> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/heist.md).

# Heist

## Gaining Access

As usual, we can start with an Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3c7e66ad88217dba30b27c78db8ccba492f8fdad%2Fimage.png?alt=media)

Take note that port 5985 for `winrm` is available, meaning that we can potentially use `evil-winrm` to gain remote access to the computer if we can find credentials.

### Cisco Hash

Within the web page on port 80, there was a login page:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6d870dab2bb40e5fee342bb36a89da29ecf6bf23%2Fimage.png?alt=media)

Weak credentials did not work, so I proceeded to login as a guest. In there, we can see some posts on a forum page of some sort.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-443055e07accac24bb70aafe335413add9920796%2Fimage.png?alt=media)

Within the attachment were some Cisco Router commands for configurations, and hashes:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c8a38929e4660ae0fe6653daab55a2c730ed0712%2Fimage.png?alt=media)

There are 2 Level 7 passwords located here, with different usernames. They can be cracked online with this website:

{% embed url="<https://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/358-cisco-type7-password-crack.html>" %}

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-256cdbd9796dffc9a56eb0e80c83c05637da700c%2Fimage.png?alt=media)

The Bcrypt password could also be cracked using `john`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1f7eeb3735fddc673819673750249aa5dd2aab75%2Fimage.png?alt=media)

### User Enumeration

With some passwords and potential usernames from the forum, we could begin brute-forcing SMB authentications with different combinations. `hazard` was the user on the forum that also requested for a Windows account for him, so I tried guessing his password first with `crackmapexec`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7e59112fe1ad1d529eb819a11233e19193ec5c36%2Fimage.png?alt=media)

Worked, but with checking the shares available with `smbmap`, there was nothing of interest:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e4f608a8bf2b9f0081adac139b1a59c6df447c17%2Fimage.png?alt=media)

However, we can use these credentials to enumerate other users that are present on the machine. I used a Metasploit module to do so:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-06203e79545dd9f66c2ce64e88307834afcd80d0%2Fimage.png?alt=media)

Now we have found more users, we can start brute-forcing again. The password we found earlier works with the `chase` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-40e34f446918c6971ecd37ad3172817b4706cc1c%2Fimage.png?alt=media)

## Privilege Escalation

We can run WinPEAS within this machine to check for easy vectors. This would pickup that some Firefox credentials have been left behind:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c384b1ea8b2bd5fa0866df6a7cd8ad46b944ee83%2Fimage.png?alt=media)

There are tools online to dump the hashed passwords for this. But first, I wanted to see if Firefox was running on this machine, then we can use`procdump.exe` to potentially dump the credentials out:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4b6fcab2ab791dd9fb678ccf0ba705ad09130e89%2Fimage.png?alt=media)

Firefox is indeed running, then we can use `procdump.exe` to dump one of them and analyse the contents on Kali. I used `strings` on the .dmp files and found this password here:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-99bfe9e0080cedff7aebc5e9de8a9920caef08dd%2Fimage.png?alt=media)

With this password, we can `evil-winrm` as the admin:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a427680724657bec33d053a8f08f5cbf63ed4219%2Fimage.png?alt=media)