search

tryhackme HACKPARK

hashtag
ENUMERATION (NMAP)

nmap -sC -sV -vv -oA 2 10.201.36.250 -Pn
PORT     STATE SERVICE       REASON          VERSION
80/tcp   open  http          syn-ack ttl 125 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: hackpark | hackpark amusements
| http-methods: 
|_  Supported Methods: HEAD
3389/tcp open  ms-wbt-server syn-ack ttl 125 Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: HACKPARK
|   NetBIOS_Domain_Name: HACKPARK
|   NetBIOS_Computer_Name: HACKPARK
|   DNS_Domain_Name: hackpark
|   DNS_Computer_Name: hackpark
|   Product_Version: 6.3.9600
|_  System_Time: 2025-11-11T13:44:46+00:00
|_ssl-date: 2025-11-11T13:45:58+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=hackpark
| Issuer: commonName=hackpark
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2025-11-10T13:10:11
| Not valid after:  2026-05-12T13:10:11
| MD5:   293e:cb01:040b:786f:d5c6:e7cc:6791:c039
| SHA-1: b798:cf68:e0d3:997e:fd92:49c5:4c13:8541:2908:6325

GOT JOKER PHOTO reverse image search

hashtag
RECONNAISSANCE

analysing the source code i got version of blog engine i.e 3.3.6.0

still analysing the source code ..........

got something suspicious there ........... return url = /admin/

hashtag
LOGIN PORTAL

CAPTURED THE POST REQ AND GONE FOR BRUTEFORCING THE PASSWORD PARAM AS USERNAME WAS ADMIN (THROUGH HINT ON THM )

GOT 302 AND MINIMUM LENGTH AND PASS IS 1qaz2wsx

LOGGEDIN AND TRIED EVERY THING LIKE CREATING THE POSTS AND ALL THINGS , ELSE THE MAIN MOTIVE WAS TO GET A UPLOAD THING ASAP , AS MENTIONED IN THE EXPLOIT.DB

AND WE GOT A FUNCTIONALITY THAT ASKS FOR UPLOADING THE FILES TO THE POST(PUBLIC ONE BY THE ADMINISTRATOR ITSELF ..........

HERE I UPLOADED THE FILE (AS I AM WRITING THIS WRITEUPPP LATE AFTER JUST MY MACHINE COMPLETED ) I FORGOT TO TAKE THE SCREENSHOT .........

AS WE CAN SEE THE URL PRESENT THERE , SO THAT IF I GO AND CHANGE THE IP AND GOT A PERFECT SHELL

THERE WE GOT THE SHELL..........

hashtag
PRIVESC

STARTED THE PYTHON WEB SERVER ON PORT 8000

USING CMD CERTUTIL I GOT THE FILE TRANSFEREF , WE CAN ALSO DO THIS POWERSHELL -C

RUNNED THE WINPEAS BY .\rev.exe i saved that file as rev.exe

got two credentials ........here , ans if i login into this to rdp , you got both user and root immidiatly ........but we are doing with second method(conceptual prvided by thm )

known that there is running a SystemSheduler got to konw by winpeas and the directory of the path and i immidiately navigated to the path and got some Message.exe and more file running

made instant a payload for Message.exe and started the python server to transfer the file .........

using the certutil i was able to do transfer successfully............ on port 7777

as i copied the file it gave me the shell , if the shell is not caputred by netcat try to paste the certutil command again and u will get the shell or stop the particular process and start again , sc stop process name ,,, and st start process name

got root.txt

below is the final shell i established !!!!

after this i gone for user.txt .........

we can also get this by simply credentials we got by winpeas ..........

root.txt and inside jeffs user.txt

PreviousSAMBA && RPCBIND & MOUNTING & SMBCLIENTNexttryhackme gamezone

Last updated

Was this helpful?