###### tags: `TryHackMe OffensiveSecurity GettingStarted`

# Blue
:::success
In this room i learned to hack into a windows machine and leverage commun misconfigurations issues
:::
## Reconnaissance using nmap
:::info
In this section of the room, i gather informations about the target machine using **nmap**.
:::

I decided to run the command `nmap -v --script vuln` to gather maximum informations about the target. I choose this syntax to know what is this machine vulnerable too.


Through the result i observe that :
- 3 ports under 1000 are open
- There is a Remote Code Execution vulnerability in Microsoft SMBv1
- The CVE associated to this vulnerability is : CVE-2017-0143
- The machine is vulnerable to ms17-010

## Gaining Acces using Metasploit

:::info
In this section of the room, using a powerfull pentesting tool called **Metasploit**, i exploit the machine and gain a foothold.
:::

**Metasploit**, an open-source pentesting framework, is a powerful tool utilized by security engineers around the world. Maintained by Rapid 7, Metasploit is a collection of not only thoroughly tested exploits but also auxiliary and post-exploitation tools.


In the picture above, i run metasploit using the `msfconsole` command.

I first search the exploitation code i will run against the machine.
To do it, i type the command : `search ms17-010`. Don't forget that *ms17-010* is what the machine is vulnerable to.
Here is the result of the command :

Through this result, i find 3 checked available exploits. I chose the one whose name was the most telling regarding the vulnerability found : `exploit/windows/smb/ms17_010_eternalblue`.
I then use this exploit :


After that i configure some elements to allow me to use the exploit against the target.
First, i run the command `options` to know what elements are required to use the exploit :

Through this result, i notice that i have to give a value to the `RHOSTS` options. `RHOSTS` has to be the IP of the target. To do it i use the `set` command like shown in this following picture :


I also have to set the **payload** to use with the exploit and as i want to have a reverse windows command line i use this one :
:::info
Starting from here, everything is ok to exploit the machine
:::
To exploit the machine i have the choice to enter one of these two commands :
- exploit
- run
We can see that we have now a DOS command line.

## Escalating privileges
:::info
In this section, i manage to convert the DOS command line to meterpreter shell in metasploit.
:::

I started by searching the name of the post module i will use. Like in the begining, i use the `search` command :


The output of this picture shows me the module to use to enable meterpreter. I then use it :


Like the past module, i show the options to know what is required and what i have to change. This done, i notice i have to connect my module to a `session` before running the module. I list the available sessions and set the more telling regarding what i want to do. In this case it was the session with **ID=1** :


:::info
Starting from here, i can now run the module :
:::


I run the module and i notice that a `meterpreter session` is opened in **session 2**. I list again the different sessions avalaible to prove what i see :


Indeed, there is a new session created where i will have a meterpreter shell.

:::warning
Let's notice that the target uses a x64/windows architecture while the meterpreter uses a x86/windows one.
:::

I connect now to the meterpreter shell :

:::success

As you see, i have now the meterpreter shell and i ahave escalated to **`AUTHORITY/SYSTEM`** :


PS : Note the use of ***CTR+Z*** to go back to meterpreter when we use ***shell*** to show the windows command line.
:::
## Cracking the Admin Password

:::info
In this section i will try to know what is the password of the admin.
:::
Now i can use meterpreter, i want to know all the differents users and their associated passwords. To do it, i will run the `hashdump` command. This will dump all of the passwords on the machine as long as we have the correct privileges to do so.


After running the command, i have some issues so i decided to **migrate** the processus. This will allow me to have all the rights.
Let's do it. I started by list the processus running associated to the authorithy/system and migrate one with the x64/windows architecture.


The migrate command is not stable so it can fail. When it occurs, change the processus ID and migrate again : `migrate PID`.

After doing that, i run again the command `hashdump` :


Now, i have the hashed passwords. To decrypt the password of the user, i use **john the ripper** tool. Before doing it, i store the hashed password in a `.txt file`.


The password is "***alqfna22*** "

:::success
I HAVE NOW THE PRIVILEGES OF THE ADMIN OF THE MACHINE AND I KNOW HIS PASSWORD.
END !!!
:::

## Capture the flag

:::info
This section is optional. I manage to obtain the flags hiden in the target machine
:::

- The first flag is in the `C:` Directory :


- The second flag is in the `Windows/System32/config` Directory :


- The third flag is in the `Users/Jon/Documents` Directory :