> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/nest.md).

# Nest

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-57d639b93381ee3e2c4c6748c846ac01b8176b7d%2Fimage.png?alt=media)

Only SMB is open it appears. Port 4386 is for a service called HQK, which I could not do much with at this point.

### SMB Shares

`enum4linux` reveals quite a few shares that are open:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11ec913d43d495e23d909b2a28e54a2f3a60a072%2Fimage.png?alt=media)

The `Users` one had the most information and was the only one accessible, so I connected and recursively downloaded all possible files:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9889d9bf6538fd9a9b2db4a317e1f7f72b9de9c2%2Fimage.png?alt=media)

Within the files downloaded, we can find a `Welcome Email.txt` file.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-27f6ca9e9ea34a14e5b071428867fd44b865f918%2Fimage.png?alt=media)

We can then check the permission of shares again with these credentials using `smbmap`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3f90c8f82a45d232922b18c09bcfc0cdc8cc99bf%2Fimage.png?alt=media)

Now we could read the `Data` share, so I went in and recursively downloaded all files:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-683726ee8fc135b685add2326a4d637532b426d1%2Fimage.png?alt=media)

Within the files downloaded, the `RU_config.xml` file contained this encrypted password for a user on the machine:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-634c209f87a2648de8b7f159f273467bc97e6af8%2Fimage.png?alt=media)

Also, within the contents of that file, was a .NET VB project files.

### Password Decryption

What I did was port all the files over to a Windows VM and then compiled it. Afterwards, I opened it up in DnSpy to see how the binary works:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-74697fe82bd290a8830502390913c8bc0689371d%2Fimage.png?alt=media)

So the binary uses the `RU_config.xml` file and decrypts the password. We can set a breakpoint at that line highlighted and then view the variable contents to see the password after clicking 'Step Over' once. This reveals the password of `xRxRxPANCAK3SxRxRx`.

### C.Smith Creds

With these credentials, I can access the directory of the user through SMB, but I did not manage to get a shell. Doesn't really matter because we can still grab the user flag. Within the user's directory there some intresting files I downloaded:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3bb298de74208c72935af29b2c33dc3ae1ae59ea%2Fimage.png?alt=media)

The `Debug Mode Password.txt` was empty for some reason, and I found that weird. As such, I used `allinfo` on SMB to view whether there were alternate data streams present for the file:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-111aae4e9a42f105ab6665788cac2980153fd9b2%2Fimage.png?alt=media)

This confirms the presence of the alternate data stream, and we can use `cat` to extract the information:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9132adc42fe9f18c8e04398641ef430ac51193be%2Fimage.png?alt=media)

Cool, now we have the HQK password.

### HQK

Now that we have credentials, we can connect to the HQK port via `telnet` and enter DEBUG mode.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-92171274186a68f10dd644b45c28f97a1a546500%2Fimage.png?alt=media)

With this, I was able to extract the administrator hash.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a74abda250b6da24fdeca3f41498e0fac66c846b%2Fimage.png?alt=media)

Within this, we also can find another binary being used:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8fc825b0db8b53e6267abe705a95140200f67b0e%2Fimage.png?alt=media)

Similar to the previous time, we can load the binary in dnSpy and set a breakpoint to view the password. We would need to use all 3 files, and create an `ldap.conf` file that is passed in as a parameter to the main function. Then, we can view the contents of variables to see the password.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-faef986edb401248e122e4d2250db5ab4c6ffd2e%2Fimage.png?alt=media)

Afterwards, we would have full access to the C Drive:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7be3d31d6d8a261d7700238a4c23c0c9c784ad81%2Fimage.png?alt=media)