Block Walkthrough — TryHackMe Lab

Lab Setup: Acquiring the Evidence Files

Note: This challenge might require your own environment to be solved.

To begin the lab, click on the “Download Task Files” button provided in **TryHackMe** to obtain the evidence.zip file, which contains the data needed for the investigation. After extracting the contents of the ZIP file, review the recovered files to identify useful information. The goal of this lab is to analyze the extracted evidence and recover the required details to answer the questions step by step.

Q1: What is the username of the first person who accessed our server?

Answer: mrealman

On line 11 of the logs, the username of the first person who accessed the server can be identified. Alternatively, we can use the query:

smb2.cmd ==0x01

Explanation:

• smb2 → refers to the SMB2 protocol used for file and resource sharing on the network.
• 0x01 → represents the Session Setup command, which is sent when a user attempts to authenticate and start a session with the server.

This query filters the SMB2 traffic to show session setup requests, which are sent when a user attempts to establish a connection to the server. Running this query reveals two users who accessed the server: “mrealman” and “eshellstrop.”

Q2: What is the password of the user in question 1?

Answer: Blockbuster1

Step 1: Analyze the LSASS memory dump

To recover the password of the user identified earlier, the LSASS memory dump file (lsass.DMP) was examined. This file contains authentication data stored by the Windows LSASS process.

Step 2: Extract authentication data with pypykatz

The LSASS dump was parsed using pypykatz to extract stored credentials and hashes.

pypykatz lsa minidump lsass.DMP

Command explanation:

• pypykatz runs the credential extraction tool
• lsa targets LSASS authentication secrets
• minidump specifies the memory dump format
• lsass.DMP is the file being analyzed

This step revealed the NTLM hash associated with the target user.

Step 3: Save the NTLM hash

The extracted NTLM hash was copied from the output and saved into a separate file for offline cracking.

nano hash.txt

Command explanation:

• Creates a file to store the NTLM hash

Step 4: Crack the NTLM hash using John the Ripper

The saved NTLM hash was cracked using John the Ripper and a common wordlist.

john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Command explanation:

• john launches the password‑cracking tool
• --format=NT specifies NTLM hash format
• --wordlist=/usr/share/wordlists/rockyou.txt instructs John the Ripper to use a common password list to efficiently attempt password recovery.
• hash.txt contains the extracted NTLM hash

By extracting the NTLM hash from the LSASS memory dump and cracking it with John the Ripper, the password of the target user was successfully recovered.

Q3: What is the flag that the first user got access to?

Answer: THM{SmB_DeCrypTing_who_Could_Have_Th0ughT}

Step 1: Identify the Need for Decryption

This step required decrypting the captured packet file. When the PCAP was opened in Wireshark, the SMB traffic was shown as encrypted, which made it impossible to read the packet contents. To proceed, I looked into how SMB traffic can be decrypted and found that valid session keys are needed to unlock the encrypted data.

Step 2: Prepare a Script to Generate the Session Key

After understanding the decryption process, a Python script was used to generate the Random Session Key (SK). This script relies on authentication details observed in Wireshark, including the username, domain, password, NT proof string, and the encrypted session key from the SMB2 session setup.

The script used for this step is shown below:

import hashlib
import hmac
import argparse
from Cryptodome.Cipherimport ARC4
from Cryptodome.Hashimport MD4

defgenerateEncryptedSessionKey(keyExchangeKey, exportedSessionKey):
    cipher = ARC4.new(keyExchangeKey)
return cipher.decrypt(exportedSessionKey)

parser = argparse.ArgumentParser(
    description="Calculate the Random Session Key based on data from a PCAP"
)
parser.add_argument("-u","--user", required=True)
parser.add_argument("-d","--domain", required=True)
parser.add_argument("-p","--password", required=True)
parser.add_argument("-n","--ntproofstr", required=True)
parser.add_argument("-k","--key", required=True)
parser.add_argument("-v","--verbose", action="store_true")

args = parser.parse_args()

user = args.user.upper().encode("utf-16le")
domain = args.domain.encode("utf-16le")

md4 = MD4.new()
md4.update(args.password.encode("utf-16le"))
nt_hash = md4.digest()

respNTKey = hmac.new(nt_hash, user + domain, hashlib.md5).digest()

NTproofStr =bytes.fromhex(args.ntproofstr)
KeyExchKey = hmac.new(respNTKey, NTproofStr, hashlib.md5).digest()

enc_session_key =bytes.fromhex(args.key)
cipher = ARC4.new(KeyExchKey)
RsessKey = cipher.decrypt(enc_session_key)

print("Random SK: " + RsessKey.hex())

Step 3: Run the Script with Values from Wireshark

Once the required values were collected from Wireshark, the script was executed using the following command:

python3 script.py -u mrealman -d WORKGROUP -p Blockbuster1 \\
-n 16e816dead16d4ca7d5d6dee4a015c14 \\
-k fde53b54cb676b9bbf0fb1fbef384698

This command calculates and outputs the Random Session Key, which is required for decrypting the SMB2 traffic.

Step 4: Copy the SMB2 Session ID

Next, the Session ID associated with the SMB2 connection was copied from the session details visible in Wireshark.

