> For the complete documentation index, see [llms.txt](https://666isildur.gitbook.io/ethical-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://666isildur.gitbook.io/ethical-hacking/tryhackme/advent-of-cyber/accumulate.md). # Accumulate CTF The thing we need to do is to perform an nmap scan to enumerate all ports open and the services operating on those ports. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_Lp836Fa2s8lqARKH%2Fimage.png?alt=media\&token=af28268b-8fa3-4c84-8774-5784a4ca74ba) The nmap scan shows that two ports are open: port 80 running `Microsoft IIS httpd 10.0` and port 3389 `ms-wbt-server`. Opening the webpage on the browser shows us a normal windows server webpage. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_MIhji6kpGChoYs9E%2Fimage.png?alt=media\&token=a6f7503f-17ef-42df-9c88-d903da062c41) Also, searching on google for the `ms-wbt-server` tells us that this is a protocol used by Windows Remote Desktop. This may indicate that we can connect remotely do the target machine if we get the right credentials. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_NGHIMjidIJyDc8qO%2Fimage.png?alt=media\&token=d755e46e-0f0e-42ad-bafb-2707d677ea43) ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_NNFluxE6KfI-lqJX%2Fimage.png?alt=media\&token=a51e14dc-0199-41bc-b3eb-1bc33d92c011) To solve the first question we need to look for hidden directories. In day 2 we used `diresearch` to do that. This time I will use `gobuster`. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_OJh8re43RcaUMrbO%2Fimage.png?alt=media\&token=521cc6da-589b-40e3-bafc-749e0d28c4cb) With gobuster we managed to find the answer to the first question. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_OaMCPry4qameE8Zw%2Fimage.png?alt=media\&token=60b6bfc7-f8da-402e-8dd9-ce850f09a68c) Our next task is to get access to the target machine. Navigating to the hidden directory takes us to a retro fanatic page run by someone called `Wade`, which is basically a forum about games. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_P6PwMFNvH9aA1RnQ%2Fimage.png?alt=media\&token=903afecb-25ef-437a-9b02-2f105646cc8a) If we click on "Wade" it takes us the his user page. After examining the content, much of it is useless for us, except a simple post: ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_PU5HseMf4-hq86v8%2Fimage.png?alt=media\&token=6d1e95e0-2a6d-409d-8e42-ec2e276863d5) By clicking on "Ready Player One" and scrolling down on the comments we have what it seems to be the password of his account. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_Q1NSKuNqjNRGIYq1%2Fimage.png?alt=media\&token=3f35d00e-7130-4548-9fef-e18bce439f62) On the bottom right corner we have a login button that takes us to a wordpress login page. So we can try to login using `wade` as the username and the supposed password we just found. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_QW639ehRkBO5eokI%2Fimage.png?alt=media\&token=8ed72d7b-1bfc-46c8-ae00-9e10b4115c14) We successfully logged in to the wordpress page, which confirms that it was indeed that password that we found. After some time wasted here to realized it was a rabbit hole, it was time to look again at the `ms-wbt-server` that we found earlier. So we know that we can have remote desktop access through this protocol on port 3389, and we have credentials to do so. After googling for a good app to connect remotely I came accross `remmina`. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_SUKXOtWFDgdUS78E%2Fimage.png?alt=media\&token=6445abae-40f9-470d-b5b7-1b27a5bfff04) We now managed to get access the target machine remotely and read the contents of `user.txt` ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_SlXKbT9-rW-Dkrsp%2Fimage.png?alt=media\&token=48f83b1b-43bf-47b9-92fe-e72f388a1059) To elevate our privileges and read the contents of `root.txt`, DarkStar left us an hint. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_SxXf_zxajnyAbkD0%2Fimage.png?alt=media\&token=117eef68-972f-4ad5-b673-0a2197b4b89f) Seeing google chrome in the desktop and reading this hint just makes it obvious that we need to search on wade's browser history, although that wasn't even needed. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_TM1oRyRgXDwjg3NX%2Fimage.png?alt=media\&token=a77f7fda-b4a9-4c1c-b462-a5f9926b7481) Opening google chrome shows us that wade had saved a page about the `CVE-2019-1388`. Some google search and we can find out that this is a windows privilege escalation technique through UAC, using the 'HTML Help Activex Control' exe file to escalate privileges. We can find this file in the recycle bin. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_UI2rvRvk_puIfxT9%2Fimage.png?alt=media\&token=1b2a589f-b2f7-4c08-8d97-08842b6fde49) There are loads of youtube video tutorials on how to recreate this post-exploitation attack. By opening the file as administrator, we are prompted for the administrator password (that we don't have), so we click on `Show more details`. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_UsREafl487MbbOw-%2Fimage.png?alt=media\&token=10ff3e6d-8f00-4b71-b501-213406b960ff) We then click the link to show information about the publisher's certificate. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_VAtHB126PDXeMASR%2Fimage.png?alt=media\&token=9773fe44-3256-4ad7-8d7a-4eee6f57e202) ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7_KsIlia_xZQ7iaLR5%2F-M7_VKHQG9WSYEydhSsZ%2Fimage.png?alt=media\&token=832d3cec-426b-4cca-8f64-ab738777ce62) Next we choose to open it with Internet Explorer. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7ctXrfvT2h9Bevgzg_%2F-M7cxJ5SL3oyYgICK2cX%2Fimage.png?alt=media\&token=c1fc0c0a-8476-4da5-9ce9-eed74f5a464c) Once the page open (we dont have internet so it wont display any content) we click save as a save the file as `C:\Windows\System32\*.*`. Once there we select `cmd.exe` and choose open. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7ctXrfvT2h9Bevgzg_%2F-M7cyBqXz2IhSFvdI5sb%2Fimage.png?alt=media\&token=2024222c-b1ed-4261-b0a6-b325785a4bba) And we are now `authority\system` and can get the `root.txt.txt` flag as show below. ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7ctXrfvT2h9Bevgzg_%2F-M7cyoV8uhg75OCoF1PU%2Fimage.png?alt=media\&token=cfd6d0fb-c129-4c48-8618-ce56b1069d29)