Ice (Windows Icecast Media Server) || TryHackMe! Walkthrough

Hello everyone, and welcome to a new video in the TryHackMe playlist! This is my first walkthrough video on TryHackMe, and in this video, we'll be exploiting and gaining privilege escalation on a vulnerable VM called "Ice."

You might wonder why I chose this VM. During my time with VulnHub, I never encountered any Windows-vulnerable VMs. So, I decided to explore TryHackMe. Although several Windows VMs are available, I decided to start with a free one, and "Ice" was my choice.

As I mentioned in my introductory video, TryHackMe is known for its structured learning paths. In this video, our goal is to follow the given tasks, deploy, and hack into a Windows machine by exploiting a poorly secured media server.

Task 1: Connect

Connecting to the TryHackMe network is the primary step, and it's crucial to remember that you must connect every time you start your attacking machine.

To connect to the TryHackMe network, we use a bridge, and the most commonly used one is OpenVPN . If you've watched the HackTheBox series, you'll be familiar with how we use OpenVPN for this purpose.

Here’s how to do it:

First, Download the Configuration File. So, Visit the TryHackMe access page and download the OpenVPN configuration file.

Now, Open a Terminal. Use the OpenVPN client tool to connect. Ensure you use sudo for the command. 

When you run this command, you'll see a lot of text. At the end, it should say " Initialization Sequence Completed ."

You can verify your connection by looking at your access page on TryHackMe. Refresh the page, and you should see a green tick next to " Connected ." It will also show your internal IP address.

Now that you're connected, you are ready to use the machines on the TryHackMe network! When we deploy the VM in our task, you'll see its internal IP address.

Note that, the virtual machine used in this room ( Ice ) can also be downloaded for offline usage. Click on the provided link to access the download page. Additionally, the sequel to this room, Blaster, can be found there as well.

Task 2: Recon

In the past, I used the term " Enumeration," which is synonymous with " Recon ." So don't get confused by the terminology. Our first priority is to scan and enumerate our target. But before we do that, we need to identify our target.

First, we have to deploy the machine! This may take up to three minutes to start. Once the machine is deployed, the target IP address will be provided. 

For this task, the target IP is 10.10.162.253 .

Before proceeding, ensure that the target is reachable by performing a ping test . This helps confirm that the target is connected to our network and is receiving data.

So, let's now perform a network scan to detect which ports are open. This is a crucial part of the recon process as it helps us understand the attack surface and plan targeted attacks.

Perform Network Scan using Nmap

We will use the famous Nmap tool for this purpose.

Where, 

• The -sC option is used to perform a script scan using the default set of scripts. It's useful for gathering additional information about the target.
• The -sV option enables version detection, which identifies the versions of services running on open ports.
• The -Pn option is used when we want to perform a scan without pinging the target first. It treats all hosts as online, which is useful if ICMP requests are blocked.

The network scan reveals several important details about the host at the IP address,  10.10.162.253 , which appears to be a Windows 7 machine named " Dark-PC " within a workgroup called " WORKGROUP ." The scan identified 10 open ports, each associated with specific services:

• 135/TCP (msrpc): This port is used by Microsoft Windows RPC (Remote Procedure Call) , a core functionality for communication between applications and services.
• 139/TCP (netbios-ssn): This port is used by Microsoft's NetBIOS name service, enabling network browsing and resource sharing.
• 445/TCP (microsoft-ds): Commonly used for SMB (Server Message Block) file sharing, this port provides access to Windows file systems. The scan also revealed that the operating system version is Windows 7 Professional 7601 Service Pack 1 , and the machine is part of the " WORKGROUP " workgroup.
• 3389/TCP (ssl/ms-wbt-server?): Typically used for Remote Desktop Protocol (RDP) with SSL , this port was found to have a self-signed certificate named "Dark-PC," valid from July 22nd, 2024, to January 21st, 2025.
• 5357/TCP (http): This port hosts a basic web server running Microsoft HTTP API httpd 2.0 . The server responded with " Service Unavailable ."
• 8000/TCP (http): Another web server is potentially running on this port, possibly an Icecast streaming media server. However, specific title information was unavailable.
• 49152/TCP, 49153/TCP, 49154/TCP, 49158/TCP, 49159/TCP, 49160/TCP (msrpc): These ports are associated with additional Microsoft Windows RPC services. They are currently identified as unknown, and further investigation might be needed to determine their exact purpose.

