Host & Network Penetration Testing: Post-Exploitation CTF 2

Hello folks! Today we'll be discussing about one more CTF challenge of the module Host and Network Penetration Testing and the sub module Post-Exploitation as always I'll not share the flags values because i want you to learn, rather than just submitting the flags on the platform. I will share the commands,tools I used to enumerate all the services and the methodology I used to gather all the flags. So lets get started …….

Flag 1: An insecure ssh user named alice lurks in the system.

starting with the nmap scan on the target ,various common ports were running services on the target system.

as per the we have to brute force the password for user alice

I used msf module to bruteforce password because it creates a session after finding valid credentials ,but the shell was a normal cmd shell so we can upgrade it to a meterpreter shell .

and the first flag was stored in the home directory of user alice

Flag 2: Using the hashdump file discovered in the previous challenge, can you crack the hashes and compromise a user?

We also found a hashdump file containg hashes of all the users on the system.

we can use the below linux utility to print only the NTLM hashes

cat hashdump.txt | cut -d ':' -f4

cat hashdump.txt | cut -d ':' -f4

cut :- to print the contents of the hashdump.txt file

d:- delimeter is set to ':'
-f4 — select only the fourth fields of every line within the delimeter

Then I used hashcat tool to crack the hashes and i found two passwords

And the above password belongs to the user david

now we can also use this password to access the system using user david

listing out the contents of the home directory gives us the 2nd flag

Flag 3: Can you escalate privileges and read the flag in C://Windows//System32//config directory?

while trying to access the c:\Windows\System32\config directory access was denied for both the users alice and david ,so we need to find a user with higher privileges such as administrator to get access to the directory.

So I head over to meterpreter to gain a meterpreter shell using the david user credentials ,you can also spawn a meterpreter shell using msf payload.

Initialy I gained a cmd shell but i upgraded it to meterpreter.

now we try to escalate privileges using meterpreter default command to try out escalation

and on the first try I got access to a NT authority user ,now we can list out the contents of c:\Windows\System32\config directory to find the 3rd flag

Flag 4: Looks like the flag present in the Administrator's home denies direct access.

For the 4th flag we need access to the c:\Users\Administrator\flag directory but even being the highest level privileged user we were not able to access the directory .

So what I did is , I changed the password of the Administrator account