search

HTB Nest Walkthrough

HTB Nest Walkthrough (nanobyte)

Jul 30, 2020 | nanobyte

This is one of my favorite Hack the Box machines, throughout my time completing them! I absolutely enjoyed every minute of this box.

My first NMAP scan, running with multiple flags, failed. I performed a simple nmap scan, and it returned only one port open:

123456789nmap 10.10.10.178                                                                                     Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-28 09:25 CST                                                      Nmap scan report for 10.10.10.178                                                                                    Host is up (0.043s latency).                                                                                         Not shown: 999 filtered ports                                                                                        PORT    STATE SERVICE                                                                                                445/tcp open  microsoft-ds                                                                                                                                                                                                                Nmap done: 1 IP address (1 host up) scanned in 5.41 seconds

In the above, with port 445 open, I then ran a scan against SMB. Server Message Block (also known as Samba) is a way for Windows to share files, printers, serial ports and communications abstractions such as named pipes and mail slots between computers.

123456789101112smbclient -L //10.10.10.178Enter WORKGROUP\root's password:         Sharename       Type      Comment        ---------       ----      -------        ADMIN$          Disk      Remote Admin        C$              Disk      Default share        Data            Disk              IPC$            IPC       Remote IPC        Secure$         Disk              Users           Disk      SMB1 disabled -- no workgroup available

The smbclient command showed that there were several network shares. Smbclient is a tool used for Samba, providing a ftp-like experience for users. I went through and connected to each, and found that I was able to login and find possible Usernames in the Users share. I took note of this, as this information is sure to come up later for this box:

12345678910111213smbclient \\\\10.10.10.178\\UsersEnter WORKGROUP\root's password: smb: \> dir  .                                   D        0  Sat Jan 25 17:04:21 2020  ..                                  D        0  Sat Jan 25 17:04:21 2020  Administrator                       D        0  Fri Aug  9 10:08:23 2019  C.Smith                             D        0  Sun Jan 26 01:21:44 2020  L.Frost                             D        0  Thu Aug  8 12:03:01 2019  R.Thompson                          D        0  Thu Aug  8 12:02:50 2019  TempUser                            D        0  Wed Aug  7 17:55:56 2019                10485247 blocks of size 4096. 6449754 blocks available

I did attempt to access the user share listed, but access was denied for each of the directories. Continuing my enumeration of the network shares, I connected to Data, and found I could login to the Shared directory:

123456789101112131415161718192021smbclient \\\\10.10.10.178\\DataEnter WORKGROUP\root's password: Try "help" to get a list of possible commands.smb: \> dir  .                                   D        0  Wed Aug  7 17:53:46 2019  ..                                  D        0  Wed Aug  7 17:53:46 2019  IT                                  D        0  Wed Aug  7 17:58:07 2019  Production                          D        0  Mon Aug  5 16:53:38 2019  Reports                             D        0  Mon Aug  5 16:53:44 2019  Shared                              D        0  Wed Aug  7 14:07:51 2019                10485247 blocks of size 4096. 6449754 blocks availablesmb: \Reports\> cd ..\Sharedsmb: \Shared\> dir  .                                   D        0  Wed Aug  7 14:07:51 2019  ..                                  D        0  Wed Aug  7 14:07:51 2019  Maintenance                         D        0  Wed Aug  7 14:07:32 2019  Templates                           D        0  Wed Aug  7 14:08:07 2019                10485247 blocks of size 4096. 6449754 blocks available

In this directory, I found a file, Maintenance Alerts.txt. I used the get command to downlaod the file to my local box, and on my Kali Linux viewed the file:

12345678910111213smb: \Shared\Maintenance\> dir  .                                   D        0  Wed Aug  7 14:07:32 2019  ..                                  D        0  Wed Aug  7 14:07:32 2019  Maintenance Alerts.txt              A       48  Mon Aug  5 18:01:44 2019                10485247 blocks of size 4096. 6449754 blocks available                smb: \Shared\Maintenance\> get "Maintenance Alerts.txt"getting file \Shared\Maintenance\Maintenance Alerts.txt of size 48 as Maintenance Alerts.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)root@bhax0r:~# cat 'Maintenance Alerts.txt'There is currently no scheduled maintenance work

However, still nothing! I then went up one directory, and logged into the Templates directory and found another file, Welcome Email.txt. This sounded promising:

