Here we are on box number four which is fashion from hack the box.
Now this machine is somewhat enumeration heavy and I think this is a really good machine in terms of
just getting the feel for what you might encounter in.
Capture the Flag type events because while this box is somewhat easy in theory the enumeration behind
it is a little bit heavy.
You have to kind of dig through the weeds a little bit to find the answers you're looking for and that's
fantastic because that's really what hacking is.
So this feels a little bit practical from that sense in that if you are just looking at the surface
and you don't see something right away maybe you need to dig deeper.
So this is one of those dig deeper boxes and I really really did enjoy it when I was going through it.
So I wanted to share it with you all.
And here we are.
We can see that we've got a port twenty two open for us H.
We've got our P.S. we've got one thirty nine for forty five have got Sambo open or SMB open fifty nine
eighty five tells me that we've got when our M open and then forty seven 00 1 the rest of this looks
just pretty standard for RBC when our m.
So what we're gonna do in my mindset is we probably want to explore SMB first and I say that because
we typically don't find a lot of exploits with SSA H unless there's some sort of default password here
or dislike really basic way in.
We're likely going to find our first path on one thirty nine forty five whether it be some sort of file
share or whether it be something like a service exploit and it looks like we're running against Windows
Server 2016.
So it's relatively new the chances that we're gonna have a service exploit are probably pretty low here
but we'll still go ahead and take a look at this.
So our IP address here is 10 dot 10 dot 10 that 130 for Amazon to go ahead and copy this and I'm going
to go and use SMB client and just give it a quick list.
I want to see what file shares are out there
enter for the root password just keeping it blank and we have admin backup C in IPC.
Now I see Alvin C and IPC all the time chances are we can't get to these.
We could always do a quick check and see if we have the capability to list those out then that would
be really really quick game over but we don't really have any detail here.
We can also try connecting to it you can see access is denied but if we try connecting to backups
we can see that we actually do get access so we can do a quick s and you can see that there is a note
in here it looks like there's some sort of temp file and there's an image backup.
And so we can download the note we could say just something like yet note that t t and then we can just
open up a new tab and read the note
and if we just cut out note text it says sysadmins please don't transfer the entire backup file locally
the VPN to the subsidiary office is too slow.
Now this is honestly talking to us because if we dig into this further we're going to see that there
is a file in here that is rather large and because of that they don't want us to transfer this file.
Now you might have dug around when you're looking through the box maybe come into this directory here
and just try to look and see what's around you.
If we see these into the windows image backup and we l s there's a L4 looks like a lamp.
J E and we Ellis again and there's just data inside of here OK.
So it looks like there's a backup so if we see into a backup here
try sitting in this way.
OK then we Alex you can see it just gets it gets to be more files here.
There's a few different files but we've got these VHS files if you can tell it's a little hard to see
but look how large they are so with this V HD file which is just a virtual hard disk we're actually
going to want to mount it because it's telling us Hey please don't transfer the file it's just way too
slow or the VPN and it'll take you forever it's a wrong way to go.
So instead they want you to do some other form of this which is going to be mounting it.
And honestly when I was going through this the first time I wasn't sure on how to mount to be HD so
I went to Google and looked it up and I found this and I'll attach this to the course resources but
these are just step by step instructions on how to mount this here.
So we're going to need to do a quick couple of quick app installs.
So if you didn't already do this I have to do a couple installs here and it just looks like this.
Yes on that and that'll install pretty quickly and then I'll go grab the other one while we're waiting
and what we're gonna do is we're gonna come in here we're going to make a folder and we're going to
basically make a mountain folder we're going to mount this backup share to that folder and then we're
going to dive into there you'll see that there's a v HD file inside of it and then we'll end up using
this guest mount command to actually connect to this file so I'll show you what that looks like here
in a second.
We're going to press.
Q to quit
and we're going to let this install here really quick.
So if you're in the same spot that I am.
Go ahead and let this install and then we're gonna hit pause and then we'll come right back as soon
as it's done OK do a quick paste here on the sifts utilize
all right.
And now that that's done we can move forward.
All right so here we are.
Let's go ahead and just make a quick folder that we can mount into.
So I'm going to make a directory and we'll just call it backups
and from here we're going to just mount this with a mount command of Vashti for CFS dash.
Oh and we're going to just provide the read write permissions here and we're gonna give a user name
of guest because that's who we are.
