Hack The Box · Archived Write-up

Out of Time

The archived source for this page contains the No Place To Hide RDP bitmap-cache walkthrough. The original technical content is preserved below.

Challenge details in the archived page

Name	No Place To Hide
Hint	Evidence points to a password-spray attack against a domain controller and a suspicious RDP session. Review the supplied RDP artifacts to determine what the attacker accessed.
Difficulty	Easy · Retired [0]
Rated difficulty
First blood	HTB-Bot
Creator	felamos

Extract the RDP bitmap cache

The supplied files are bcache24.bmc and Cache0000.bin. The BMC file is empty, while the cache file is binary. The ANSSI-FR bmc-tools project can extract the cached RDP tiles.

python3 bmc-tools.py -s /Cache0000.bin -d /

[+++] Processing a single file: '/Cache0000.bin'.
[===] 1162 tiles successfully extracted in the end.
[===] Successfully exported 1162 files.

The tool exports 1,162 tiles. Tiles 1126, 1128, 1149, and 1151 combine to reveal the flag.

Extracted RDP cache tiles arranged to reveal the flag — The selected bitmap-cache tiles reconstruct the captured display.

Flag: HTB{w47ch_y0ur_c0Nn3C71}

BMC Tools to the rescue on this one.