Heist — HTB Writeup | The Hack Sparrow

Executive summary — Heist is a tour of credential hygiene without exploiting a single software vulnerability: a support web app with guest access leaks a ticket carrying an attached Cisco router configuration; its Type 7 passwords (reversible by design) and its enable secret 5 (crackable MD5crypt) get reused against the host's Windows accounts; and, once inside as a user, a running Firefox keeps the administrator's panel password sitting in its process memory — dumping it with procdump closes the chain up to Administrator.

Platform	Hack The Box
Operating system	Windows Server 2019 (Build 17763)
Difficulty	Easy
Status	Retired
Target IP	`10.129.96.157`

Attack map

[80/HTTP] login.php?guest=true -> issues.php (ticket with attachment)
   |
   v
[Attachment] config.txt Cisco IOS -- password 7 (reversible XOR) + enable secret 5 (MD5crypt)
   |  decrypt + hashcat -m 500
   v
[Reuse] hazard:stealth1agent (SMB) -- Chase:Q4)sJu\Y8qz*A3?d (WinRM)
   v
[USER] Chase over WinRM -> user.txt
   |  firefox.exe running (owned by Chase)
   v
[procdump] Firefox process memory dump (466 MB)
   |  Select-String "login_password" in the dump
   v
[ROOT] admin@support.htb : 4dD!5}}x/re8]FBuZ == Administrator password -> root.txt

1. Reconnaissance

An ICMP ttl≈127 (128 minus one hop) points at Windows.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.96.157

80/tcp    open  http
135/tcp   open  msrpc
445/tcp   open  microsoft-ds
5985/tcp  open  wsman
49669/tcp open  unknown

sudo nmap -p80,135,445,5985 -sCV -Pn -oN nmap-services.txt 10.129.96.157

80/tcp   open  http   Microsoft IIS httpd 10.0
| http-title: Support Login Page          (redirects to login.php)
| http-cookie-flags: PHPSESSID (httponly flag not set)     <- IIS + PHP
445/tcp  open  microsoft-ds? (name:SUPPORTDESK domain:SupportDesk signing not required)
5985/tcp open  http   Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)     <- WinRM

IIS + PHP is an unusual pairing — the PHPSESSID cookie on IIS gives away a hand-rolled PHP application, a good candidate for the initial surface. No Active Directory ports (88/389/53): this is a standalone Windows server, not a DC. WinRM already open hints at the shell path once a valid credential for a Remote Management Users member turns up.

netexec smb 10.129.96.157 -u '' -p '' --shares       # STATUS_ACCESS_DENIED
netexec smb 10.129.96.157 -u 'guest' -p '' --shares  # STATUS_LOGON_FAILURE

SMB closed to null and guest sessions: the real entry point is the web app.

Resumen ejecutivo — Heist es un recorrido por la higiene de credenciales sin explotar ninguna vulnerabilidad de software: una web de soporte con acceso de invitado filtra un ticket con una configuración de router Cisco adjunta; sus contraseñas Type 7 (cifrado reversible por diseño) y su enable secret 5 (MD5crypt crackeable) se reutilizan contra las cuentas de Windows del host; y, ya con acceso de usuario, un Firefox en ejecución conserva en su memoria de proceso la contraseña del administrador tecleada en el panel — volcarla con procdump cierra la cadena hasta Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2019 (Build 17763)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.96.157`

Mapa del ataque

[80/HTTP] login.php?guest=true -> issues.php (ticket con adjunto)
   |
   v
[Adjunto] config.txt Cisco IOS -- password 7 (XOR reversible) + enable secret 5 (MD5crypt)
   |  descifrado + hashcat -m 500
   v
[Reutilizacion] hazard/hazard:stealth1agent (SMB) -- Chase:Q4)sJu\Y8qz*A3?d (WinRM)
   v
[USER] Chase por WinRM -> user.txt
   |  firefox.exe en ejecucion (propiedad de Chase)
   v
[procdump] volcado de memoria del proceso Firefox (466 MB)
   |  Select-String "login_password" en el dump
   v
[ROOT] admin@support.htb : 4dD!5}}x/re8]FBuZ == contrasena de Administrator -> root.txt

1. Reconocimiento

El ttl≈127 de la respuesta ICMP (128 menos un salto) apunta a Windows.

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.96.157

80/tcp    open  http
135/tcp   open  msrpc
445/tcp   open  microsoft-ds
5985/tcp  open  wsman
49669/tcp open  unknown

sudo nmap -p80,135,445,5985 -sCV -Pn -oN nmap-services.txt 10.129.96.157

80/tcp   open  http   Microsoft IIS httpd 10.0
| http-title: Support Login Page          (redirige a login.php)
| http-cookie-flags: PHPSESSID (httponly flag not set)     <- IIS + PHP
445/tcp  open  microsoft-ds? (name:SUPPORTDESK domain:SupportDesk signing not required)
5985/tcp open  http   Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)     <- WinRM

IIS + PHP es una combinación poco habitual — la cookie PHPSESSID sobre IIS delata una aplicación PHP montada a mano, buena candidata a superficie inicial. No hay puertos de Active Directory (88/389/53): es un servidor Windows independiente, no un DC. WinRM ya abierto anticipa cuál será la vía de shell en cuanto haya una credencial válida de un miembro de Remote Management Users.

netexec smb 10.129.96.157 -u '' -p '' --shares       # STATUS_ACCESS_DENIED
netexec smb 10.129.96.157 -u 'guest' -p '' --shares  # STATUS_LOGON_FAILURE

SMB cerrado a sesiones nulas y de invitado: la entrada real es la web.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.