Capture the flag (CTF)

Hack the Box (HTB) machines walkthrough series — Bastion

Today, we will be continuing with our exploration of Hack the Box (HTB) machines as seen in previous articles. This walkthrough is of an HTB machine named Bastion.

HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Bastion, is retired.

The walkthrough

Let’s start with this machine.

1. Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN.

2. The Bastion machine IP is 10.10.10.134.

3. We will adopt the same methodology of performing penetration testing as we’ve used previously. Let’s start with enumeration in order to learn as much information about the machine as possible.

4. As usual, let’s start with the nmap scan to gather more information about the services running on this machine. [CLICK IMAGES TO ENLARGE]
<<nmap -sC -sV -oA Bastion 10.10.10.134>>

5. As we can see, ports 22, 135, 139 and 445 are opened. Let’s start the enumeration with smb.
<<smbclient -I 10.10.10.134 -L Bastion>>

6. We can see that the shares are listed. Upon their individual enumeration, we can see that we have WindowsImageBackup.
<<smbclient //10.10.10.134/Backups>>

7. Under WindowsImageBackup, some VHD files were recovered.

8. We have two options: either to download the VHD files (which is never a good idea!) or to remotely mount them in read-only mode, like below:
<<mount -t cifs //10.10.10.134/Backups/ /opt/HTB/bastion/vhd -o ro>>

9. Below we can see that WindowsImageBackup is mounted.

10. Since the directory is mounted, now we can use “guestmount” to spin the VHD file, as below:
<<guestmount --add 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd --inspector --ro /opt/HTB/bastion/windowsvhd/ -v>>

11. After successful guest mounting, we can see that now we can enumerate the Windows system.

12. First thing that we can do is to copy the SAM, SECURITY and SYSTEM hives.

13. Now use pwdump on SAM and SYSTEM hives to recover hashes.
<<pwdump SYSTEM SAM>>

14. Using an online cracker, we recovered the password for the user named “L4mpje.”

15. Since port 22 is available on the original target, we can use these creds as we do below.

16. We can successfully log in and can then recover user.txt.

17. Now, let’s start the privilege escalation. Upon enumeration, it was found that software named “mRemoteNG” was installed on this box. This software has its vulnerabilities.

18. It has a config file named confsConf.xml which has an encrypted password that can be decrypted.

19. First, let’s find the location of the file using the below command.
<<dir /s /b confCons.xml>>

20. OK, we got the location and we can now see the password.

21. There is a git which can decrypt it: https://raw.githubusercontent.com/haseebT/mRemoteNG-Decrypt/master/mremoteng_decrypt.py

22. Using that, we recovered the password for user:Administrator.
Python remoteng.py <password>:

23. We use that password to log in.
<<ssh Administrator@10.10.10.134>>

24. Enumerate to recover the root.txt flag.

This was an interesting machine with lots to learn about mounting, guest-mounting and then enumerating to reveal vulnerable software.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

We will continue this series with more such interesting machines.