1234567891011121314151617181920212223242526smb: \Shared\Templates\HR\> dir  .                                   D        0  Wed Aug  7 14:08:01 2019  ..                                  D        0  Wed Aug  7 14:08:01 2019  Welcome Email.txt                   A      425  Wed Aug  7 17:55:36 2019                10485247 blocks of size 4096. 6449754 blocks availablesmb: \Shared\Templates\HR\> get "Welcome Email.txt"getting file \Shared\Templates\HR\Welcome Email.txt of size 425 as Welcome Email.txt (2.4 KiloBytes/sec) (average 0.9 KiloBytes/sec)root@hax0r:~# cat 'Welcome Email.txt' We would like to extend a warm welcome to our newest member of staff, <FIRSTNAME> <SURNAME>You will find your home folder in the following location: \\HTB-NEST\Users\<USERNAME>If you have any issues accessing specific services or workstations, please inform the IT department and use the credentials below until all systems have been set up for you.Username: TempUserPassword: welcome2019Thank you

And I found a possible set of credentials, tempuser:welcome2019! Noting the Users directory earlier, I logged back in with these credentials to that network share:

1234567891011121314151617smbclient \\\\10.10.10.178\\Users -U TempUserEnter WORKGROUP\TempUser's password: Try "help" to get a list of possible commands.smb: \> cd TempUsersmb: \TempUser\> dir  .                                   D        0  Wed Aug  7 17:55:56 2019  ..                                  D        0  Wed Aug  7 17:55:56 2019  New Text Document.txt               A        0  Wed Aug  7 17:55:56 2019                10485247 blocks of size 4096. 6449754 blocks available                smb: \TempUser\> get "New Text Document.txt"getting file \TempUser\New Text Document.txt of size 0 as New Text Document.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)root@hax0r:~# cat 'New Text Document.txt'

However, this did not have any further information for me. I then attempted to login to the Users share with the other usernames, using the same password (users don’t always change default passwords) but this approach also did not work. So, I moved on and used these credentials agaisnt other shares. I did find that it allowed me into Secure$:

123456789101112smbclient \\\\10.10.10.178\\Secure$ -U TempUserEnter WORKGROUP\TempUser's password: Try "help" to get a list of possible commands.smb: \> dir  .                                   D        0  Wed Aug  7 18:08:12 2019  ..                                  D        0  Wed Aug  7 18:08:12 2019  Finance                             D        0  Wed Aug  7 14:40:13 2019  HR                                  D        0  Wed Aug  7 18:08:11 2019  IT                                  D        0  Thu Aug  8 05:59:25 2019                10485247 blocks of size 4096. 6449738 blocks available

But, there was nothing within that network share that I could use to my advantage. Moving on, I was able to log into the Data share with the tempuser credentials. I was able to find two interesting files in this share, RU_config.xml and config.xml:

Neither of these looked like much at first, but there is relevant and important information. FIrst off, we have a username and password from the RU_config.xml. The second can be easily missed, and this is the second File filename variable in config.xml. I can see that in the network share Secure$, there is a Carl directory within the IT directory. In the RU_config.xml, there is a c.smith password, can this be Carl!?

I logged in and attempted to see if I could get to the Carl directory:

And that worked! Note above, that when I was in the Secure$\IT directory, I could not list the contents. However, I could still change into the Carl directory. Awesome! Enumerating these files, I found a RUScanner in VB Projects direcory:

Looking at the Utils.vb file, there are encrypting and decrypting functions. Looking at how these functions work, there is reference to symmetric key creation, using Rfc2898DeriveBytes. Instead of trying to break this encryption, I took the complete file structure, and copied to a Windows machine. Once I had it locally, I was able to compile the code using Visual Studio.

Once compiled and I attempted to run the file, there was an error message:

Having RU_config.xml file, which contains the hash string that looked like base 64, I placed that file into the directory, and when I ran it, the program ran without any exception errors. I then placed a single line of code to write to console the Plain Text in the Utils.vb decrypt function:

And with that, when I compiled the code again, I could see the plain text password:

Now, I am able to connect to the Users share and own user:

Now to move on to own root. I looked in the HQK Reporting directory, and found a password file:

But, it was empty. That would have been to easy! However, looking at the file attributes, there is a stream associated to it, so I copied of the Alternate Data Stream (ADS) to get the password file:

With this password, I can telnet into the box and enable Debug:

Still connected with this telnet session, I enumerated and going up one directory, in the LDAP directory, I found a config file:

Using the RU_config.xml I attempted to decrypt returned a padding error. Looking further into the KqdLdap.exe, I found the following code in the CR function:

This is a different set of encryption, different IV, string, and iteration. So, I placed this into the Decryption function of DbPof.exe, and with the administrator hash in the RU_config.xml file, I reran the DbProf.exe program from command prompt, and got the administrator password!

I connected to SMB Share, but there was a shortcut link to the admins desktop. This was no good. So, I used metasploit (after multiple failed attempts with evil-winrm, impacket psexec.py, and winexec) psexec with reverse_tcp payload:

And rooted this box! The name, Nest, really fits this complex set of steps, nesting each step to proceed. Thanks for reading!

PreviousHTB Magic WalkthroughNextHTB Monteverde Walkthrough

Last updated