Hack The Box · Windows Machine
Bastion
| Name | Bastion |
|---|---|
| Release date | 27 Apr 2019 |
| Retire date | 07 Sep 2019 |
| OS | Windows |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | L4mpje |
| CherryTree file | Download and remove the .txt extension |
SMB backup discovery
Guest SMB access exposed the Backups share and a Windows image containing two VHD files.
smbclient -L //10.10.10.134
smbclient //10.10.10.134/BackupsThe large VHD was mounted remotely rather than downloaded in full, allowing access to the offline Windows filesystem.
Registry-hive credential recovery
The offline SAM and SYSTEM hives were extracted and processed with Impacket to recover the local account hashes. Cracking the L4mpje hash yielded bureaulampje, which worked over SSH.
secretsdump.py -sam SAM -system SYSTEM LOCAL
ssh [email protected]mRemoteNG credentials
Enumeration of L4mpje's profile found an mRemoteNG configuration containing an encrypted Administrator password. Decrypting the stored value revealed thXLHM96BeKL0ER2, providing Administrator access and the root flag.
python3 mremoteng_decrypt.py -s <ENCRYPTED-PASSWORD>
ssh [email protected]