> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/blaster.md).

# Blaster

![](/files/-MeW8yOA4wzQs3kZDBR1)

## Activate Forward Scanners and Launch Proton Torpedoes

Lets run nmap scans to find open ports and the services running on them

![](/files/-MeWDEVFHTquifjXfDgR)

![](/files/-MeWFzQyzItLSIAR5X7q)

![](/files/-MeWDH2rtOTRcZTtFif1)

Lets check the website

![](/files/-MeWDOibfiZ9VTSuhZIp)

![](/files/-MeWDizzo9GGhBqbTkDQ)

Looks like there is nothing interesting here, lets look for hidden directories and pages with gobuster

![](/files/-MeWEoxABma4vVwnUAww)

![](/files/-MeWErn9JzheZ94uuQ0F)

Lets look at this directory

![](/files/-MeWEz2bI4WiWJioJeji)

We have a possible username Wade.

![](/files/-MeWF3s3d4biW0HA9fzQ)

Lets look at the website and see if we can find anything interesting. Looking around we come around this post

![](/files/-MeWGLiNbAClqMm6an--)

After we click on it, we get to this page

![](/files/-MeWGTaBbIUpNbeuDpwZ)

It looks like a password

![](/files/-MeWGY4_LH9O2tA4sUCC)

Now lets try to login through Remote Desktop with the credentials we have. We can use remmina to do this.

![](/files/-MeWGsHEWpOREcm5kCmU)

![](/files/-MeWGyWsf7uQiyCfyM29)

![](/files/-MeWH3ladaFHd9zYv4fc)

We are logged in, lets read the user.txt file

![](/files/-MeWHEutLYJ3AdRYnXaL)

## Breaching the Control Room

Lets look for interesting information like what the user what looking at, lets go to Internet Explorer ;-; and look at the history.

![](/files/-MeWJ-kNN_t6o53dMaD0)

We have the CVE number

![](/files/-MeWJBrtOysWGlKTNwoH)

We need an executable that is necessary for the exploitation of this vulnerability, and we can find this on the desktop

![](/files/-MeWJwJrNlb7dOPvnDyo)

![](/files/-MeWK-D0_oCYVSSHJsQH)

Lets look at this vulnerability closer and use it to get a shell on the machine

First lets look at this executable by clicking it.

![](/files/-MeWKMOUyv83w2ZJr2EI)

Lets go to show more details > Show information about the publisher's certificate

![](/files/-MeWK_jJ0NIl_uxpmuAy)

Lets click issued by link, and close the tabs, now lets go to internet explorer and hit Ctrl + s

![](/files/-MeWLyHIvO1cw0xHpIB3)

We have an error, now lets click ok and we see that the file explorer is open, lets open cmd

![](/files/-MeWMC4Dr4J4JmjuIxjT)

Now lets check who we are on the system

![](/files/-MeWMI_JBJDUN-aKy3rN)

![](/files/-MeWMPDQpBCBuakblNle)

Lets read the root flag

![](/files/-MeWMh9JifcYzj9z8bW2)

## Adoption into the Collective

Lets follow the steps mentioned in the room

First lets go to our machine and launch metasploit and select the module they provided

![](/files/-MeWNRCNdPusnv8K7hIE)

![](/files/-MeWNZYkCSw4tn3q9aeU)

Now lets set the target to PSH

![](/files/-MeWNjMvFUPv3rV88Y2V)

![](/files/-MeWNmGkuJiyUpcS30o4)

Lets set the options

![](/files/-MeWO4Y6nmbCJ9smn4s7)

Lets set the payload the run the exploit as a job

![](/files/-MeWPW9RD3rh1J7xG-qp)

![](/files/-MeWPSkpiYqpcsFgoXwV)

Lets select the command and paste it in the terminal of the machine we just exploited

![](/files/-MeWPf4ZkP-aZMXbfbhO)

And we should get a meterpreter shell

![](/files/-MeWQG9RBnqqtc_NmM1w)

We can get persistence with this command

![](/files/-MeWQVQfVHVtY_L9SWVc)