HTB: Heist
Heist opens with a guest-accessible support portal hiding a chat with a Cisco router config attached. We crack its MD5 hash and decrypt the type 7 passwords, then rid-brute the domain for users and spray the creds to land WinRM on Chase for the user flag. For root, we spot Firefox running, dump its memory with procdump and pull the administrator's password straight out of the browser, then log in and grab root.txt.
Kicking things off with an nmap scan, we see we have something being served on port 80, and WinRM sitting on 5985 (note that one for later).
Heading over we find some sort of login portal, and guest login is available here. Logging in as guest, we see a chat between Hazard and a support admin, and there's an attachment on Hazard's message, so let's download it and check it out.
It's a Cisco router config, and we have credentials with hashed passwords. Let's crack these. The first is an MD5-crypt hash we throw at hashcat:
hashcat -m 500 -a 0 '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' /usr/share/wordlists/rockyou.txtCisco routers also used a fixed XOR key for their type 7 encryption that was published ages ago, so with that we can decrypt the other passwords.
dsfd;kfoA,.iyewrkldJKDHSUBsgvca69834ncxv9873254k;fg87 (the public Cisco type 7 key)
Once we've cracked these, let's spray them across the network and see what we can access. First we rid-brute the box to pull a list of users.
nxc smb $TARGET -u hazard -p stealth1agent --rid-brute 10000
We get a list of users! Now let's spray these users with the passwords we have, this time against WinRM.
nxc winrm $TARGET -u allusers.txt -p passwords.txt --continue-on-success
It worked, we have WinRM on Chase. Let's log in with evil-winrm. Heading over to Chase's desktop we find the user.txt flag.
Great, now let's enumerate and see how we can privesc. We spot Firefox currently running on PID 6220. We can use something like procdump to dump the process memory and pull it over to our Kali box.
.\pd.exe -accepteula -ma 6220 fox.dmp
Transferring the dump over kept failing on us, so instead we just search it right there on the Windows box with Select-String.
Select-String -Path fox.dmp -Pattern "password=" -AllMatches -Encoding ASCII | Select-Object -First 20
And there it is, the administrator's password sitting right in the browser's memory. Let's log in as admin with those creds. Heading over to the administrator's desktop, we grab the root.txt flag.
This box was pretty easy, but a good reminder: never forget to check what processes are running. If it wasn't for that I'd have been stuck going around in circles looking for an angle here.