Answer the questions below

What is the Port number of one of the more interesting ports that is open Microsoft Remote Desktop (MSRDP)?

• As I already told you this is: 3389

What service did nmap identify as running on port 8000? (First word of this service)

• This port 8000 runs the Icecast streaming media server. So, the first word of this service is  Icecast.

What does Nmap identify as the hostname of the machine?

• The hostname identified by Nmap is DARK-PC.

Now, let's move on to Task 3.

Task 3: Gain Access

Gaining access involves exploiting a vulnerability to establish a foothold on the target system. In our previous task, we identified several interesting services running on our target machine, including Icecast.

Icecast is an open-source software that allows streaming audio content over the internet , much like a digital radio station. It can be used for creating online radio stations or hosting personal audio libraries. However, the version of Icecast running on our target has significant vulnerabilities with a high-risk level, scoring around 7.5 (or 7.4 depending on the source).

Answer the questions below

What is the Impact Score for this vulnerability? It has given a hint to use CVEdetails.com, to find the impact score. 

However, I couldn’t find the information directly on the site. Instead, I used a useful trick: a Google search led me to an Exploit DB link where the CVE details are available.

The vulnerability in question is associated with Icecast 2.0.1 (Win32) and is identified as CVE-2004-1561. 

• Based on the details found, the Impact Score for this vulnerability is 6.4.

What is the CVE number for this vulnerability? 

• The CVE number is already told, that is CVE-2004-1561 .

Now that we’ve identified the vulnerability, let’s find and use the corresponding exploit with Metasploit.

Exploit using MSF Console

Let's go ahead and launch the Metasploit framework. 

Once the Metasploit console starts, search for the exploit related to Icecast using: search icecast .

What is the full path for the exploitation module?

• The path for the exploitation module is  /exploit/windows/http/icecast_header/ .

It shows us one module related to Icecast. Let's go ahead and select this module for use. Type the command ` use 0 ` to select our search result.

Following selecting our module, we now have to check what options we have to set. Run the command ` options `.

By looking at the options, we’ll need to set the RHOSTS (Target IP address) and the LHOST (Attacker’s IP address) . The IP address for LHOST can be found on the tun0 adapter.

With all options set, we are now ready to execute the exploit.

Upon successful attempt, we have successfully got a Meterpreter session. 

Answer the given questions

The only required setting that is currently blank is RHOSTS. 

• Although LHOST is required, if you are using a paid membership or an online attacking machine, LHOST might already be set.

Task 4: Escalate

Previously, we’ve successfully gained access to the victim machine! Now, it’s time to enumerate the system and identify potential privilege escalation paths to gain administrative powers. Let’s follow the steps below to gather the necessary information:

To not distract our path we will follow the questions below.

What's the name of the shell we have now?  

• We are currently using the Meterpreter shell.

What user was running that Icecast process?

To determine which user is running the Icecast process, we need to check the running processes. Use the ps command in Meterpreter. 

• From the output, you’ll see that the Icecast process ( Icecast2.exe ) is running under the user Dark.

Answer the questions below

Top of Form

What build of Windows is the system?

To get the Windows build information, use the sysinfo command in Meterpreter. 

• The build number of the Windows system is 7601.

Now that we know some of the finer details of the system we are working with, let's start escalating our privileges. First, what is the architecture of the process we're running?  

• As from the system information, we already found that the architecture is X64 .

Now that we know the architecture of the process, let's perform additional reconnaissance. Although this may not be as effective on x64 machines, we should run this command to find potential exploits.

This command may appear to hang for a few minutes as it tests various exploits. Once it completes, it will provide a list of potential local exploits for privilege escalation.

From the results, we have to select an appropriate exploit that could provide full access. For this walkthrough, we will choose the first exploit.

Answer the questions below

What is the full path for the first returned exploit?

• The path for the first exploit is exploit/windows/local/ bypassuac_eventvwr.

Once you’ve identified the exploit to use, background the current session to proceed with the next steps. You can do this by typing,  background or by pressing Ctrl + Z .

Before proceeding with the exploit, take note of the session number you have. You can list all active sessions by using the command sessions when outside the Meterpreter shell. In my case, the session number is 1.

Now, go ahead and select the previously identified local exploit for use with the command, use, and then specify the full path for the exploit.