Step 5: Add the Session Key to Wireshark

To decrypt the traffic, the generated session key was added to Wireshark by navigating to:

Edit → Preferences → Protocols → SMB2

Under “Secret session keys for decryption”:

• The copied Session ID was entered in the Session ID field.
• The generated Random Session Key (SK) was pasted into the Session Key field.

After clicking OK, Wireshark decrypted the SMB2 traffic automatically.

Step 6: Export SMB Objects and Retrieve the Flag

After decrypting the SMB2 traffic, navigate to File → Export Objects → SMB in Wireshark to export the files accessed over SMB. Save the objects as a CSV file.

Then, list the directory using ls and display the file with cat to reveal the flag.

Q4: What is the username of the second person who accessed our server?

Answer: eshellstrop

By applying the same filter used in the first question:

smb2.cmd ==0x01

We can identify the second username. This filter displays SMB2 Session Setup requests, which reveal user authentication attempts. Analyzing the results shows another user account associated with server access, allowing us to determine the second username.

Q5: What is the hash of the user in question 4?

Answer: 3f29138a04aadc19214e9c04028bf381

To identify the hash of the second user, the same approach used in the previous question was applied with the following command:

pypykatz lsa minidump lsass.DMP | grep 'eshellstrop' -A10

Explanation:

• pypykatz → a tool used to extract credential material from LSASS memory.
• lsa → targets the Local Security Authority, where authentication data is handled.
• minidump → indicates that the input file is a memory dump, not a live system.
• lsass.DMP → the LSASS memory dump file being analyzed.
• | (pipe) → passes the output of pypykatz directly to another command for filtering.
• grep 'eshellstrop' → searches the output for entries related to the user eshellstrop.
• -A10 → displays 10 lines after the matched username, which typically include credential details such as hashes.

Using this command makes it easier to isolate the credential information related to the second user and extract the associated hash from the output.

Q6: What is the flag that the second user got access to?

Answer: THM{No_PasSw0Rd?_No_Pr0bl3m}

For this question, the same SMB2 decryption process used earlier was followed. However, since eshellstrop’s password could not be cracked, a different approach was required. Instead of using the plaintext password, the Python script was modified to accept the NTLM hash directly.

The updated script calculates the Random Session Key (SK) using the NTLM hash along with other authentication values extracted from the PCAP file, such as the NT proof string and the encrypted session key. This allows the SMB2 session to be decrypted without knowing the actual password.

The modified script used for this process is shown below:

import hashlib
import hmac
import argparse

try:
from Cryptodome.Cipherimport ARC4
from Cryptodome.Hashimport MD4
except Exception:
print("Warning: You need pycryptodomex installed")

defgenerateEncryptedSessionKey(keyExchangeKey, exportedSessionKey):
    cipher = ARC4.new(keyExchangeKey)
return cipher.encrypt(exportedSessionKey)

parser = argparse.ArgumentParser(
    description="Calculate the Random Session Key using an NTLM hash"
)
parser.add_argument("-u","--user", required=True)
parser.add_argument("-d","--domain", required=True)
parser.add_argument("-n","--ntproofstr", required=True)
parser.add_argument("-k","--key", required=True)
parser.add_argument("--ntlmhash", required=True)
parser.add_argument("-v","--verbose", action="store_true")

args = parser.parse_args()

user = args.user.upper().encode("utf-16le")
domain = args.domain.upper().encode("utf-16le")
password =bytes.fromhex(args.ntlmhash)

respNTKey = hmac.new(password, user + domain, hashlib.md5).digest()
NTproofStr =bytes.fromhex(args.ntproofstr)
KeyExchKey = hmac.new(respNTKey, NTproofStr, hashlib.md5).digest()
RsessKey = generateEncryptedSessionKey(KeyExchKey,bytes.fromhex(args.key))

print("Random SK: " + RsessKey.hex())

After extracting the required values from Wireshark, the script was executed using the following command:

python3 script.py -u eshellstrop -d WORKGROUP \\
-n 0ca6227a4f00b9654a48908c4801a0ac \\
-k c24f5102a22d286336aac2dfa4dc2e04 \\
--ntlmhash 3f29138a04aadc19214e9c04028bf381

Command Explanation:

• -u eshellstrop specifies the username involved in the SMB2 session.
• -d WORKGROUP defines the associated domain.
• -n provides the NT proof string extracted from the NTLM authentication exchange.
• -k supplies the encrypted session key captured in the PCAP file.
• --ntlmhash passes the NTLM hash of the user’s password, allowing the session key to be generated without plaintext credentials.

The command outputs the Random Session Key, which was then added to Wireshark along with the corresponding Session ID under:

Edit → Preferences → Protocols → SMB2 → Secret session keys for decryption

Once applied, the SMB2 traffic was successfully decrypted. As before, the SMB objects were exported in CSV format, and the contents of the file revealed the second flag.

Walkthrough Complete 🥳🎉

Thank you for following this walkthrough! I hope you found it clear and helpful in completing the challenge.

If you enjoyed this guide, please consider sharing it with others who might be working on the same task!