HTB: Nest

Looking at the nmap scan, there is almost nothing exposed here. SMB on 445, and an unknown service on 4386 that the fingerprint identifies as HQK Reporting Service V1.2, which runs queries against databases in a legacy format. The banner even lists its own commands, including a DEBUG that takes a password.

There's a reporting service on port 4386, so let's try to connect to it via netcat.

nc 10.129.86.234 4386

We don't get a response worth anything, so let's run this by enum4linux and see what we can get.

enum4linux-ng -A 10.129.86.234

The server allows anonymous enumeration, so let's run NetExec SMB with user guest and no password and see if we find any shares.

nxc smb 10.129.86.234 -u 'guest' -p '' --shares

Alright, we have a Data and a Users share, both looking nice and sweet. Let's see what we can find in them.

smbclient //10.129.86.234/Users -U 'guest%' -c 'recurse ON; ls'

The Users share gives us a set of usernames we can add to a usernames.txt file.

In the Data share we have some onboarding material. There's a welcome email we should go take a look at and see if it has a set of default credentials or material to work with.

We got ourselves credentials for TempUser. Let's run this by NetExec and see what we can get.

nxc smb 10.129.86.234 -u 'TempUser' -p 'welcome2019' --shares

Looking at the shares we can see that there is a new Secure share. Let's explore that.

smbclient //10.129.86.234/Data -U 'TempUser%welcome2019'

Going through the shares we find an XML config file in the IT, Configs, RU Scanner folder. Let's download it to our loot folder on Kali and continue searching.

We have creds in this XML for the c.smith user, and their password looks base64 encoded. Let's decode it.

Trying to decode this raw doesn't work. Doing a little research we find out this is a Notepad++ VB.NET function type of thing, so let's head back into the share and search that NotepadPlusPlus folder and see what we can find.

Looking at the config XML we can see that there's a share we couldn't see before. Let's try to blindly download that Temp.txt from the Carl folder in IT.

We can't get to that file, but looking in the Secure share we find source code for the RU Scanner, and upon enumerating that we find a few interesting files.

We download the .vb files and open them up in Mousepad.

Opening up Utils.vb gives us all the material we need to decrypt the c.smith account password. The passphrase, the salt, the iteration count, the IV and the key size are all sitting right there in the source. Doing a little research we can whip up a decrypt script in Python with the pycryptodome module and decrypt this.

This gives us the password, and we will run enumeration now using the c.smith account and see what we can find.

impacket-smbclient c.smith:xRxRxPANCAK3SxRxRx@10.129.86.234

Going through the Users share we find the user flag in the C.Smith folder.

Inside HQK Reporting there's a Debug Mode Password.txt that looks empty. We need to pull the allinfo trick to see what's actually in it, because the content is hiding in an alternate data stream.

smbclient //10.129.86.234/Users -U 'c.smith%xRxRxPANCAK3SxRxRx' \
  -c 'allinfo "C.Smith\HQK Reporting\Debug Mode Password.txt"'

That shows us a :Password stream on the file, so we run it back in and pull that stream down.

smbclient //10.129.86.234/Users -U 'c.smith%xRxRxPANCAK3SxRxRx' \
  -c 'get "C.Smith\HQK Reporting\Debug Mode Password.txt:Password" debug_pw.txt'

cat debug_pw.txt

Let's head back to what we did at the beginning and hit that port with our netcat, and try to use this password to debug.

ncat -C 10.129.86.234 4386

Using the debug tool we traverse up to see what we can find, and behold, the LDAP folder, which contains an Ldap.conf file.

SHOWQUERY 2 lets us read the config and we save this to our notes. We need to find the rule set for the decrypt. Remember the .exe file we pulled earlier? That should have it, so let's head over and pull it apart and see what we can find.

strings -e l HqkLdap.exe > strings.txt
strings HqkLdap.exe >> strings.txt
grep -nE '^[A-Za-z0-9]{4,20}$|Rfc2898|passPhrase|salt|Vector|Decrypt' strings.txt

Now we run it by our decrypt script from earlier and see if we can get the password. We had to modify the script a bit to run through different iterations, and on the third one we get a hit.

Let's run this by Impacket and see if we can grab the flag with a shell.

impacket-psexec Administrator:'XtH4nkS4Pl4y1nGX'@10.129.86.234

type C:\Users\Administrator\Desktop\root.txt

And we get the root flag.

This box was a little more complex than the other ones. I learned more about pulling binaries apart and writing custom scripts to decrypt passwords. Still a basic box, but it had its advantages.