TryHackMe — Advent of Cyber 2 — Day 10
By: Trent Darrow
Tags: Smb, Smbclient, Beginner, Walkthrough, Tryhackme

Good morning everyone,

We will be playing catchup some more today. Let’s get after it.

Intro for Day 10:

“The Best Festival Company (TBFC) has since upscaled its IT infrastructure after last year’s attack for all the other elves to use, including a VPN server and a few other services. You breathe a sigh of relief…”That’s it, Me, Elf McEager saved the Christmas of 2020! I can’t wait to — -” But suddenly, a cold shiver runs down your spine, interrupting your monologue… You suddenly recall that Elf McSkidy had set up a Samba file server just before the attack occurred — could this have been hacked too?! What about our data…Oh no, quick! Find out what usernames may have been leaked and attempt to login to the server yourself, noting down any vulnerabilities found to report back to Elf McSkidy.”

Looking through the learning section, we will be focusing on Samba for our entry point. This is good, only have gotten to play with this a few times on HackTheBox. Should be a good refresher and learning time for me.

Question 1: Using enum4linux, how many users are there on the Samba server ( 10.10.40.92 )?

alrighty, so obviously we have to start with enum4linux. Let’s take a look at the options



enum4linux v0.8.9 (

Copyright (C) 2011 Mark Lowe ( root@kali:/mnt/hgfs/shared_folder/tryhackme# enum4linux -henum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ Copyright (C) 2011 Mark Lowe ( mrl@portcullis-security.com

functionality to enum.exe (formerly from

features such as RID cycling have also been added for convenience. Simple wrapper around the tools in the samba package to provide similarfunctionality to enum.exe (formerly from www.bindview.com ). Some additionalfeatures such as RID cycling have also been added for convenience. Usage: ./enum4linux.pl [options] ip Options are (like "enum"):

-U get userlist

-M get machine list*

-S get sharelist

-P get password policy information

-G get group and member list

-d be detailed, applies to -U and -S

-u user specify username to use (default "")

-p pass specify password to use (default "") The following options from enum.exe aren't implemented: -L, -N, -D, -f Additional options:

-a Do all simple enumeration (-U -S -G -P -r -o -n -i).

This opion is enabled if you don't provide any other options.

-h Display this help message and exit

-r enumerate users via RID cycling

-R range RID ranges to enumerate (default: 500-550,1000-1050, implies -r)

-K n Keep searching RIDs until n consective RIDs don't correspond to

a username. Impies RID range ends at 999999. Useful

against DCs.

-l Get some (limited) info via LDAP 389/TCP (for DCs only)

-s file brute force guessing for share names

-k user User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none)

Used to get sid with "lookupsid known_username"

Use commas to try several users: "-k admin,user1,user2"

-o Get OS information

-i Get printer information

-w wrkg Specify workgroup manually (usually found automatically)

-n Do an nmblookup (similar to nbtstat)

-v Verbose. Shows full commands being run (net, rpcclient, etc.)

Now we can specify the flags, for now I’ll leave it blank, which will use the -a flag and we will separate out each section for what flag it would pertain.

Now if you know the information that is provided by enum4linux please feel free to skip ahead.



Starting enum4linux v0.8.9 ( root@kali:/mnt/hgfs/shared_folder/tryhackme# enum4linux 10.10.105.1Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Dec 15 11:29:04 2020 ==========================

| Target Information |

==========================

Target ........... 10.10.105.1

RID Range ........ 500-550,1000-1050

Username ......... ''

Password ......... ''

Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ===================================================

| Enumerating Workgroup/Domain on 10.10.105.1 |

===================================================

[+] Got domain/workgroup name: TBFC-SMB-01 ===========================================

| Nbtstat Information for 10.10.105.1 | -n Do an nmblookup

===========================================

Looking up status of 10.10.105.1

TBFC-SMB <00> - B <ACTIVE> Workstation Service

TBFC-SMB <03> - B <ACTIVE> Messenger Service

TBFC-SMB <20> - B <ACTIVE> File Server Service

..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser

TBFC-SMB-01 <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name

TBFC-SMB-01 <1d> - B <ACTIVE> Master Browser

TBFC-SMB-01 <1e> - <GROUP> B <ACTIVE> Browser Service Elections MAC Address = 00-00-00-00-00-00 ====================================

| Session Check on 10.10.105.1 |

====================================

[+] Server 10.10.105.1 allows sessions using username '', password '' ==========================================

| Getting domain SID for 10.10.105.1 |

==========================================

Domain Name: TBFC-SMB-01

Domain Sid: (NULL SID)

[+] Can't determine if host is part of domain or part of a workgroup =====================================

| OS information on 10.10.105.1 | -o Get OS information

=====================================

Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464.

