# Nest

## Gaining Access

Nmap scan:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/ivT04KnARYuf3yggqK9q/image.png" alt=""><figcaption></figcaption></figure>

Only SMB is open it appears. Port 4386 is for a service called HQK, which I could not do much with at this point.

### SMB Shares

`enum4linux` reveals quite a few shares that are open:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/GXAScEh3Wc0sIHUX5pEA/image.png" alt=""><figcaption></figcaption></figure>

The `Users` one had the most information and was the only one accessible, so I connected and recursively downloaded all possible files:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/4oH2bBrwXA4Hqd2jpUHE/image.png" alt=""><figcaption></figcaption></figure>

Within the files downloaded, we can find a `Welcome Email.txt` file.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/AiZ66khhRTIpnOziFYvs/image.png" alt=""><figcaption></figcaption></figure>

We can then check the permission of shares again with these credentials using `smbmap`.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/1P6vUa6aFrS9JKQWwVgM/image.png" alt=""><figcaption></figcaption></figure>

Now we could read the `Data` share, so I went in and recursively downloaded all files:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/JSqw0b05efJjt5CekPmA/image.png" alt=""><figcaption></figcaption></figure>

Within the files downloaded, the `RU_config.xml` file contained this encrypted password for a user on the machine:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/K1vP6VM1seAd63pWQqOQ/image.png" alt=""><figcaption></figcaption></figure>

Also, within the contents of that file, was a .NET VB project files.&#x20;

### Password Decryption

What I did was port all the files over to a Windows VM and then compiled it. Afterwards, I opened it up in DnSpy to see how the binary works:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Ne8ZG4fnhffXZfE67UXd/image.png" alt=""><figcaption></figcaption></figure>

So the binary uses the `RU_config.xml` file and decrypts the password. We can set a breakpoint at that line highlighted and then view the variable contents to see the password after clicking 'Step Over' once. This reveals the password of `xRxRxPANCAK3SxRxRx`.&#x20;

### C.Smith Creds

With these credentials, I can access the directory of the user through SMB, but I did not manage to get a shell. Doesn't really matter because we can still grab the user flag. Within the user's directory there some intresting files I downloaded:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/fnTcQ5O6z8zF0rTvYE3Y/image.png" alt=""><figcaption></figcaption></figure>

The `Debug Mode Password.txt` was empty for some reason, and I found that weird. As such, I used `allinfo` on SMB to view whether there were alternate data streams present for the file:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/nVxBQfIc9QpW1CPrhg8p/image.png" alt=""><figcaption></figcaption></figure>

This confirms the presence of the alternate data stream, and we can use `cat` to extract the information:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/gyNEjP6viJdfksYz9EXX/image.png" alt=""><figcaption></figcaption></figure>

Cool, now we have the HQK password.

### HQK

Now that we have credentials, we can connect to the HQK port via `telnet` and enter DEBUG mode.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/f66Cqywo9M4jhtCBrzRO/image.png" alt=""><figcaption></figcaption></figure>

With this, I was able to extract the administrator hash.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/s8Fh86P8pypYpQy4Llec/image.png" alt=""><figcaption></figcaption></figure>

Within this, we also can find another binary being used:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Z1U3MDL3XrjLqlBVRqcS/image.png" alt=""><figcaption></figcaption></figure>

Similar to the previous time, we can load the binary in dnSpy and set a breakpoint to view the password. We would need to use all 3 files, and create an `ldap.conf` file that is passed in as a parameter to the main function. Then, we can view the contents of variables to see the password.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/RhZ1C7H3ZcYqC1CjxnuT/image.png" alt=""><figcaption></figcaption></figure>

Afterwards, we would have full access to the C Drive:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/Y54grY82rRTY36p1NnXu/image.png" alt=""><figcaption></figcaption></figure>