Remember we didn't provide credentials and we mounted the share originally or when we connected to the
share and then we just need to supply the IP address and where we're connecting so we're connecting
to that backups folder and then we're gonna tie it to our backups folder here.
So let's make sure we understand this here so we have this folder we've connected to remember the backup
folder at 10 dot 10 dot 10 that one thirty four.
We're just doing a quick mount of that folder.
We're using a file type or a folder type of CFS or it's a file system type.
So this is a file system and then we're gonna do a dash oh we're saying hey this is going to be read
right and the user name is going to be guessed.
And then we're gonna connect to this.
Tie it to our folder that we just created.
So go ahead and mount it enter for the password.
Now you should be able to see these into backups hit Ellis and look what's there.
We have connection to this folder.
It's just like a shared drive.
Think of it just the same way as the shared drive.
All right.
So let's go ahead and open up a new tab or we're just going to store it here.
I'm actually going to do a C.D. dot dot and we'll just make a directory called Bastian and let's go
back and explore this a little further.
So if you go to see Windows Image do an L S here C.D. into this folder l s OK.
Let's see into the backup ls there.
And we have to the HD files right.
And you can see they're actually the same name.
There's a three and a four.
So what we're gonna do is we're going to mount these.
We can assume that one is likely for a boot partition.
One is likely for like a C volume
so with a little bit of experimentation it's actually going to be the C volume we're mounting.
So assume this is the boot partition the number four here is going to be the C volume are gonna be mounting
and let's go ahead and actually get this mounted.
So what we're gonna do is we're gonna come over here and we're just going to say guest mount we're gonna
do a dash a which is going to add the image and the image is going to be over at root and we had it
at backups
and backups.
OK.
And then Windows Image.
I'm trying to read off of this top line here and then l for then back the backup folder that we found.
All right
and then we're going to mount the nine for sure Bill to add the four there and that should auto tab
complete for the rest of this.
Then go ahead and we can add quotes around this.
Actually we probably won't need to.
But if it breaks we'll try to add quotes around it.
We're going to mount this partition to our dev SDK 1 and then we're just gonna supply a read only to
this.
We're not doing read write
and then I'm just going to say route Bastion is where we're gonna place this.
So now this is going to take just a little bit.
Go ahead and hit the pause button and then come back when it's ready.
So it's going to be mounting over us and b it's just going to take just a little bit.
So go ahead hit pause once it's done come back and then actually is done already.
So if you need to if you need to pause go ahead if you're ready let's move forward.
So I'm going to go ahead and C.D. into this bash in Fuller.
If we LSA this.
What can we see here.
Well we see basically what is like a C drive.
Right.
So I'm actually going to open up and I'm going to go into this bash and folder
and now we've got this C drive.
That should look just like if you're logged in at home.
Right.
So we can see users.
There's a user here this L for m p j e we could try to drive in here.
Look around this machine see what we can find out about it.
Right.
Now what am I interested in here.
I'm interested in trying to find some sort of information that will provide me access to this computer
now that can be in all sorts of places.
But what is that what does it make us think.
We have port twenty two open port twenty two open we're looking to find maybe SSA age credentials or
some way to log in.
So what am I looking for.
I'm maybe looking for an SS age configuration file or I'm looking for credentials which could be in
some sort of in some sort of Sam file.
Right.
We could be looking for a password stored in a text document in the user's folder for example.
So we're hunting down credentials here is really what I think we're after and unless there's some other
thing that we saw in an open port that might tell us otherwise.
But we're in this enumeration phase.
This is very very CTF heavy very realistic when it comes to CTF itself.
We might dig through the recycle bin and see maybe there's something in here just a desktop that I and
I.
So we have to look around this machine now just save time I'm going to go ahead and direct us down to
the path that we need to be so if you're familiar and you should be at this point.
Windows has what is called a sound file.
Now Sam stores the hashes of the machine right of the users that log into the machine.
And we could take those hashes off line and try to crack them.
We've got a few different tools that we can use.
First we can see if we can just pull the information download something like a secret stump or we can
actually see if we can crack this.
So you had a couple of different paths that you could take.
You can extract this information try to crack the hash see if you can crack the hash if the past is
weak enough or you can try to extract it as well.
I mentioned the extraction method here.
So what we can do is we can come into here and if you know where the sample there is it lives in windows
and we can go to system 32 which is just easier to scroll down than to type it in.
So we've got a system 30 to and again this might be a little slow just because we are running off of
a mount here.
So if yours does freeze.
