Access — HTB Writeup | The Hack Sparrow

Executive summary — Access is an Easy Windows box of pure file forensics: an anonymous FTP exposes a Microsoft Access database (.mdb) and a ZIP; the .mdb yields the ZIP password, and inside the ZIP is an Outlook mail file (.pst) with security's password. We log in via telnet, and escalation uses saved Administrator credentials (runas /savecred). A FTP → mdb/pst → telnet → runas → Admin path.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.23.42`

Attack map

[80] HTTP — static site, no functionality (not the vector)
   │
[21] anonymous FTP → backup.mdb (Access DB) + «Access Control.zip»
   │  mdbtools → ZIP password (access4u@security)
   │  the ZIP contains a .pst (Outlook) → readpst → «security» password
   ▼
[23] telnet as security  (user.txt)
   │  cmdkey /list → SAVED Administrator credentials
   ▼
[ADMIN]  runas /savecred /user:Administrator

1. Reconnaissance

The target has an internal domain name (access.htb). Even though the bare IP already works, it's good practice to map it in /etc/hosts in case any service depends on the Host: header:

echo "10.129.23.42 access.htb" | sudo tee -a /etc/hosts

With the domain resolving, we run a port scan with service detection and default scripts:

nmap -sC -sT -sV access.htb

What we're looking for: which services are open, whether there are weak configurations (anonymous logins, outdated banners), and possible entry vectors.

Port	Service	Observation
21	FTP	Anonymous login allowed
23	Telnet	Remote access — interesting, cleartext
80	HTTP	Basic web

Resumen ejecutivo — Access es una Windows Easy de puro análisis forense de ficheros: un FTP anónimo expone una base de datos Access (.mdb) y un ZIP; de la .mdb sale la contraseña del ZIP, dentro del ZIP hay un correo de Outlook (.pst) con la contraseña de security. Se entra por telnet, y la escalada usa credenciales de Administrator guardadas (runas /savecred). Recorrido FTP → mdb/pst → telnet → runas → Admin.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.23.42`

Mapa del ataque

[80] HTTP — web estática, sin funcionalidad (no es el vector)
   │
[21] FTP anónimo → backup.mdb (base Access) + «Access Control.zip»
   │  mdbtools → contraseña del ZIP (access4u@security)
   │  el ZIP contiene un .pst (Outlook) → readpst → contraseña de «security»
   ▼
[23] telnet como security  (user.txt)
   │  cmdkey /list → credenciales de Administrator GUARDADAS
   ▼
[ADMIN]  runas /savecred /user:Administrator

1. Reconocimiento

El objetivo tiene un nombre de dominio interno (access.htb). Aunque la IP sola ya funciona, es buena práctica mapearlo en /etc/hosts por si algún servicio depende de la cabecera Host::

echo "10.129.23.42 access.htb" | sudo tee -a /etc/hosts

Con el dominio resuelto, lanzamos un escaneo de puertos con detección de servicios y scripts por defecto:

nmap -sC -sT -sV access.htb

Qué buscamos: qué servicios están abiertos, si hay configuraciones débiles (login anónimo, banners desactualizados) y posibles vectores de entrada.

Puerto	Servicio	Observación
21	FTP	Permite login anónimo
23	Telnet	Acceso remoto — interesante, texto plano
80	HTTP	Web básica

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.