HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform. Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Nest, is retired.
The walkthrough
Let’s start with this machine.
Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN. The Nest machine IP is 10.10.10.178. We will adopt our usual methodology of performing penetration testing. Let’s start with enumeration in order to gain as much information about the machine as possible. As usual, let’s start with the Nmap scan to learn more information about the services running on this machine. As we can see, multiple ports are listed. As a best practice, I always do a full port scan to see if there are more ports that got discovered. In this case, it was the case, and we found basic ports such as 21 and 80 on full port sweep. [CLICK IMAGES TO ENLARGE] «nmap -sC -sV -oA Nest 10.10.10.178»
Since we have got a very limited port, let’s start enumeration on port 445 using smbclient. It was found that we can list the shares on the machine.
We can also enter the Data share on the target machine.
As we can see, there are three folders under the Data folder. Let’s start enumeration on that. We keep digging into all these folders. At last, we saw two interesting files, which were “Welcome Email.txt” and “Maintenance Alerts.txt”.
We’ll download them onto a local machine. Looking into their contents reveals a username and password.
Since we now have a username and password, let’s try the enumeration phase again with these creds.
And we can now enter the IT folder as well. Under the IT folder and RU Scanner folder, we can see a RU_Config.xml file.
Downloading it to the local machine and viewing its contents reveals some interesting facts: port, username and password. This password for user c.smith was a hash and I was not able to break using a normal dictionary-based mechanism.
So, let’s find a way to break this password. Other files found during enumeration listed some files in the IT/carl directory.
Moving to the IT/carl directory, we can see folders named docs, report and VB Projects.
Downloading the VB Project file as the name suggest it relates to RU Scanner file.
The way to achieve the user flag and root flag will be shown in Part 2 of this article series.