Go ahead and just pause and wait it out and then come back OK.
And now that we're in here we need to search down for the config
which might take just a second for me to hunt through.
There it is it's easier than typing all this out because when you use a search bar here it just takes
for ever.
Speaking from experience.
So we need to get the hives here are the files that we're after which contain the information.
So we have the Sam.
The security in the system.
These are the common ones that we're going to need.
So I'm just actually going to just grab these three hit copy and then I'm going to go ahead and just
dump these into maybe a new folder.
So will this say a new folder and I'll call this Sam come into here and paste OK.
That'll make our life a lot easier.
So what we're gonna do is we're going to just C.D. back out of this and we'll see these into Sam now
from here we're going to run secret stuff.
So if you've never done secret summed up pi this is a great great tool I run this all the time.
Now from a pen tester perspective when I'm doing an assessment secret some PI is amazing because I could
just say hey here's the local username parser that I found and here's the IP address I know it works
for.
Go ahead and dump out the Sam file and whatever secrets that you can see on this machine.
And sometimes just instant win.
It's amazing stuff.
So a great tool to use on assessments but also a great tool to this use in end CTF as well.
So this is part of the impact tool kit as many tools are.
So I'm going to she's going to dump out the Sam files so we're going to need the Sam hive.
We're going to need the security hive and the system hive.
OK.
We're gonna need all three in order for this to work.
So we're gonna say secret stump and then word is going to provide it just like that.
We're gonna say Sam and they're going to give it to Sam and then we're going to come up here make sure
it's all right.
Security and system.
Right.
OK so security is security system is system.
Go ahead hit enter on that and we're missing syntax of local so we need to specify that this is actually
a local
all right.
And we have dumped that this is a local hash here.
So we're looking to dump all the local hashes meaning that we're not attacking active directory right.
These are just until I am hashes so we could take these hashes and we could try to crack say the administrator
hash or this hash here and try to log in with it we can see for example if this default password that
we've dumped has worked for us it's possible too that we get us take this hash and try to pass it into
the machine and see if it works for us.
Now with this being a backup it's possible that the administrator hash is no longer the same.
It's possible that this hash is no longer the same either.
So we have to see what's available to us.
Now we could take these and crack them but it looks like we have a password here already.
So with this password what we can do is we can go in and try to log into SS age with this to this machine.
So if we go back to our original screen here we're at 10 10 10 10 thirty four.
So if we just try to SSA age ten ten ten one thirty four and then we add in the user that we just saw
here which is L for M P J E so we'll just go ahead and add that in the beginning L4 MP JP at go ahead
and see if that works.
Yes for the fingerprint and then let's just paste that password we found and looky there we are in.
So now we have a low level user.
All right.
So now that we're on this machine you should have taken the process of doing your enumeration.
Right.
You could have attempted here to run a tool.
You could have run system info seen if there was any sort of exploitation if when piece found anything
for you etc..
Now this machine itself is pretty manual which is why I chose it.
I wanted to see if you would not just rely on tools but if you would also take a look around what is
there on the machine and see if there's anything of interest to you.
So if we look around this machine and we just kind of gather our foothold we can see these over to the
C folder and if we do a quick dir we could see that there is a program files folder.
So let's go ahead and just see the end of this
actively make a quick dir here.
We can see what's available to us now.
I like to look through the dates here and it's not always an indicator but if you look through the data
you could see like what maybe was already here before.
Like common files is here before dot nets here before but some of these have the same date.
So looks like they were all installed at the same time but all these 2016 ones probably not of interest.
Anything windows probably not of interest.
I'm just looking to see what might stand out if I'm looking for applications like what's installed in
this machine.
And that's always a good one.
Here we can see em remote.
And G is the only one to me that stands out like common files comes with Windows Internet Explorer Microsoft
dot net and then all these windows come with it.
We could of course look at program files see what's there as well.
We just need to identify what's available to us and this box may have thrown you for a loop if you figured
this out.
Great job.
This one may have thrown you for a loop and that's absolutely OK.
That was the intention.
So what I want you to take away from this is that we have to look at other things other than our our
tool sets.
And if you went through your full enumeration process and then it took you a while to get to this that's
that's fine that's the appropriate method.
So you're absolutely on track.
So what we're we need to do is we need to say OK we're here we see something that maybe doesn't look
right.
So we need to maybe just go out to Google and say OK what is first of all what is m remote n g OK so
it's a open source tab multi protocol remote connections manager.
Got you.
