VulnNet: Roasted

This is my write-up for the machine on TryHackMe known as VulnNet: Roasted: https://tryhackme.com/room/vulnnetroasted

I am going to start off my running the following nmap scan:

nmap -T4 -A -vvv -Pn 10.10.146.147 -oN nmap.output

I then got the following result from the search:

# Nmap 7.91 scan initiated Sat Jul 24 15:18:10 2021 as: nmap -T4 -A -vvv -Pn -oN nmap.output 10.10.146.147
Increasing send delay for 10.10.146.147 from 0 to 5 due to 25 out of 62 dropped probes since last increase.
Nmap scan report for 10.10.146.147
Host is up, received user-set (0.16s latency).
Scanned at 2021-07-24 15:18:11 EDT for 69s
Not shown: 995 closed ports
Reason: 995 conn-refused
PORT     STATE    SERVICE        REASON      VERSION
135/tcp  filtered msrpc          no-response
139/tcp  filtered netbios-ssn    no-response
593/tcp  filtered http-rpc-epmap no-response
636/tcp  filtered ldapssl        no-response
3389/tcp filtered ms-wbt-server  no-response

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jul 24 15:19:20 2021 -- 1 IP address (1 host up) scanned in 70.18 seconds

My next step was to look at what each of the ports have on them using the browser. I was getting this message:

I looked at this write-up to compare the results for nmap, and changed my search to be the following:

I then got a different result:

Running smbmap (an idea I got from the write-up mentioned previously) on the IP address got me the following result:

I then looked on book.hacktricks.xyz to see what the author would do in this case. I ended up using this site to connect to the SMB share with the following command:

I then got this output:

I then downloaded those files using mget *:

I did see a couple names in the files, which could potentially be usernames we can exploit later:

I then downloaded the other files from the other share:

There were names that stood out on these files as well:

I then wanted to know where I would go from here. Viewing the book.hacktricks.xyz site from before I realized that I would have to bruteforce SIDs. I used the Metasploit version (this takes 5-10 minutes):

I then copied that into a file, and then ran grep on it to just print the list of the users only:

For some reason, the Impacket download on my Kali Linux machine was lacking a lot of scripts. I then cloned the following repository: https://github.com/SecureAuthCorp/impacket. I noticed a couple write-ups referring to GetNPUsers.py, and so I decided to give that a try as well. I ran the following command to try to get hashes from the Users:

In the previous command, the vulnnet-rst.local was the IP address of the machine. I had just changed that in /etc/hosts. I got the following result:

I then realized that I would have to crack the hash in the output. My assumption is that this is a kerberos hash. Looking on https://hashcat.net/wiki/doku.php?id=example_hashes, I found out that this is Kerberos 5, and the mode for this is 18200. I then tried to crack this using hashcat:

The hash was then cracked:

I then plugged that information into smbmap:

I noticed that there were more READ ONLY shares available from this user. I then wanted to see what those files were:

Viewing the .vbs file it showed me a username and password:

I then did smbmap using this username and password:

I first used smbclient to get into the C$ drive. After not finding anything for a while, I looked at this write-up. I then realized that I had to use Impacket again in order to get the other hashes for the other users. I first ran crackmapexec:

I then added the "pwned" share into the secretsdump.py command:

Using the same write-up I learned about evil-winrm. I then used that to try to get a foothold into the machine:

I then got into the machine! When I looked into the C:\Users\Administrator\Desktop I found the system.txt file. I then realized, that I had to look for the user.txt file next. I found the user.txt file in C:\Users\enterprise-core-vn\Desktop. I then had both flags:

Last updated