HTB - Bastion

Bastion

Getting Root:

  1. Enumerate SMB and find access to Backups directory

  2. Mount *.vhd file found on the backups folder and get SAM and SYSTEM files

  3. Crack the hash for user and ssh to the box

  4. mRemoteNG is installed in the box which stores saved session passwords using static string

  5. Decrypt the stored Administrator password using a tool from GitHub

  6. SSH to the box using the Administrator account

Nmap

Enumerating SMB

Looks like we can read IPC$, and we have READ and WRITE access to the Backups directory.

Mount the remote share

Interesting Files

Enumerating the Backups directory shows two .vhd files (virtual hard drives)

Mounting VHD (Virtual Hard drives)

Getting a hashdump from the image

Using the impacket secresdump

We get the hashes for the user L4mpje because the Administrator hash is empty. This can be recognized by the 31d6 of the admin hash.

Cracking the Hash

https://hashes.org/search.phphashes.org

I used hashes.org which is a free online password recovery tool and submitted the hash for user L4mpje and I got he following:

26112010952d963c8dc4217daec986d9:bureaulampje

Getting the User Flag

As noted on the output of the nmap results, this is a windows box but it is running ssh.

Privilege Escalation

There is an application called mRemoteNG installed.

Exploiting mRemoteNG

A quick google on "mRemoteNG exploit" return the following article detailing how abuse the poor encryption on this application.

mRemoteNG: Just Loaded with "Features" - Hackers VanguardHackers Vanguard

Getting the passwords from the encrypted config

I found the following tool on github. You can read the source code. It's safe

LogoGitHub - haseebT/mRemoteNG-Decrypt: Python script to decrypt passwords stored by mRemoteNGGitHub

To run the script, you the password string which is located in the following directory:

c:\Users\L4mpje\AppData\Roaming\mRemoteNG

All you have to do is read the latest xml backup file and get the string.

Decrypting the Password

Getting the Root Flag

PreviousHTB - ActiveNextHTB - Haystack

Last updated