TryHackMe Blueprint – Cybersecurity-Write-up
Ich habe mich entschieden, etwas mehr Penetration Testing/Ethical Hacking auszuprobieren. Das Folgende ist ein Write-Up zum TryHackMe-Room “Blueprint”. Aufgaben Die einzige Information, die wir gehabt haben, ist: Habt ihr das Zeug dazu, in diese Windows-Maschine einzudringen? Und die Fragen: NTLM-Hash des “Lab”-Users entschlüsselt root.txt Also können wir davon ausgehen, dass es eine Windows-Maschine ist. Discovery Ich habe meine Kali-Linux-Maschine gestartet und auf meinem Desktop einen Ordner als Workspace angelegt. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 # create a workspace mkdir Desktop/blueprint && cd Desktop/blueprint # portscan with nmap nmap -v -A -oN nmap-scan.txt 10.10.251.173 # nmap result PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 7.5 |_http-title: 404 - File or directory not found. |_http-server-header: Microsoft-IIS/7.5 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/http Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28) | http-ls: Volume / | SIZE TIME FILENAME | - 2019-04-11 22:52 oscommerce-2.3.4/ | - 2019-04-11 22:52 oscommerce-2.3.4/catalog/ | - 2019-04-11 22:52 oscommerce-2.3.4/docs/ |_ | http-methods: | Supported Methods: OPTIONS GET HEAD POST TRACE |_ Potentially risky methods: TRACE |_ssl-date: TLS randomness does not represent time |_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28 | ssl-cert: Subject: commonName=localhost | Issuer: commonName=localhost | Public Key type: rsa | Public Key bits: 1024 | Signature Algorithm: sha1WithRSAEncryption | Not valid before: 2009-11-10T23:48:47 | Not valid after: 2019-11-08T23:48:47 | MD5: a0a4:4cc9:9e84:b26f:9e63:9f9e:d229:dee0 |_SHA-1: b023:8c54:7a90:5bfa:119c:4e8b:acca:eacf:3649:1ff6 |_http-title: Index of / | tls-alpn: |_ http/1.1 445/tcp open microsoft-ds Windows 7 Home Basic 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP) 3306/tcp open mysql MariaDB (unauthorized) 8080/tcp open http Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28) |_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28 | http-methods: | Supported Methods: OPTIONS GET HEAD POST TRACE |_ Potentially risky methods: TRACE |_http-title: Index of / | http-ls: Volume / | SIZE TIME FILENAME | - 2019-04-11 22:52 oscommerce-2.3.4/ | - 2019-04-11 22:52 oscommerce-2.3.4/catalog/ | - 2019-04-11 22:52 oscommerce-2.3.4/docs/ |_ 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49158/tcp open msrpc Microsoft Windows RPC 49159/tcp open msrpc Microsoft Windows RPC 49160/tcp open msrpc Microsoft Windows RPC Service Info: Hosts: www.example.com, BLUEPRINT, localhost; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: -20m03s, deviation: 34m37s, median: -4s | smb-os-discovery: | OS: Windows 7 Home Basic 7601 Service Pack 1 (Windows 7 Home Basic 6.1) | OS CPE: cpe:/o:microsoft:windows_7::sp1 | Computer name: BLUEPRINT | NetBIOS computer name: BLUEPRINT\x00 | Workgroup: WORKGROUP\x00 |_ System time: 2024-08-16T18:05:38+01:00 | smb2-security-mode: | 2:1:0: |_ Message signing enabled but not required | smb2-time: | date: 2024-08-16T17:05:39 |_ start_date: 2024-08-16T17:02:15 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | nbstat: NetBIOS name: BLUEPRINT, NetBIOS user: <unknown>, NetBIOS MAC: 02:a6:9b:93:fd:95 (unknown) | Names: | BLUEPRINT<00> Flags: <unique><active> | WORKGROUP<00> Flags: <group><active> | BLUEPRINT<20> Flags: <unique><active> | WORKGROUP<1e> Flags: <group><active> | WORKGROUP<1d> Flags: <unique><active> |_ \x01\x02__MSBROWSE__\x02<01> Flags: <group><active> Also haben wir Folgendes beobachten können: ...