Deploy & hack into a Windows machine, leveraging common misconfigurations issues.

Metadata

Tasks

Task 1 - Recon

When I conduct a scan with nmap - I like to scan in two stages, one broad scan and one narrow detailed scan.

Broad scan:

sudo nmap -p- -v -Pn MACHINE-IP

Narrow scan:

sudo nmap -v -A -sC --script vuln -p ALL-OPEN-PORTS 

Here we found the vulnerability number as well as the CVE number! We could use these in our next task!

Task 2 - Gain Access

Start Metasploit:

msfconsole -q

-q : doesn't output all ASCII art and other useless information to screen

To search for 'Modules' within metasploit we use search. Either for the ms- or CVE-number:

The first option seems great and the numbers match with what we've seen previously.

Now we can list the module options with show options and change the required settings:

A last step before running the exploit is to change our listening address to our VPN interface. Then run the exploit!:

Now we have a shell with highest privilege! Now we background it as we're told with CTRL+Z:

Task 3 - Escalate

Stepping aside from the questions - a faster way to upgrade a shell is to use sessions -u:

When you want to dump passwords on a system, it's popular to migrate your shell into a process with access to the passwords, one such process is lsass.exe.

Although when using `migrate` in a meterpreter, you do not actually need the pid but just the process name using the `-N` flag:

Task 4 - Cracking

Now we dump the passwords:

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::

When cracking passwords there are generally one of two different tools you will use:

John:

John will use crack depending on the first hash it notices - and thus we need to specify the hash format we want to crack. This due to how the aad3b4... is the LM hash, an old and insecure algoritm and should not being used. The value we see is the default LM hash value. The part we want to crack is ffb4... which is the NT hash. In john syntax this would be format=NT:

Hashcat:

With hashcat however it operates in attack-modes (-a) and hash-types (-m). All information can be found in hashcat -h - however to keep it simple; grep for NT in the help command to get the hash-type number and the attack-mode 0 is equal to using a wordlist:

Now we just have to put in the hash as the first argument and the wordlist as the second. You could also supress the output like I did with `--quiet`:

Task 5 - Find flags!

To play this task on easy mode we can utilise the meterpreter command search:

Now we can just read them:

Cheat Sheet

Nmap

Initial port scan:

sudo nmap -p- -v 

Add -Pn if windows machine

Secondary scan:

sudo nmap -v -A -sC --script vuln -p PORTS

Metasploit

Start Metasploit:

msfconsole -q

-q : doesn't output all ASCII art and other useless information to screen

Meterpreter

Hash-cracking

JohnTheRipper

Also:

# Combine passwd and shadow for linux systems
sudo unshadow /etc/passwd /etc/shadow > unshadowed

# unshadowed parser
cat unshadowed | awk +F: '{print $2}' | sort -u

john --wordlist=list.txt --format=md5crypt unshadowed.txt

*Cracked passwords stored in ~/.john/john.pot or add --show and --show=left*

Custom rule

Edit: /etc/john/john.conf

Hashcat

Mode (-a):

Hash (-m):

Rules (-r):

Cracked passwords stored in ~/.local/share/hashcat/hashcat.potfile or --show --user

Support me

Thank you so much for reading and I hope you found it inspirational or helpful! You can best support me by doing any of the following bellow!

You can read more about the perks of being a Member or Subscriber here.

Additionally, you can stay updated and engage with me on social media: