Permieter Breach
To breach the perimeter, we target the public-facing VPN server. Given its connection to the internal network, it presents a prime opportunity for initial exploitation.
┌──(kali㉿kali)-[~/Desktop/THM/Red Team Capstone/Capstone_Challenge_Resources]
└─$ hydra -L usernames.txt -P passwords.txt mail.thereserve.loc smtp
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-11-12 13:10:10
[INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
[DATA] max 16 tasks per 1 server, overall 16 tasks, 10800 login tries (l:15/p:720), ~675 tries per task
[DATA] attacking smtp://mail.thereserve.loc:25/
[STATUS] 986.00 tries/min, 986 tries in 00:01h, 9814 to do in 00:10h, 16 active
[STATUS] 1009.67 tries/min, 3029 tries in 00:03h, 7771 to do in 00:08h, 16 active
[25][smtp] host: mail.thereserve.loc login: laura.wood@corp.thereserve.loc password: Password1@
[STATUS] 1109.14 tries/min, 7764 tries in 00:07h, 3036 to do in 00:03h, 16 active
[25][smtp] host: mail.thereserve.loc login: mohammad.ahmed@corp.thereserve.loc password: Password1!
1 of 1 target successfully completed, 2 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-11-12 13:19:33
We can reuse the same username and password lists to perform a brute-force attack on the VPN login as well.
Breach
With these accounts, we can attempt to log into the webmail application, the VPN server (to obtain a VPN file assigned to the users), and, if fortunate, potentially gain Active Directory credentials. Ignoring the potential MySQL vulnerabilities for now, we focus on the webmail login.
After successfully logging into both accounts, we find that, unfortunately, nothing useful is located in the mailboxes.
Upon examining the VPN server, we successfully log in and retrieve two `.ovpn` files. The form prompts us to submit an account name. On login, it’s pre-filled with `laura.wood@corp.thereserve.loc`. Testing with my own name in the same format also works successfully.
At the start of the challenge, during the first attempt, the routes were configured correctly, allowing us to successfully reach the internal network IPs 10.200.XXX.21 and 10.200.XXX.22, both of which are WRK machines within the internal network.
WRKX Recon (10.200.XXX.21, 10.200.XXX.22)
Scanning those reveals their FQDN WRK_.corp.thereserve.loc and they have an open RDP port 3389.
An interesting observation is that both machines have Remote Desktop Protocol (RDP, port 3389) open. This suggests that we may be able to log in using the same credentials as their Active Directory accounts if they are consistent.
Internal Network Recon
Let's attempt to find other hosts with RDP enabled on the network by using Nmap with the following command:
Replace XXX with the appropriate subnet. This command will help us identify any other machines with RDP (port 3389) open.
Let's attempt to find other hosts with HTTP enabled on the network by using Nmap with the following command:
Replace XXX with the appropriate subnet. This command will help us identify any other machines with RDP (port 3389) open.
After the scan, we identify a fourth machine with ports 80 and 443 exposed, serving an HTTP/HTTPS web page. When accessing the IP in the browser, the page loads with a white background, displaying no content or errors.
By checking the source code, we discover that the web page is associated with the Swift Bank web application, as indicated by the static links present in the JavaScript code.
After adding the hostname to the hosts file, we can now successfully access the Swift Bank web application.
We can also run an Nmap scan against the Swift Bank web application to identify any open ports and services that might be exposed.
It seems that, for now, we are unable to do much with the application, as only ports 22, 80, and 443 are available.
By using Remmina and reusing the credentials of laura.wood, we successfully establish a connection to the WRK1 machine.
Flags 1 - 3
Last updated
Was this helpful?