Nest,a Windows box created by HackTheBox user VbScrub, was an overall easy difficulty box. It had a smbshare which was Guest accessible and was leaking a cred for low privilege user.Using which we can get configurations for installed application on the box, one of which was exposing the creds for user of the box and also had a hidden directory which contain a VB projected which contain the routine to decrypt the password for the user. The user directory contain few files and a .NET binary which find was the to decrpyt the Administrator Password.
# Nmap 7.80 scan initiated Sat Jan 25 14:03:32 2020 as: nmap -sC -sV -oN nmap/nest 10.10.10.178 Nmap scan report for 10.10.10.178 Host is up (0.13s latency). Not shown: 999 filtered ports PORT STATE SERVICE VERSION 445/tcp open microsoft-ds?
Host script results: |_clock-skew: -1s | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2020-01-25T19:04:51 |_ start_date: 2020-01-25T19:00:56 4386/tcp open unknown | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe: | Reporting Service V1.2 | FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, RTSPRequest, SIPOptions: | Reporting Service V1.2 | Unrecognised command | Help: | Reporting Service V1.2 | This service allows users to run queries against databases using the legacy HQK format | AVAILABLE COMMANDS --- | LIST | SETDIR <Directory_Name> | RUNQUERY <Query_ID> | DEBUG <Password> |_ HELP <Command> 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port4386-TCP:V=7.80%I=7%D=1/25%Time=5E2C9495%P=x86_64-pc-linux-gnu%r(NU SF:LL,21,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(GenericLin SF:es,3A,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>\r\nUnrecognise SF:d\x20command\r\n>")%r(GetRequest,3A,"\r\nHQK\x20Reporting\x20Service\x2 SF:0V1\.2\r\n\r\n>\r\nUnrecognised\x20command\r\n>")%r(HTTPOptions,3A,"\r\ SF:nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>\r\nUnrecognised\x20comma SF:nd\r\n>")%r(RTSPRequest,3A,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\ SF:n\r\n>\r\nUnrecognised\x20command\r\n>")%r(RPCCheck,21,"\r\nHQK\x20Repo SF:rting\x20Service\x20V1\.2\r\n\r\n>")%r(DNSVersionBindReqTCP,21,"\r\nHQK SF:\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(DNSStatusRequestTCP,21," SF:\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(Help,F2,"\r\nHQK\ SF:x20Reporting\x20Service\x20V1\.2\r\n\r\n>\r\nThis\x20service\x20allows\ SF:x20users\x20to\x20run\x20queries\x20against\x20databases\x20using\x20th SF:e\x20legacy\x20HQK\x20format\r\n\r\n---\x20AVAILABLE\x20COMMANDS\x20--- SF:\r\n\r\nLIST\r\nSETDIR\x20<Directory_Name>\r\nRUNQUERY\x20<Query_ID>\r\ SF:nDEBUG\x20<Password>\r\nHELP\x20<Command>\r\n>")%r(SSLSessionReq,21,"\r SF:\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(TerminalServerCooki SF:e,21,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(TLSSessionR SF:eq,21,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(Kerberos,2 SF:1,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(SMBProgNeg,21, SF:"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(X11Probe,21,"\r\ SF:nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>")%r(FourOhFourRequest,3A SF:,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r\n\r\n>\r\nUnrecognised\x20 SF:command\r\n>")%r(LPDString,21,"\r\nHQK\x20Reporting\x20Service\x20V1\.2 SF:\r\n\r\n>")%r(LDAPSearchReq,21,"\r\nHQK\x20Reporting\x20Service\x20V1\. SF:2\r\n\r\n>")%r(LDAPBindReq,21,"\r\nHQK\x20Reporting\x20Service\x20V1\.2 SF:\r\n\r\n>")%r(SIPOptions,3A,"\r\nHQK\x20Reporting\x20Service\x20V1\.2\r SF:\n\r\n>\r\nUnrecognised\x20command\r\n>")%r(LANDesk-RC,21,"\r\nHQK\x20R SF:eporting\x20Service\x20V1\.2\r\n\r\n>")%r(TerminalServer,21,"\r\nHQK\x2 SF:0Reporting\x20Service\x20V1\.2\r\n\r\n>"); Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat Jan 25 14:05:29 2020 -- 1 IP address (1 host up) scanned in 117.50 seconds
Listing all the Shares in the SMB we see
Looking in all the shares we find few interesting files in Data Share as
//Data/Shared/Templates/HR/Welcome Email.txt
Download the entire share we read the Welcome Email.txt which leake a credential as TempUser:welcome2019
User
Using the credential we have already found we can search for new files inside the Data Share. so we just download all again.
Inside the Data/IT/Configs/RU Scanner/ru_config.xml we find a encrypted password for the user C.smith
Downloading that share folder we get a VB Project opening that in Visual Studio code and providing the user and encrypted password
and adding a break-point we get the password for C.Smith as xRxRxPANCAK3SxRxRx
and using that creds we can download the user share and grab user.txt as
cf71b25404be5d84fd827e05f426e987
Privilege Escalation
Now we need to go back to C.Smith folder and we see HQK Reporting folder
First of all we notice the interesting name of the file Debug Mode password.txt and the 0 bytes length of the file.
Downloading that in windows and checking for password in the alternate data Streams of the file. we find the password in password stream
as WBQ201953D8w using that on the 4386 port we see we have more command in the HQK service
And we also find an Administrator encrypted password
we saw a binary in C.Smith share HqkLdap.exe might be the key to decrpyt it. getting and load that in dnSpy, and running the binary with the ldap.conf as a parameter we see an error that it require a module looking in the binary we see it is Importing HqkDbImport.exe so we just create an empty file with that and we see we can run the binary. after fixing that we try to find where the password is decrypted and used we see that in CR.RD function so we add a log before the return and we compile and save the binary.
