Lateral Movement & Pivoting CTF 1 - can only get flag 1!

Cyber Security
,
1

so i feel like my confidence has completely drained, i can only find the first flag (out of 5) for this lab. any help would be appreciated

2

You need to focus on Both ports open you can either get shell by msconsole or can use Creds to authenicate.

3

thanks, i will try again.

5

where you find your flag4 there i sthe hash file there left on tha first machine you neeed to pivot and use proxychains to use that for pass the hash.

6

Thank you. It’s done now.

7

How did you get the second flag :)?

8

no idea, im stuck on this too

9

how can i use msfconsole without creds? i cannot find mikes credentials at all, so im not sure what the next step would be?

10

could you help me with flag 2 please, also 3 and 5!

11

if you got flag1 then you should have to use use this creds on server which have database look into database may be you will find something

12

as i say look for open ports

13

ive got 2 open ports, ive used the creds and logged in using them - searched everywhere for mikes credentials to gain access to the other open port, but cannot find anything?

14

Not able to login as any user into mssql. It’s showing the error “ERROR 2002 (HY000): Can’t connect to local MySQL server through socket ‘/var/run/mysqld/mysqld.sock’ (13)“ on the machine target1. Is this supposed to happen???
any help would be appreciated.

15

For flag 5 use the psexec module of msfconsole in order to access to target3, setup the autoroute and the socks_proxy. Then on target3 C:\ you will find a file hash.txt with the hash of the user for the access on target4. Use proxy chains with evil-winrm passing -H . The flag is in the home directory C:\. Let me know if you have other needs. I’m trying to reach flag 2 and 3 now.

1 Like
16

For flag 2 and 3 you have to retrieve the credentials from the mysql db. You can use this command to access and identify the name of the db:

mysql -u john -h 127.0.0.1 -p

show databases;

but user John can’t access the db.

So from the kali machine you can use:

mysqldump -u john -h target1.ine.local -p(john’s password) (db name)

2 Likes
17

Thanks I overlooked the file and only focused on hashes in memory. Also, for target 1, I figure out how to connect to mysql service successfully.

18

Hello,
Try to keep it simple
Flag 2 and 3 from database found in target1 (mysql -u root -p -h 127.0.0.1)
Flag4 bruteforce Administrator user
Flag 5 search hash file on target3

2 Likes