Hack The Box write-up: Bastion
Today, I’m taking on a retired Hack The Box machine: Bastion.
This time, I’m following the Guided Mode. Rather than simply giving you the commands and the answers, I want to use the guided questions to show you how to approach a machine and more importantly, how to develop the right hacker mindset.
Throughout this walkthrough, I’ll explain not only what I did, but also why I did it. The goal is to help you recognize similar situations on other machines and eventually solve them on your own.
So, grab your terminal, start enumerating, and let’s see what Bastion has waiting for us. And as always, feel free to share your own tips or alternative approaches at the end!
How many TCP ports are open on the remote host? 4
Well… this question might need a small correction.
A full port scan actually reveals 13 open TCP ports. So why does the answer say 4?
The key word here is common.
Instead of scanning all 65,535 TCP ports, the guided question is referring to the common TCP ports scanned by Nmap’s default scan.
To answer the question, I therefore started with a scan of the common ports:
nmap -sT --min-rate=5000 10.129.136.29The result gives us the four common ports we’re looking for.
If I perform a full port scan, I find 13 open TCP ports. So, below we can see the difference between the common TCP ports and all TCP ports:
If you want to learn more about common TCP ports and why they are often scanned first, check out this article: Common Ports — CBT Nuggets
What is the name of the non-standard SMB share on Bastion? Backups
We already know that SMB is running on port 445. To get more information about the services running on the target, I can use Nmap’s -A option, which enables several advanced detection features.
Among other things, Nmap runs scripts that can provide additional information about the SMB service, including whether certain forms of guest or anonymous access might be possible.
Next, I use NetExec (nxc) to enumerate the available SMB shares using the Anonymous account. This reveals an interesting share called Backups, and even better, I have both READ and WRITE permissions.
That immediately raises a question: What exactly is stored in this share?
What is the file extension of the two most interesting files on the share? VHD
To search for interesting files on the share, I use the spider_plus module of NetExec. The results reveal two files with a .vhd extension.
A VHD (Virtual Hard Disk) is a virtual disk image that can contain an entire file system, including partitions, folders, and files. In other words, it can essentially be a virtual hard drive stored inside a single file.
And this is where things start getting interesting.
If the VHD contains a Windows installation, there is a chance that we can access files from that system without actually having access to the running operating system.
Two files are needed from a Windows machine to dump its user hashes. One is SAM. What is the other? SYSTEM
This is more of a theoretical question, but it’s worth understanding because it explains why the VHD files are so interesting.
The Windows SAM (Security Account Manager) hive contains credential information for local Windows accounts, including password hashes. The SYSTEM hive contains key material used as part of the protection of the SAM data.
Therefore, having both the SAM and SYSTEM files allows tools such as impacket-secretsdump to extract the local account password hashes.
So now we have a new objective: find the SAM and SYSTEM files inside the VHD.
Get Jordi Been’s stories in your inbox
Join Medium for free to get updates from this writer.
To access the contents of the VHD, I first need to mount it. The article below explains how to do this:
After following the steps described in the article, I can browse the contents of the virtual disk and start looking for the files I’m interested in.
And there they are: SAM and SYSTEM.
I copy both files to my own system and use impacket-secretsdump to extract the local account hashes:
The output contains the NT hashes of the local accounts.
What is the password for user L4mpje? bureaulampje
Now that I have the password hash, it’s time to see whether it can be cracked.
I use John the Ripper to crack the hash, and eventually recover the password: bureaulampje
Submit the flag located on the L4mpje user’s desktop. DONE
What is the name of the remote connection management tool installed on Bastion? mRemoteNG
To answer this question, I start exploring the file system. One of the places worth checking is Program Files.
I notice that there are two different Program Files directories. The Program Files (x86) directory is generally used for 32-bit applications, while the regular Program Files directory is typically used for 64-bit applications.
While browsing through the installed applications, one name immediately catches my attention: mRemoteNG.
mRemoteNG is an open-source remote connection manager for Windows. It allows users to manage multiple remote connections from a single interface, including protocols such as RDP, SSH, Telnet, and VNC.
What is the name of the file that mRemoteNG uses to store encrypted user passwords? confCons.xml.20190222–1403486580.backup
When I inspect the mRemoteNG installation directory, I find several backup configuration files, including files with names such as:
confCons.xml.20190222-140XXXXXXX.backupThese configuration files can contain encrypted connection credentials.
What is the administrator’s password? thXLHM96BeKL0ER2
At this point, I have another interesting lead. I search online for information about how mRemoteNG stores and encrypts passwords.
I find a tool that can decrypt mRemoteNG credentials:
After decrypting the stored credential, I can recover the plaintext password.
And with that, I have everything I need to fully compromise the machine.
Submit the flag located on the administrator’s desktop. DONE
Bastion is rooted.
What started with a few open ports and an SMB share eventually led to a VHD containing a Windows file system, local account hashes, and finally stored credentials from mRemoteNG.
And that’s the end of this box.
Hopefully you enjoyed the walkthrough and more importantly, picked up a few ideas that you can apply to your own enumeration process. The goal isn’t to memorize a list of commands, but to learn how one discovery can lead to the next.
Don’t forget to like or follow my account for more hacking content!
