HTB- Access
Enumeration
Scope
IP Address: 10.10.10.98
Nmap Scan
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ nmap -p- --min-rate 10000 $ip -Pn -vv
PORT STATE SERVICE REASON
21/tcp open ftp syn-ack
23/tcp open telnet syn-ack
80/tcp open http syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ nmap -p21,23,80 $ip -sCV -oN Nmap/script-scan
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 425 Cannot open data connection.
| ftp-syst:
|_ SYST: Windows_NT
23/tcp open telnet?
80/tcp open http Microsoft IIS httpd 7.5
|_http-title: MegaCorp
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsEnumeration
HTTP The webapp didn't reveal anything except this image at http://10.10.10.98
FTP I'm used to downloading all files on ftp server by one command and explore them locally
all files downloaded in 10.10.10.98 folder
Looking into zip file, it contains a .pst file and also encrypted
I will get the hash with john the ripper and attempt to crack it
Cracking Failed
I want to know what is that file and from the output below it's Microsoft Access Database
I had to move it to windows host and explore it.
I found a table that contain usernames & passwords
I will try to telnet with these credentials since, there is no SMB protocol
Initial Access
I remember that I couldn't crack the zip file, So I will try these passwords to decrypt the file
It revealed Access Control.pst file and I wanted to know what its type
It's Microsoft Outlook Personal Storage, I moved it to my windows host and opened it with outlook
It contains an email with the following data
So, We get a new credentials security:4Cc3ssC0ntr0ller and I will try it on telnet
User Flag: 713d8fafce27a927227b6a3124c79ea3
Privilege Escalation
When I land on any windows machine on HTB, I always run cmdkey /list to view saved credentials
This can be abused to run as admin with runas command.
Since we can't execute .exe files, I will try to execute .ps1 as administrator, So I grep Invoke-PowerShellTcp.ps1 from my host, start webserver & nc listener and execute the command as administrator
We must add this line before executing the shell to Invoke-PowerShellTcp.ps1
Change IP & Port to yours when modifying the file
Netcat listener
Root Flag: 066b2ca40b4ab07b4387c6e4fe06bc32
Alternative path
Since the administrator credentials is stored in security user session, We can get the credentials by decrypting DPAPI secrets
We must have two files masterkey & credentials and there are located in current user directory under C:\Users\Security\AppData\Roaming\Microsoft\ but hidden.
I personally use ls with -Force flag to list hidden files
I will encode the two files as base64 and decode them in my attack host
On windows host:
Decrypting credentials file with masterkey
So, the admin credentials are administrator:55Acc3ssS3cur1ty@megacorp
Last updated