HTB - Heist
Getting Root:
We gather a few creds from a cisco router configuration after login in as guest to the application on port 80
Enumerated the box using
enum4linux,smbmapandsmbclientand was able to get two additional usersThe box has port 5985 opened so decided to test all users and passwords to see if any of the combination was successful and was able to get a shell.
On the privilege escalation, I was not able to get much from Watson, Sherlock, winPEAS, PowerUp All-Checks or basic manual enumeration. However I noticed the box had Firefox listed in the process list, therefore, i decided to do a process dump using the Microsoft Sysinternals.
After analyzing the output file from the dump, I was able to get the password from the Administrator and login using evil-winrm.
Nmap
Enumerating SMB
I used smbmap, smbclient, enum4linux and crackmapexec and was not able to get anything.
Enumerating http
Gobuster
Going to http://10.10.10.149 redirects to http://10.10.10.149/login.php. I tried admin/admin and a few other combinations but nothing worked. However there is a "Login as guest" button and I was bale to login.
There user Hazard has attached the configuration of a Cisco router.
The configuration of the Cisco router has some encrypted passwords and usernames.
Decrypting the Cisco Passwords
User: rout3r
Password: $uperP@ssword
User: admin
Password: Q4)sJu\Y8qz*A3?d
The enable secret: stealth1agent
Enumerating SMB Again
With the new credentials obtained I enumerated smb, using smbmap, smbclient, enum4linux and crackmapexec I was bale to get two additional usernames using enum4linux
Using metasploit winrm_login module to see to brute force creds. For some weird reason crackmapexec smb and winrm modules were not successful and were generating a lot of errors.
Enumerating winrm
I tried to brute force the winrm login creds with crackmapexec using its winrm module but it was failing, there I decided to sue metasploit winrm_login auxiliary module.
Using evil-winrm
Privilege Escalation
Checking the Processes
We notice that Firefox is running. We could use the process dump tool from Microsoft sysinternals to create dump of the processes.
Using the Sysinternals Suite from Microsoft
The specific tool we are interested in is ProcDump.
ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. ProcDump also includes hung window monitoring (using the same definition of a window hang that Windows and Task Manager use), unhandled exception monitoring and can generate dumps based on the values of system performance counters. It also can serve as a general process dump utility that you can embed in other scripts.
Started with the first process which is using PID 752
Transferred the file to my Kali box using evil-winrm
Inspecting the file after transfer
Got some creds from the dump:
User: admin@support.htb
Password: 4dD!5}x/re8]FBuZ
Using evil-winrm to test those creds with the Administrator user confirms that was the correct password.
Got a shell as SYSTEM
Last updated