Skip to content

Commit

Permalink
removed THM flags
Browse files Browse the repository at this point in the history
  • Loading branch information
syselement committed Oct 20, 2024
1 parent e9592a8 commit c31aaca
Show file tree
Hide file tree
Showing 30 changed files with 175 additions and 335 deletions.
10 changes: 5 additions & 5 deletions writeups-walkthroughs/hackthebox/_box-template.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

```bash
su
echo "IP boxname.thm" >> /etc/hosts
echo "IP boxname.htb" >> /etc/hosts

# At the end of the box
# To clean up the last line from the /etc/hosts file
Expand All @@ -32,11 +32,11 @@ sed -i '$ d' /etc/hosts
Start Reconnaissance

```bash
mkdir $HOME/thm/boxname
cd $HOME/thm/boxname
nmap boxname.thm
mkdir $HOME/htb/boxname
cd $HOME/htb/boxname
nmap boxname.htb

nmap -sV -sC -Pn -oA boxname boxname.thm
nmap -sV -sC -Pn -oA boxname boxname.htb
```

```bash
Expand Down
25 changes: 14 additions & 11 deletions writeups-walkthroughs/tryhackme/practice/_room-template.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,9 @@
| 🎯 Target IP | `IP` |
| 📈 Difficulty level | 🟢Easy 🟡Medium 🔴Hard/Insane |
| 💲 Subscription type | Free/Sub only |
| 🪟 🐧OS | Linux/Windows |


---

## Recon

Expand Down Expand Up @@ -41,6 +42,8 @@ nmap -sV -sC -Pn -oA roomname roomname.thm



---

## Exploitation

-
Expand All @@ -51,7 +54,7 @@ nmap -sV -sC -Pn -oA roomname roomname.thm




---

## Privilege Escalation

Expand All @@ -63,34 +66,34 @@ nmap -sV -sC -Pn -oA roomname roomname.thm





## Post Exploitation
### Get Flags

-

```bash
find / -type f -name 'flag.txt' 2>/dev/null

```
find / -type f -iname user.txt 2>/dev/null

find / -type f -iname root.txt 2>/dev/null
```



---

## Get Flags
## Post Exploitation

-

```bash
find / -type f -name 'flag.txt' 2>/dev/null

find / -type f -iname user.txt 2>/dev/null

find / -type f -iname root.txt 2>/dev/null
```



---

## Extra

------
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
62 changes: 24 additions & 38 deletions writeups-walkthroughs/tryhackme/practice/easy/blaster.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,22 +2,17 @@

![tryhackme.com - © TryHackMe](.gitbook/assets/tryhackme-logo-small.png)

## Room Info

> **Name**
>
> 🔗 [Blaster](https://tryhackme.com/room/blaster)
>
> ![](.gitbook/assets/blaster.png)
>
> **Description**
>
> 📝 *Throughout this room, we'll be looking at alternative modes of exploitation without the use of Metasploit or really exploitation tools in general beyond nmap and dirbuster.*
>
> **Target IP**
>
> 🎯 `10.10.27.22`
## Intro

| Room Info | ![](.gitbook/assets/blaster.png) |
| :------------------ | --------------------------------------------- |
| 🔗 Name | [Blaster](https://tryhackme.com/room/blaster) |
| 🎯 Target IP | `10.10.27.22` |
| 📈 Difficulty level | 🟢Easy |
| 💲 Subscription type | Free |
| 🪟 🐧OS | Windows |

---

## Recon

Expand Down Expand Up @@ -83,17 +78,11 @@ xfreerdp /u:Wade /p:parzival /v:10.10.27.22
# or use Remmina
```

Read **`user.txt`** file.

<details>
<summary>Reveal Flag - user.txt: 🚩</summary>


`THM{HACK_PLAYER_ONE}`

🚩 Read **`user.txt`** file.


</details>
```bash
THM{H***************
```

### Local Recon

Expand All @@ -102,32 +91,27 @@ Check Internet Explorer history.
* `CVE-2019-1388` - Windows Privilege Escalation Through UAC
* `hhupd.exe` on desktop

---

## Privilege Escalation

* Run `hhupd.exe` to exploit the privilege escalation vulnerability present in the Windows Certificate Dialog box, a bug in the UAC mechanism
* `cmd` user: `nt authority\system`

![](.gitbook/assets/certuacbypass.gif)

🚩 Read **`root.txt`** file.

```bash
cd c:\Users\Administrator\Desktop
type root.txt
```



<details>
<summary>Reveal Flag - root.txt: 🚩</summary>


THM{C**************************
```

`THM{COIN_OPERATED_EXPLOITATION}`

<img src=".gitbook/assets/image-20230510180611161.png" alt="" data-size="original">

</details>

![](.gitbook/assets/image-20230510180611161.png)

---

## Exploitation

Expand Down Expand Up @@ -182,6 +166,8 @@ Logged On Users : 1
Meterpreter : x86/windows
```

---

## Persistence

```bash
Expand Down
92 changes: 24 additions & 68 deletions writeups-walkthroughs/tryhackme/practice/easy/blue.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,17 @@

![tryhackme.com - © TryHackMe](.gitbook/assets/tryhackme-logo-small.png)

## Room Info

> **Name**
>
> 🔗 [Blue](https://tryhackme.com/room/blue)
>
> ![](.gitbook/assets/blue.jpg)
>
> **Description**
>
> 📝 *Deploy & hack into a Windows machine, leveraging common misconfigurations issues.*
>
> **Target IP**
>
> 🎯 `10.10.177.175`
## Intro

| Room Info | ![](.gitbook/assets/blue.jpg) |
| :------------------ | --------------------------------------- |
| 🔗 Name | [Blue](https://tryhackme.com/room/blue) |
| 🎯 Target IP | `10.10.177.175` |
| 📈 Difficulty level | 🟢Easy |
| 💲 Subscription type | Free |
| 🪟 🐧OS | Windows |

---

## Recon

Expand All @@ -26,6 +22,8 @@ nmap -sV -p445 10.10.177.175
nmap --script smb-vuln-ms17-010 -p445 10.10.177.175
```

---

## Exploitation

```bash
Expand All @@ -46,6 +44,8 @@ background # or CTRL+Z

![](.gitbook/assets/image-20230316134157848.png)

---

## Privilege Escalation

* Used payload was `windows/x64/shell/reverse_tcp`, so convert the shell to a `meterpreter` shell.
Expand Down Expand Up @@ -75,6 +75,8 @@ migrate 1284

![](.gitbook/assets/image-20230316141809336.png)

---

## Post Exploitation

### Cracking
Expand Down Expand Up @@ -105,81 +107,35 @@ Jon's credentials are `jon`:`alqfna22`.

## Flags

* In the `meterpreter` session
* 🚩 In the `meterpreter` session

```bash
cd C:\\
dir
cat flag1.txt
flag{*******************
```



<details>

<summary>Reveal Flag1: 🚩</summary>



`flag{access_the_machine}`



<img src=".gitbook/assets/image-20230316143237356.png" alt="" data-size="original">

</details>


![](.gitbook/assets/2024-10-20_22-09-30_758.png)

```bash
cd C:/Windows/System32/config
cat flag2.txt
flag{*****************************
```






<details>

<summary>Reveal Flag2: 🚩</summary>



`flag{sam_database_elevated_access}`



<img src=".gitbook/assets/image-20230316143502259.png" alt="" data-size="original">

</details>


![](.gitbook/assets/2024-10-20_22-11-22_759.png)

```bash
cd C:\\Users\\
dir
cd Jon
cd Documents
cat flag3.txt
flag{********************************
```



<details>

<summary>Reveal Flag3: 🚩</summary>



`flag{admin_documents_can_be_valuable}`



<img src=".gitbook/assets/image-20230316143807868.png" alt="" data-size="original">

</details>
![](.gitbook/assets/2024-10-20_22-12-04_760.png)


***
Loading

0 comments on commit c31aaca

Please sign in to comment.