SystemSpoils Parrot CTF
Hello guys welcome back to another walkthrough by parrot CTF called systemspoils. The challenge has been rated as medium but in my opinion it’s a simple challenge. You start of by running a nmap scan on the box and discover a couple of interesting ports. The ones we are mostly interested in are SMB port 445, HTTP port 80 and RDP port 3389. On performing a directory brute forcing on port 80 we get some credentials that works on both SMB share and RDP. Using the credentials we login to the server and on running whoami /all we discover that we are in the administrator’s group hence we can get both user and root flag
On running nmap using the below flags we discover a few ports that are open. The command that we use was
nmap -sC -sV -oA nmap/systemspoils 10.14.3.204
# Nmap 7.94SVN scan initiated Sun Jun 16 15:23:54 2024 as: nmap -sC -sV -oA nmap/systemspoils 10.14.3.204
Nmap scan report for 10.14.3.204
Host is up (0.28s latency).
Not shown: 995 closed tcp ports (reset)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: DESKTOP-UCP7MTV
| NetBIOS_Domain_Name: DESKTOP-UCP7MTV
| NetBIOS_Computer_Name: DESKTOP-UCP7MTV
| DNS_Domain_Name: DESKTOP-UCP7MTV
| DNS_Computer_Name: DESKTOP-UCP7MTV
| Product_Version: 10.0.19041
|_ System_Time: 2024-06-16T19:27:42+00:00
| ssl-cert: Subject: commonName=DESKTOP-UCP7MTV
| Not valid before: 2024-06-13T20:05:41
|_Not valid after: 2024-12-13T20:05:41
|_ssl-date: 2024-06-16T19:27:48+00:00; -1m30s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-06-16T19:27:42
|_ start_date: N/A
|_nbstat: NetBIOS name: DESKTOP-UCP7MTV, NetBIOS user: <unknown>, NetBIOS MAC: 00:ff:50:b2:e8:71 (unknown)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
|_clock-skew: mean: -1m30s, deviation: 0s, median: -1m30s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jun 16 15:29:19 2024 -- 1 IP address (1 host up) scanned in 324.56 seconds
I started by trying to enumerate SMB share and check if null authentication was enabled. I used netexec which can be installed from the below github directory
https://github.com/Pennyw0rth/NetExec.git
The command i used was
netexec smb 10.14.3.204 -u anonymous -p "" --shares
Looking the the screenshot below it failed.
It appears to be a dead-end since we need valid credentials to access SMB Share. I decided to start by enumerating the Web Application. On opening the web application we get a default iis page
I performed directory brute forcing using feroxbuster
https://github.com/epi052/feroxbuster.git
And the command used was
feroxbuster --url http://10.14.3.204/ -w /usr/share/wordlists/dirb/common.txt
We get a directory called employees that has some usernames and passwords in profile.txt
I took all the usernames and passwords and created a wordlist. The performed a brute force attach using netexec.
If the server allows you first confirm the account lockout policy to ensure that you are now locking out user accounts while performing a brute force attack OR pick a couple of usernames first to use at test data. This will prevent user accounts from being locked out
Given this is a CTF i just performed a brute force attach using netexec and the command
netexec smb 10.14.3.204 -u users -p password --continue-on-success
We get a valid account for Jessica. Remember initially we had access RDP We can try and see if the credentials will work. The Remote desktop client i like using is called Remmina but rdesktop and xfreerdp still works fine
On trying the credentials they work we have access to the server
On opening the user file we get the user flag on the box
On running the command
whoami /all
We notice are an in the administrator’s group
I opened a second command prompt as administrator and on pillaging through the file system we get the root flag in DefaultAppPool
And the box is pretty much done. If you liked the walkthrough clap for me down below and follow me so that you don’t miss any upcoming walkthroughs