{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-windows-bastion-en","result":{"data":{"markdownRemark":{"id":"7e155cad-343c-5007-9b76-92cd6b190882","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy current rank on Hack The Box is ProHacker at the time of writing.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This is a writeup for the HackTheBox retired machine “Bastion.”

\n\n

About This Article

\n

The content of this article is not intended to promote any actions that violate social order.

\n

Please note in advance that attempting to attack environments you do not own or have not been authorized to access may violate the ‘Act on Prohibition of Unauthorized Computer Access’ (Unauthorized Access Prohibition Act).

\n

All opinions expressed here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

Starting with the usual reliable port scan.

\n
>IPをHOSTSに追加して高速スキャン\n$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.134 $RHOST/g' /etc/hosts\n$ nmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\n\n# All ports\n$ nmap -p- $RHOST -Pn -sC -sV -A  | tee nmap_max.txt
\n

Quite a few things appear to be open.

\n
PORT    STATE SERVICE      VERSION\n22/tcp  open  ssh          OpenSSH for_Windows_7.9 (protocol 2.0)\n| ssh-hostkey: \n|   2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)\n|   256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)\n|_  256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)\n135/tcp open  msrpc        Microsoft Windows RPC\n139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn\n445/tcp open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds\nService Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows\n\nHost script results:\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n| smb2-security-mode: \n|   3.1.1: \n|_    Message signing enabled but not required\n| smb2-time: \n|   date: 2022-08-14T07:08:23\n|_  start_date: 2022-08-14T07:05:13\n| smb-os-discovery: \n|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)\n|   Computer name: Bastion\n|   NetBIOS computer name: BASTION\\x00\n|   Workgroup: WORKGROUP\\x00\n|_  System time: 2022-08-14T09:08:24+02:00\n|_clock-skew: mean: -39m57s, deviation: 1h09m13s, median: 0s
\n

Let’s start by enumerating SMB.

\n
$ enum4linux $RHOST\n> 特に何も見つからず\n\n$ crackmapexec smb $RHOST\nSMB         10.10.10.134    445    BASTION          [*] Windows Server 2016 Standard 14393 x64 (name:BASTION) (domain:Bastion) (signing:False) (SMBv1:True)\n\n$ smbmap -H $RHOST -d WORKGROUP -u guest
\n

The smbmap results were as shown in the following image.

\n

\n \n \n \n \n \n \n \n \n

\n

Privilege Escalation

\n

I tried running systeminfo to look for vulnerabilities, but it seems I don’t have sufficient privileges.

\n
$ C:\\Users\\L4mpje>systeminfo                                       \nERROR: Access denied
\n

Continuing the enumeration, I found the Administrator’s RDP password embedded in the configuration file of an application called mRemoteNG.

\n
<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<mrng:Connections xmlns:mrng=\"http://mremoteng.org\" Name=\"Connections\" Export=\"false\" EncryptionEngine=\"AES\" BlockCipherMode=\"GC                         \nM\" KdfIterations=\"1000\" FullFileEncryption=\"false\" Protected=\"ZSvKI7j224Gf/twXpaP5G2QFZMLr1iO1f5JKdtIKL6eUg+eWkL5tKO886au0ofFPW0                         \noop8R8ddXKAx4KK7sAk6AA\" ConfVersion=\"2.6\">\n    <Node Name=\"DC\" Type=\"Connection\" Descr=\"\" Icon=\"mRemoteNG\" Panel=\"General\" Id=\"500e7d58-662a-44d4-aff0-3a4f547a3fee\" Userna me=\"Administrator\" Domain=\"\" Password=\"aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==\" Hostname=\"127.0.0.1\" Protocol=\"RDP\" PuttySession=\"Default Settings\" Port=\"3389\" ConnectToConsole=\"false\" UseCredSsp=\"true\" Rend eringEngine=\"IE\" ICAEncryptionStrength=\"EncrBasic\"       \n</mrng:Connections>
\n

This password is encrypted and Base64-encoded, but it can be decrypted using the following script.

\n

os.environ[‘PYGAMEHIDESUPPORT_PROMPT’] = ‘hide’mremoteng-decrypt/mremoteng_decrypt.py at master · kmahyyg/mremoteng-decrypt · GitHub

\n

Using this password to connect via SSH, I was able to obtain a shell with Administrator privileges.

\n

\n \n \n \n \n \n \n \n \n

","fields":{"slug":"/hackthebox-windows-bastion-en","tagSlugs":["/tag/hack-the-box-en/","/tag/windows-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-08-20","description":"Writeup for the HackTheBox retired machine 'Bastion'.","tags":["HackTheBox (en)","Windows (en)","EasyBox (en)","English"],"title":"【Easy/Windows】Bastion Writeup(HackTheBox)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-windows-bastion-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}