Loading...

THM - Relevant

Created2025-05-29|Updated2025-07-15|writeups

|Post Views:

We start with an nmap scan

We can see that the open ports correspond to those of a Windows machine, which is confirmed by visiting the web site on port 80:

We start by trying to enumerate smb shares with the guest account:

Note that you have read and write rights on a share. Using impacket-smbclient, we discover a password.txt file containing base64 :

By decoding it with CyberChef, we obtain Bob’s and Bill’s identifiers:

After trying to use these accounts to access other parts of the server, we realize that they are useless.

We then run an aggressive nmap scan to try and find another attack path:

We then decide to check that the SMB shares are not linked to the Web servers by trying to access the passwords.txt files from the servers:

We can see that we can access share files from the web site, so as we have write rights on this share, we can upload an aspx file (because it’s an IIS server) which will be executed by the server and allow us to obtain a reverse shell:

Related Articles

We start by enumerating the open ports with an nmap : We notice that the certificate used for https contains several domain names, so we add them to the /etc/hosts file to access them: Most of the domains are useless, but accessing the domain netops-dev.dodge.thm using https will bring up a blank page: By analyzing the source code, we discover a php file that allows us to modify the firewall configuration: By entering the sudo ufw disable command, we can disable the firewall rul...

This challenge simulates a scenario where you have to compromise an Active Directory environment.Scan nmap : In view of the open ports, we’re probably dealing with an Active Directory environment. We can try to obtain information using a few important ports: Port 53 (DNS) :The nmap scan provides us with FQDNs (Fully Qualified Domain Names) such as haystack.thm.corp. We can then ask DNS to provide us with all DNS records linked to the thm.corp domain. This can be done with the dig utility (di...

We start with an nmap scan: The robots.txt file reveals 3 directories. Only one of them is accessible:You can now create an account and the initial password will be md5(username+ddmm)So we create a test account with a date of birth of 00/00/0000. We can then calculate the requested hash with the following bash command:Use -n to avoid line breaks. You can then connect to the test account with this password:We can see that the admin account has recently logged in, and we can also see ...

EnumerationEnumeration of open ports using nmap : Looking at the smb share, we see that it is possible to connect to the share using the guest account : A log1.txt file is then retrieved from the anonymous share, which appears to contain passwords:Listing the web server folders with dirb, we come across a mail server connection page: Mail server accessUsing hydra and the log1.txt file, we find the password for the milesdyson account (name found when enumerating smb shares). This gives us acc...

THM - BOF - Task8

Step 1: Find the offsetThe first step is to find the offset that will allow us to replace the return address. To do this, there are 2 methods: Manual method:We can see in the source code that the buffer is 140 bytes long, but between the end of this buffer and the return address there are possible fill bytes (memory alignment) and the rbp register (base pointer), which is 8 bytes long on a 64-bit architecture.So, to overwrite the return address, you’ll need at least 148 bytes. To find out the...

THM - U.A High School

Machine presentation Level: Easy Link: https://tryhackme.com/r/room/yueiua Tools nmap fuzz dirb hexeditor steghide openssl EnumerationWe start with a simple nmap scan: 2 ports are open, the ssh port and the http port.Using dirb, we discover an index.php file in an assets directory, which is unusual: We then try to verify the existence or otherwise of an input parameter to this php file using FUZZ with this command : 1ffuf -u 'http://10.10.85.246/assets/index.php?FUZZ=whoami' -...

Loading Database