Heist
https://app.hackthebox.com/machines/201
Last updated
Was this helpful?
https://app.hackthebox.com/machines/201
Last updated
Was this helpful?
Starting out we dive straight into port 80 where we are present with a login page. Testing with some common usernames and credentials proves unsuccessful.
We then use the "Login as guest" option and are directed to the /issues.php page. On this we see the user Hazard has attached a router configuration file.
The contents of the Cisco router configuration has been inserted below.
A little bit of research shows the Cisco "7" passwords can be easily decrypted to reveal the corresponding plain text string.
The following URL can be used to decrypt Cisco 7 passwords. Where we input both strings to get the passwords shown below.
Passwords:
$superP@ssword
Q4)sJu\Y8qz*A3?d
This encrypted secret string within the file was then cracked using hashcat.
Storing all the cracked passwords within a file alongside discovered potential usernames we then password spray with crackmapexec against SMB on the target system.
Where the following user credentials are revealed:
hazard:stealth1agent
Using the new set of credentials we can perform further recon against the target host to discover even more users.
With a more complete list of usernames we then spray again against SMB.
Where the following user credentials are revealed:
chase:Q4)sJu\Y8qz*A3?d
Using the newly acquires credentials we test WinRm with Evil-WinRm and obtain a foothold.
Grabbing the user.txt flag.
Performing application enumeration on the target system we find Mozilla Firefox is installed.
Searching through the log files it is revealed the administrator has used credentials inline with the Firefox process which has been logged by the Mozilla Maintenance service.
Credentials: Administrator:4dD!5}x/re8]FBuZ
The credentials are then used against the system over WinRm and confirmed administrative access.
