HackTheBox: Heist

Enumeration

Nmap

Starting with an Nmap scan, we see several interesting open ports.

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-04 15:23 EDT
Nmap scan report for 10.129.96.157
Host is up (0.098s latency).

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-title: Support Login Page
|_Requested resource was login.php
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp   open  msrpc         Microsoft Windows RPC
445/tcp   open  microsoft-ds?
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49669/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

We accessed the website on port 80 and found a web login where we can log in as a guest.

Support login page allowing guest access

Logging in as guest, we can see a conversation about an issue. Here a user leaves an attachment that everyone can see and download.

Guest view of the support conversation with a downloadable attachment

The attachment is a Cisco router config file. Within the file we can see some leaked password hashes.

Cisco router configuration file exposing password hashes

We managed to crack the Cisco type 7 password with the following website:

https://www.ifm.net.nz/cookbooks/passwordcracker.html

Cracking the Cisco type 7 password online

Recovered Cisco type 7 password

To crack the Cisco secret 5 we used hashcat mode 500:

bash

hashcat -m 500 router.hash /usr/share/wordlists/rockyou.txt --force

<SNIP>

$1$pdQG$o8nrSzsGXeaduXrjlvKc91:##########

Status...........: Cracked
Hash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5))
Hash.Target......: $1$pdQG$o8nrSzsGXeaduXrjlvKc91

Foothold

Earlier in the conversation, the user Hazard asked the admin to add him to the server so he could access the files.

Conversation where the user Hazard requests server access

Using a password spray, we found valid credentials that gave us access to the system.

Password spray returning valid credentials

Now we can WinRM into the server.

WinRM session established against the target

And get our first flag.

User flag retrieved

Privilege Escalation

On the user’s desktop we found another file, todo.txt, which lists some things the user has to do.

todo.txt on the user's desktop

Following the note, this user has to check the issues list, which makes us think it could be a running service. Checking the processes, we saw Firefox in use.

Process list showing Firefox running

Using Procdump64.exe we dumped this process.

Dumping the Firefox process with Procdump64.exe

After the process was dumped and downloaded to our attack machine, we could see the admin username and password in clear text.

Admin credentials found in clear text inside the memory dump

Using the credentials obtained, we could WinRM into the server as admin.

WinRM session as the administrator

And here is our root flag.

Root flag retrieved

Thanks for reading.