Does MMO engine have any exploit it has windows gather and remote say password extraction from rapid
7 OK.
That's great.
Well we're not using Metis flight so we're not going to do that.
However what we can do is we can read about it.
Right.
And so this model extracts module extract say parsers from remote and remote stores connections for
RTP V.A. SSA done it sounds like something we've used.
Right.
It saves the passwords in encrypted format.
This module will extract the connection info and decrypt to save passwords.
The passwords are deep Cristobal.
OK.
So if we go to this GitHub we could see that this python script was made to decrypt the stored passwords
so we could just provide it with a file and it will automatically do it for us.
So I'm going to clone this even though we don't have the file yet.
I just want to clone this.
And for me I like to clone over in the folder.
So I'm going to opt and then get clone really quick and we'll see these over into the M remote here.
Do a quick.
OK.
And we've got the file there.
So now we need to determine where this actually exists.
Where does the X AML file exists for this or where are the password stored to kind of give a hint the
way.
It's an axiom all file.
So we need to say
where are passwords stored
maybe we can open something like this or if we go back we could see stealing passwords from and remote
so on this blog here it says the connections in and remote our state are stored into a data and X email
report in your app data folder
ok.
So we need to look at the app data folder parsers are saved in encrypted format.
However this is trivial to circumvent.
Perfect.
So let's go ahead and try to dig into this app data folder so we'll go ahead and C.D. back and we're
going to see these into our user.
So of see the users and see the L4.
There we go.
We'll see these two app data do a quick LSI or dare.
Sorry.
And we're probably gonna go into roaming.
So let's see these and a roaming do a quick Dir.
And there we go we've got em remote so let's see these into m remote
while more dir and there are a bunch of comp cons dot ex email here so we've got backups as well.
Let's go ahead and just type out this comp cons and see what we've got here.
Now if we scroll towards the top and start reading from the path down you could see pretty much right
away there is this protected equals.
So there's what looks to be perhaps a password and then if we come down here we can actually see that
we have a password so and a hostname.
So we've got password for the user name administrator.
That's way more lucrative to me.
Password stored here hostname etc. So what we're going to do is just let's copy down this file we'll
copy down this entire file.
All right.
And then with this file copy I'm going to go ahead and just come into here and I'm going to get it and
we'll just call this confident X AML I'll paste it in here and save it
and then I'm going to have to go back and look at the actual decrypt.
So we'll just give it a file and we'll see how it works.
So Python 3 and remote and G file of competent X AML OK.
And maybe the file doesn't work.
So before we troubleshoot that issue let's go ahead and just take a look at this password itself.
So I'm going to come back up here.
I'm just going to grab this password and we'll see if the password can be decrypted.
Otherwise we might have to troubleshoot the issue.
So Python 3 and remote.
And then we'll do a string instead because there was a string option in here so we'll do a string and
see if it decrypt that
and I just have a little small copy paste issue here so let me grab the rest of that
paste OK.
That worked so we've got this long password that we never would have been able to crack in the first
place.
And hopefully this works for us so maybe we can try to SS H now and see if we can get into this as an
administrator.
Let's go ahead and just exit out of this we'll try SSA aging as administrator at
pace that password.
And there we go where the admin.
So we have escalated this machine to full Avenue.
Now this is an interesting box and I'm going to just be a broken record here but this box was meant
to challenge you and it was meant to take you down a path that maybe you quite haven't seen before but
really wanted to challenge your enumeration skills here.
This in theory or it is.
There is no in theory this is password stored in configuration files.
So that was the method of escalation.
Something you have seen before.
It's not as easy as just a registry query.
Right.
It's more that we had to dig through this and look for it and actually actually do our enumeration that
we should be doing as a hacker.
So this is one of the more challenging concepts that a lot of people struggle with and a lot of people
give up on the first go if they don't see it with their tools that's it it's over.
You have to break away from that tool mindset and start focusing on the manual side of enumeration as
well when the tools are not showing you anything.
So remember to look around you remember that just because something is is there doesn't mean it's going
to be easy especially with that mounting and then looking around the machine finding the actual exploit
that we needed to find finding the password stored in configuration identifying the remote and was not
part of this machine to begin with and kind of just understanding that and doing research on the programs
that you see it takes time.
But here we are.
If you've got this great job we are down to one machine left in the capstone so we're gonna go ahead
and cover that machine and we'll head onto the conclusion after that.
So I'll catch you in the next video as we walk through the next machine.