Hack The Box · Forensics

No Place To Hide

Recovering visual evidence from an RDP bitmap cache after a suspicious remote session.

Challenge details

Name	No Place To Hide
Hint	Evidence points to a password-spray attack against a domain controller and a suspicious RDP session. Review the supplied RDP artifacts to determine what the attacker accessed.
Difficulty	Easy · Retired [0]
Rated difficulty
First blood	HTB-Bot
Creator	felamos

Extract the RDP bitmap cache

The archive contains bcache24.bmc and Cache0000.bin. The BMC file is empty, while the cache file contains binary data that is not directly readable. The ANSSI-FR bmc-tools project can extract the cached RDP tiles.

python3 bmc-tools.py -s /Cache0000.bin -d /

[+++] Processing a single file: '/Cache0000.bin'.
[===] 1162 tiles successfully extracted in the end.
[===] Successfully exported 1162 files.

The utility exports 1,162 image tiles. Tiles 1126, 1128, 1149, and 1151 stand out; placing them together reconstructs the flag visible during the RDP session.

Four extracted RDP bitmap-cache tiles arranged to reveal the flag — The relevant cache tiles reconstruct the captured screen content.

Flag: HTB{w47ch_y0ur_c0Nn3C71}

BMC Tools to the rescue on this one.