Last updated
Last updated
Scope
IP Address: 10.10.10.98
Nmap Scan
Enumeration
HTTP The webapp didn't reveal anything except this image at http://10.10.10.98
FTP I'm used to downloading all files on ftp server by one command and explore them locally
all files downloaded in 10.10.10.98 folder
Looking into zip file, it contains a .pst file and also encrypted
I will get the hash with john the ripper and attempt to crack it
Cracking Failed
I want to know what is that file and from the output below it's Microsoft Access Database
I had to move it to windows host and explore it.
I found a table that contain usernames & passwords
I will try to telnet with these credentials since, there is no SMB protocol
I remember that I couldn't crack the zip file, So I will try these passwords to decrypt the file
It revealed Access Control.pst file and I wanted to know what its type
It's Microsoft Outlook Personal Storage, I moved it to my windows host and opened it with outlook
It contains an email with the following data
So, We get a new credentials security:4Cc3ssC0ntr0ller and I will try it on telnet
User Flag: 713d8fafce27a927227b6a3124c79ea3
When I land on any windows machine on HTB, I always run cmdkey /list to view saved credentials
This can be abused to run as admin with runas command.
Since we can't execute .exe files, I will try to execute .ps1 as administrator, So I grep Invoke-PowerShellTcp.ps1 from my host, start webserver & nc listener and execute the command as administrator
We must add this line before executing the shell to Invoke-PowerShellTcp.ps1
Change IP & Port to yours when modifying the file
Netcat listener
Root Flag: 066b2ca40b4ab07b4387c6e4fe06bc32
Since the administrator credentials is stored in security user session, We can get the credentials by decrypting DPAPI secrets
We must have two files masterkey & credentials and there are located in current user directory under C:\Users\Security\AppData\Roaming\Microsoft\ but hidden.
I personally use ls with -Force flag to list hidden files
I will encode the two files as base64 and decode them in my attack host
On windows host:
Decrypting credentials file with masterkey
Note: We can provide the masterkey with /masterkey:<key> but mimikatz does it automatically
So, the admin credentials are administrator:55Acc3ssS3cur1ty@megacorp
