TryHackMe Lookback

nmap

nmap -sV -sC -T4 -p- 10.10.69.162 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-09 15:12 EST
Nmap scan report for 10.10.69.162
Host is up (0.092s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Site doesn't have a title.
443/tcp  open  ssl/https
| ssl-cert: Subject: commonName=WIN-12OUO7A66M7
| Subject Alternative Name: DNS:WIN-12OUO7A66M7, DNS:WIN-12OUO7A66M7.thm.local
| Not valid before: 2023-01-25T21:34:02
|_Not valid after:  2028-01-25T21:34:02
|_http-server-header: Microsoft-IIS/10.0
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=WIN-12OUO7A66M7.thm.local
| Not valid before: 2024-02-08T19:18:53
|_Not valid after:  2024-08-09T19:18:53
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 233.18 seconds

ffuf

test endpoint credentials admin/admin https://win-12ouo7a66m7.thm.local/test/

Exploitation

The Path parameter is vulnerable to RCE, so the flag can be read easily

Privilege escalation

There is a TODO file on desktop. payload:

containing this text "Install the Security Update for MS Exchange [TO BE DONE]" and several users including dev-infrastracture-team@thm.local

msfconsole

PreviousTryHackMe Post-Exploitation BasicsNextMobileHackingLab Food Store

Last updated