BASTION
- Layout for this exercise:
1 - INTRODUCTION
- The goal for this exercise is to develop a hacking process for the vulnerable machine Bastion from Hack The Box pentesting platform:
https://www.hackthebox.eu/
2 - ENUMERATION
- Bastion's IP is 10.10.10.134:
- Scanning with Nmap there are four open ports: 22, 135,139 and 445.
- Scanning deeper those four ports it seems that we have an SMB service running on port 445:
- This Nmap script enumerates the four shared folders:
- Connecting with smbclient:
- As expected, both ADMIN$ and C$ are not accessible:
- IPC$ seems accessible, but it does not yield any valuable information:
- However folder Backups gives us a lot of very important information about Bastion:
- Getting and reading note.txt it gives us a hint about backup related problems:
- Getting and reading SDT65CB.tmp it seems that the file is empty:
- Going into folder WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351:
- There are some .vhd and .xml files:
- VHD (Virtual Hard Disk) is a file format representing a virtual hard disk drive (HDD).
- It may contain what is found on a physical HDD, such as disk partitions and a file system, which in turn can contain files and folders.
- It is typically used as the hard disk of a virtual machine.
https://en.wikipedia.org/wiki/VHD_(file_format)
- Getting the 1st .vhd file and applying command strings over it we find a lot of strings, but nothing that could lead to find any interesting hint for our purpose:
............................
3 - EXPLOITATION
3.1 - Mounting the backup .vhd disk
- About the 2nd .vhd disk it is too large (5.4 GB) to check with strings, so it would be a better solution to mount it locally.
- Installing cifs-utils:
- Creating folder /Backups:
- Mounting locally the shared folder /Backups:
- The mounting process is successful:
- Looking for the 2nd .vhd disk:
- The guestmount program can be used to mount virtual machine filesystems and other disk images on the host.
- It uses libguestfs for access to the guest filesystem, and FUSE (the "filesystem in userspace") to make it appear as a mountable device.
http://libguestfs.org/guestmount.1.html
- Installing libguestfs-tools:
- Creating folder /vhd2:
- Using guestmount to mount the 2nd .vhd disk on local folder /mnt/vhd2:
- The mounting process is successful, so now we have access to the whole backup disk .vhd2:
3.2 - Getting the Security Account Manager (SAM)
- The Security Account Manager (SAM) is the database where Windows systems store users's passwords.
- The user passwords are stored in a hashed format in a registry hive either as a LM hash or as a NTLM hash.
- Bastion is a Windows Server 2016 so it uses NTLM hashes for sure.
- This file can be found in %SystemRoot%/System32/config/SAM and is mounted on HKLM/SAM:
- Using samdump2 to retrieve hashes from Bastion's users:
- Accounts Administrator and Guest are disabled, so let's write down hash for user L4mpje:
26112010952d963c8dc4217daec986d9
3.3 - Cracking the NTLM hash
- Hashkiller works online to decrypt the NTLM hash found in previous point:
3.4 - Getting a remote shell
- Now, using credentials L4mpje:bureaulampje we have an SSH connection and a remote shell:
4 - CAPTURING THE 1st FLAG
- Reading user.txt from user l4mpje's Desktop:
5 - PRIVILEGE ESCALATION
- As expected Administrator's Desktop is not accessible, so we need some type of Privilege Escalation:
- Browsing around with the command line we check the presence of the .vhd and .xml files found before:
- Going to L4mpje's home folder:
- However looking for hidden folders we discover a lot more available resources:
- Going inside AppData\Roaming there is a very interesting folder named mRemoteNG:
- Actually mRemoteNG is an open source remote control and connections manager:
- Reading confCons.xml we find encrypted credentials for Administrator:
- It happens that there are online available tools for dealing with mRemoteNG encrypted credentials, for instance the Python script named mremoteng_decrypt.py:
- Launching the script without parameters to explore available optional arguments:
- Applying the -s option, because the encrypted password seems to be encoded with base64 (see the final ==):
- So finally we have the Administrator's password: thXLHM96BeKL0ER2
- Connecting with SSH as Administrator we have a privileged remote shell:
6 - CAPTURING THE 2nd FLAG
- Reading root.txt:
