Port 21

  • First do a version check for vulnerabilities

  • Proceed with ftp connection

10201321 - cd73502828457d15655bbd7a63fb0bc8

➡️ hashcat

  • Inside the Kali VM, hashcat will use only the CPU for cracking the hash

10201321:student

➡️ dirb

➡️ ffuf

  • Upload the shell.php file using the web image uploader

    • The file is already executed (if not navigate to its webpage)

    • Reverse shell working

Privilege Escalation LinPEAS

➡️ LinPEAS

  • Check for interesting data

➡️ pspy - Monitor linux processes without root permissions

  • Download pspy64 and move it into the ~/tools dir where Python HTTP server is running

  • Since the script will run as root user's cronjob, root shell will be executed

root reverse shell

Dev

O.S. - Debian 10

Credentials:

  • root:tcm

HTTP - Port 80/8080

NFS - Port 2049

Crack ZIP

➡️ fcrackzip

LFI

  • Use the Local File Inclusion vulnerability, that allows to expose files running on a server

    • LFI - Steps to Reproduce:

      • Using HTTP GET request browse to the following page, whilst being authenticated user.

    • Create and account and login

SSH

  • The user is jeanpaul

  • Abuse sudo /usr/bin/zip to escalate to root user

Privesc GTFO Bins

➡️ GTFO Bins

  • Check zip - GTFOBins

    • look for Sudo - If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.

Butler

O.S. - Windows 10

Credentials:

  • Low Privilege User - butler:JeNkIn5@44

  • Admin - administrator:A%rc!BcA!

HTTP - Port 8080

Intercept the login request and send it to the Intruder.

  • Use Cluster bomb attack type

  • Set the payloads lists and start the attack

jenkins:jenkins is a valid login.

  • Disable proxy

Reverse shell

Reverse Shell as 'butler' user

Privesc WinPEAS

➡️ WinPEAS

  • Look for useful (red color) information, quick wins for privilege escalation

Unquoted service paths

  • Drop an exploit binary into the C:\Program Files (x86)\Wise\ directory

  • Reverse shell as system

Revershel shell

Blackpearl

O.S. - Debian 10

Credentials:

  • root:tcm

HTTP - Port 80

DNS - Port 53

➡️ dnsrecon

  • Add blackpearl.tcm to Kali /etc/hosts

This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 2.8 and prior, to bypass authentication. The module then uses a path traversal vulnerability in navigate_upload.php that allows authenticated users to upload PHP files to arbitrary locations. Together these vulnerabilities allow an unauthenticated attacker to execute arbitrary PHP code remotely. This module was tested against Navigate CMS 2.8.

TTY Shell

Privesc LinPEAS

  • Look for username and password, bottom up (red, yellow stuff)

If the binary has the SUID bit set, it does not drop the elevated privileges and may be abused to access the file system, escalate or maintain privileged access as a SUID backdoor. If it is used to run sh -p, omit the -p argument on systems like Debian (<= Stretch) that allow the default sh shell to run with SUID privileges.

This example creates a local SUID copy of the binary and runs it to maintain elevated privileges. To interact with an existing SUID binary skip the first command and run the program using its original path.

🔗 For more in depth Privilege Escalation, check TCM courses here:

PreviousExploitation BasicsNext4. Active Directory

Last updated

Was this helpful?