It’s time to check the available options to configure. 

Local exploits require a session to be specified, so set this by running:  set session <specify the session number> , that is, also after setting the session number, additional options need to be configured from the options menu. We'll have to set one more as our listener IP isn't correct.

So, Set the LHOST option now.

Answer the questions below

What is the name of this option? 

• The answer is RHOST.

Once, the necessary options are configured, we now can run the privilege escalation exploit by typing: run.

Please note that this might take a few attempts, and you may need to restart the machine and re-exploit the service if the initial attempt fails. After successfully escalating privileges, a new Meterpreter session should open.

So, we can now verify the expanded permissions using the command,  getprivs.

Answer the questions below

What permission listed allows us to take ownership of files?

• The “ SeTakeOwnershipPrivilege ” permission listed allows us to take ownership of files.

Let’s move on to the next task.

Task 5: Looting

In this task, we will learn how to gather additional credentials and crack the saved hashes on the machine. Before proceeding, we need to migrate to a process that has the necessary permissions to interact with the lsass service, which handles authentication in Windows.

Before further action, we need to move to a process that actually has the permissions that we need to interact with the lsass service, the service responsible for authentication within Windows.

To identify a suitable process, we first list all running processes by using the command ps. This will display a list of processes along with their process IDs (PIDs), names, and the users running them.

Now, we have to identify a Suitable Process.

Look for processes running under NT AUTHORITY\SYSTEM account. Even though our current process may not have the required permissions, we can migrate to a process running as SYSTEM to gain full access.

By migrating to a SYSTEM-level process, we gain the necessary privileges to interact with the lsass service and extract credentials. Once we've identified a suitable process, we can proceed with the migration and begin gathering credentials.

In order to interact with,  lsass , we need to be within a process that matches the architecture of the lsass service (x64 in this case) and has the same permissions. The printer spool service is ideal for this purpose, as it meets the necessary criteria and will automatically restart if it crashes.

Answer the questions below

What's the name of the printer service? 

• The answer is spoolsv.exe .

When we say ' living in ' a process, it refers to the technique of injecting malicious code into a running program by loading a shared library (DLL) into it. This can allow us to spawn a new thread that hosts our shell. To migrate to the printer spool service, use the command: migrate -N <specify the PROCESS_NAME>.

Let’s Check the Current User. After migrating, verify the user context by running the command getuid.

Answer the questions below

What user is listed?

• The answer should be NT AUTHORITY\SYSTEM.

Now that we've achieved full administrator permissions, we can focus on extracting valuable information and credentials from the system.

Using Mimikalz

Mimikatz is a well-known tool for dumping passwords and is incredibly useful for gathering credentials. In our meterpreter session, we can use the updated version of Mimikatz, known as Kiwi , by loading it with the command load kiwi .

Use the command load kiwi to load Kiwi into the meterpreter session. This will expand the help menu with new commands available for use.

Check the newly added commands by typing help to see what options are available. Here, it is.

Answer the questions below

Which command allows up to retrieve all credentials?

• The answer is the creds_all command, which retrieves all credentials from the system.

Run the  creds_all  command, to dump all available credentials. 

Mimikatz can extract these passwords from memory, even if the user ' Dark ' is not currently logged in, thanks to a scheduled task that runs Icecast under the ' Dark ' user's account. Additionally, the absence of Windows Defender on the system makes this process easier.

Answer the questions below

What is Dark's password? 

• The password is Password01!

Now that we've retrieved the necessary credentials, let's move on to the next task.

Task 6: Post-Exploitation

Let's explore the post-exploitation actions we can take on a Windows system. These actions can provide valuable information and access, but they should be carried out with caution and only when authorized.

Before diving into specific actions, let's revisit the help menu in the meterpreter shell. We'll use it to answer the following questions.

Answer the questions below

What command allows us to dump all of the password hashes stored on the system?

• The answer is hashdump. 

The hashdump command allows us to dump all the password hashes stored on the system. 

Note that while we can obtain these hashes, we won't attempt to crack the administrative password, as it is intentionally strong to prevent password spraying attempts.

Answer the questions below

While more useful when interacting with a machine being used, what command allows us to watch the remote user's desktop in real-time? 

• The screenshare  the command allows us to view the remote user's desktop in real-time. 

This is particularly useful when the machine is actively being used.