[+] Got OS info for 10.10.105.1 from smbclient:

[+] Got OS info for 10.10.105.1 from srvinfo:

TBFC-SMB Wk Sv PrQ Unx NT SNT tbfc-smb server (Samba, Ubuntu)

platform_id : 500

os version : 6.1

server type : 0x809a03 ============================

| Users on 10.10.105.1 | -U get userlist

============================

index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: elfmcskidy Name: Desc:

index: 0x2 RID: 0x3ea acb: 0x00000010 Account: elfmceager Name: elfmceager Desc:

index: 0x3 RID: 0x3e9 acb: 0x00000010 Account: elfmcelferson Name: Desc: user:[elfmcskidy] rid:[0x3e8]

user:[elfmceager] rid:[0x3ea]

user:[elfmcelferson] rid:[0x3e9] ========================================

| Share Enumeration on 10.10.105.1 | -S get sharelist

======================================== Sharename Type Comment

--------- ---- -------

tbfc-hr Disk tbfc-hr

tbfc-it Disk tbfc-it

tbfc-santa Disk tbfc-santa

IPC$ IPC IPC Service (tbfc-smb server (Samba, Ubuntu))

SMB1 disabled -- no workgroup available [+] Attempting to map shares on 10.10.105.1

//10.10.105.1/tbfc-hr Mapping: DENIED, Listing: N/A

//10.10.105.1/tbfc-it Mapping: DENIED, Listing: N/A

//10.10.105.1/tbfc-santa Mapping: OK, Listing: OK

//10.10.105.1/IPC$ [E] Can't understand response:

NT_STATUS_OBJECT_NAME_NOT_FOUND listing \* ===================================================

|Password Policy for 10.10.105.1 | -P get password policy info

===================================================

[E] Unexpected error from polenum: [+] Attaching to 10.10.105.1 using a NULL share [+] Trying protocol 139/SMB... [!] Protocol failed: Missing required parameter 'digestmod'. [+] Trying protocol 445/SMB... [!] Protocol failed: Missing required parameter 'digestmod'. [+] Retieved partial password policy with rpcclient: Password Complexity: Disabled

Minimum Password Length: 5 =============================

| Groups on 10.10.105.1 | -G get group and member list

============================= [+] Getting builtin groups: [+] Getting builtin group memberships: [+] Getting local groups: [+] Getting local group memberships: [+] Getting domain groups: [+] Getting domain group memberships: ======================================================================

| Users on 10.10.105.1 via RID cycling (RIDS: 500-550,1000-1050) | -r enumerate users via RID cycling

======================================================================

[I] Found new SID: S-1-22-1

[I] Found new SID: S-1-5-21-3823526196-2163436115-3915495932

[I] Found new SID: S-1-5-32

[+] Enumerating users using SID S-1-22-1 and logon username '', password ''

S-1-22-1-1000 Unix User\elfmceager (Local User)

S-1-22-1-1001 Unix User\elfmcelferson (Local User)

S-1-22-1-1002 Unix User\elfmcskidy (Local User)

[+] Enumerating users using SID S-1-5-32 and logon username '', password ''

S-1-5-32-544 BUILTIN\Administrators (Local Group)

S-1-5-32-545 BUILTIN\Users (Local Group)

S-1-5-32-546 BUILTIN\Guests (Local Group)

S-1-5-32-547 BUILTIN\Power Users (Local Group)

S-1-5-32-548 BUILTIN\Account Operators (Local Group)

S-1-5-32-549 BUILTIN\Server Operators (Local Group)

S-1-5-32-550 BUILTIN\Print Operators (Local Group)

[+] Enumerating users using SID S-1-5-21-3823526196-2163436115-3915495932 and logon username '', password ''

S-1-5-21-3823526196-2163436115-3915495932-500 *unknown*\*unknown* (8)

S-1-5-21-3823526196-2163436115-3915495932-501 TBFC-SMB

obody (Local User)

S-1-5-21-3823526196-2163436115-3915495932-513 TBFC-SMB\None (Domain Group)

S-1-5-21-3823526196-2163436115-3915495932-1000 TBFC-SMB\elfmcskidy (Local User)

S-1-5-21-3823526196-2163436115-3915495932-1001 TBFC-SMB\elfmcelferson (Local User)

S-1-5-21-3823526196-2163436115-3915495932-1002 TBFC-SMB\elfmceager (Local User) ============================================

| Getting printer info for 10.10.105.1 | -i Get printer info

============================================

No printers returned. enum4linux complete on Tue Dec 15 11:38:49 2020

So we got a ton of information. We can take a look as see that we have 3 users, 4 shares and we can map the tbfc-santa share. That answers question 2 and 3 for us now.

Question 2: Now how many “shares” are there on the Samba server?

Question 3: Use smbclient to try to login to the shares on the Samba server ( 10.10.40.92 ). What share doesn't require a password?

Onto the last Question 4: Log in to this share, what directory did ElfMcSkidy leave for Santa?

We can use the smbclient tool for this.

#smbclient //10.10.105.1/tbfc-santa

We have access to the jingle-tunes directory. We also can get the note_from_mcskidy.txt

Hi Santa, I decided to put all of your favourite jingles onto this share - allowing you access it from anywhere you like! Regards ~ ElfMcSkidy

Anyhow, that completes todays challenge. As always, best of luck. If you enjoy my content, feel free to add me on LinkedIn and let me know you saw the blog.

Until next time,

-3lduderino