NYP InfoSec Introduction to Pentesting Workshop
NYP InfoSec Introduction to Pentesting Workshop
This workshop is hosted using a TryHackMe Lab, where we will need to exploit CVE-2017-0144 on a Windows 7 Machine
Exporting the IP as shell variable to make life easier
export ip=10.10.24.176We are able to call $ip in the terminal when we need it instead of typing out the whole IP Address
Task 1 [Recon]
Nmap Scan
nmap -A -T4 -oN output.nmap $ip-A: Performs OS Detection, Version Detection, Script Scanning and Traceroute
-T4: Timing Template, number between 1-5, higher is faster, but might be less accurate
-oN: Normal output
Redacted nmap output
# Nmap 7.92 scan initiated Thu Mar 10 19:57:12 2022 as: nmap -A -T4 -vv -oN nmap.out 10.10.24.176
Increasing send delay for 10.10.24.176 from 0 to 5 due to 26 out of 64 dropped probes since last increase.
Nmap scan report for 10.10.24.176
Host is up, received conn-refused (0.32s latency).
Scanned at 2022-03-10 19:57:13 +08 for 168s
Not shown: 991 closed tcp ports (conn-refused)
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ssl/ms-wbt-server? syn-ack
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
# Nmap done at Thu Mar 10 20:00:01 2022 -- 1 IP address (1 host up) scanned in 168.71 seconds
Enumeration
Google Windows 7 Professional 7601 Service Pack 1 exploit
MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
Task 2 [Gain Access]
Gaining Shell
Module options to set
RHOSTS Remote Host, or our victim machines IP Address
LHOST Listen Host, or our local machine IP Address
Confirm that the exploit works
Note: The exploit uses the Metasploit ms17_010_eternalblue.rb script, however that is out of scope for this workshop. The GitHub URL is attached below for reference if anyone is interested in learning more.
metasploit-framework/ms17_010_eternalblue.rb at master · rapid7/metasploit-framework
Task 3 [Escalate]
Upgrading command shell to Meterpreter
Why? Able to run Meterpreter shell command, instead of only being limited to windows command
How?
We will need to background our current session, and use the post/multi/manage/shell_to_meterpreter to convert our shell to Meterpreter Shell
Note: The module uses the Metasploit shell_to_meterpreter.rb script, which is out of scope for the workshop. The GitHub URL is attached below for reference if anyone is interested in learning more.
metasploit-framework/shell_to_meterpreter.rb at master · rapid7/metasploit-framework
Swap to Meterpreter shell after running the post module
sessions -l List all active sessions
sessions -i Interact with the supplied session ID, which in this case is Session ID 2
Confirm that the Meterpreter shell works and that we are
NT AUTHORITY\SYSTEM
Migrating Process
We are running as system but that doesn’t indicate that our process is. We need to migrate to another process which user is NT AUTHORITY\SYSTEM
Dumping Users Hash
Task 4 [Cracking]
Identifying the type of hash
Google windows 7 password hash format
Understanding Windows local password hashes (NTLM)
From the stackexchange article, we understand that it is a LM/NT hash
Cracking the hash
First, we will save the hash that we managed to dump into a file called password_hash
We have managed to successfully cracked Jon password, using the rockyou.txt wordlist
To learn more about Windows LM hash, refer to this article.
You Gotta Hack That | Penetration Testing Consultancy
Why did we fail to crack Administrator and Guest Hash?
The aad3b435b51404eeaad3b435b51404ee is the Windows LM hash for “no password”.
Task 5 [Find Flags!]
Challenge
Attempt to exploit the machine without using Metasploit!
You are all encouraged to explore different methods to hack into the box without relying on Metasploit.
Installing Requirements
Checking if machine is vulnerable to EternalBlue
Compiling Shellcode
Preparing the listener (following the instructions)
OR Using a netcat listener instead
PWN the target!
Open a new shell/new tab
GitHub Link:
https://github.com/worawit/MS17-010
Closing Thoughts
I hope you all enjoyed the demonstration during the workshop, and managed to learn a few things!
If you have any question or doubt, feel free to reach out to me at Kabinet#1553 on discord.
I will be happy to connect with you all on LinkedIn at https://www.linkedin.com/in/edwinczd/
References
Last updated
Was this helpful?