HackTheBox · Lab
Nest
notes
NMAP
```shell
PORT STATE SERVICE VERSION
445/tcp open microsoft-ds?
4386/tcp open unknown
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe:
| Reporting Service V1.2
| FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, RTSPRequest, SIPOptions:
| Reporting Service V1.2
| Unrecognised command
| Help:
| Reporting Service V1.2
| This service allows users to run queries against databases using the legacy HQK format
| AVAILABLE COMMANDS ---
| LIST
| SETDIR <Directory_Name>
| RUNQUERY <Query_ID>
| DEBUG <Password>
|_ HELP <Command>
Host script results:
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled but not required
| smb2-time:
| date: 2025-07-29T08:15:01
|_ start_date: 2025-07-29T08:08:30
```
SMB
After full spidering we found several files.
We also mounted all the shares
10.10.10.178-Data_Shared_Templates_HR_Welcome Email.txt
```shell
Username: TempUser
Password: welcome2019
```
With new creds, even more files were found.
//Share/Users
```shell
./Users
dr--r--r-- 0 Sun Jan 26 00:04:21 2020 .
dr--r--r-- 0 Sun Jan 26 00:04:21 2020 ..
dr--r--r-- 0 Wed Jul 21 20:47:04 2021 Administrator
dr--r--r-- 0 Wed Jul 21 20:47:04 2021 C.Smith
dr--r--r-- 0 Thu Aug 8 19:03:29 2019 L.Frost
dr--r--r-- 0 Thu Aug 8 19:02:56 2019 R.Thompson
dr--r--r-- 0 Wed Jul 21 20:47:15 2021 TempUser
```
//share/Data
```shell
Data/Shared
Data/IT/Configs/Adobe/editing.xml
Data/IT/Configs/Adobe/Options.txt
Data/IT/Configs/Adobe/projects.xml
Data/IT/Configs/Adobe/settings.xml
Data/IT/Configs/Atlas/Temp.XML
Data/IT/Configs/Microsoft/Options.xml
Data/IT/Configs/NotepadPlusPlus/config.xml
Data/IT/Configs/NotepadPlusPlus/config.xml
Data/IT/Configs/NotepadPlusPlus/shortcuts.xml
Data/IT/Configs/NotepadPlusPlus/shortcuts.xml
Data/IT/Configs/RU Scanner/RU_config.xml
Data/IT/Configs/RU Scanner/RU_config.xml
Data/Shared/Maintenance/Maintenance Alerts.txt
Data/Shared/Templates/HR/Welcome Email.txt
```
10.10.10.178-Data_IT_Configs_RU Scanner_RU_config.xml
```shell
<Username>c.smith</Username>
<Password>fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=</Password>
```
[//10.10.10.178/Data/IT/Configs/NotepadPlusPlus/config.xml](https://10.10.10.178/Data/IT/Configs/NotepadPlusPlus/config.xml)
```shell
<File filename="C:\windows\System32\drivers\etc\hosts" />
<File filename="\\HTB-NEST\Secure$\IT\Carl\Temp.txt" />
<File filename="C:\Users\C.Smith\Desktop\todo.txt" />
```
Looks interesting!
After we mounted `secure$` we noticed we can’t change directory into `IT` due to none permissions, but, if we change directly into `IT/Carl` we have success.
smbmount/IT/Carl
```shell
drwxr-xr-x - root 7 Aug 2019 Docs
drwxr-xr-x - root 6 Aug 2019 Reports
drwxr-xr-x - root 6 Aug 2019 'VB Projects'
```
Visual Studio
After some examination in code we could finally withdraw our decrypted string
- `xRxRxPANCAK3SxRxRx`
And we have auth success with `c.smith`
SMB
We now have access to //Users/C.smith
After alot of recon we can see that one file has an alternate data stream.
```shell
smb: \C.Smith\HQK Reporting\> Allinfo "Debug Mode Password.txt"
altname: DEBUGM~1.TXT
create_time: Fri Aug 9 01:06:12 2019 CEST
access_time: Fri Aug 9 01:06:12 2019 CEST
write_time: Fri Aug 9 01:08:17 2019 CEST
change_time: Wed Jul 21 20:47:12 2021 CEST
attributes: A (20)
stream: [::$DATA], 0 bytes
stream: [:Password:$DATA], 15 bytes
```
Lets download file and check it
```shell
drwxr-xr-x - root 29 Jul 11:54 'AD Integration Module'
.rwxr-xr-x 0 root 9 Aug 2019 'Debug Mode Password.txt'
.rw-r--r-- 15 root 29 Jul 12:24 'Debug Mode Password.txt:Password'
.rwxr-xr-x 249 root 9 Aug 2019 HQK_Config_Backup.xml
❯ cat Debug\ Mode\ Password.txt:Password
WBQ201953D8w
```
PORT 4386 w/ TELNET
```shell
Domain=nest.local
Port=389
BaseOu=OU=WBQ Users,OU=Production,DC=nest,DC=local
User=Administrator
Password=yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4=
```
Compiling the HqkLdap.exe
Admin password
XtH4nkS4Pl4y1nGX
Scope
- 10.10.10.178
OS
Windows 7 / Server 2008 R2 Build 7601
FQDN / DOMAIN
HTB-NEST.HTB-NEST
Users
Administrator
C.Smith
Guest
Service_HQK
TempUser
l.frost
r.thompson
Credentials
TempUser:welcome2019
c.smith:xRxRxPANCAK3SxRxRx
P4386 debug password:WBQ201953D8w
administrator:yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4=
NMAP
PORT STATE SERVICE VERSION
445/tcp open microsoft-ds?
4386/tcp open unknown
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe:
| Reporting Service V1.2
| FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, RTSPRequest, SIPOptions:
| Reporting Service V1.2
| Unrecognised command
| Help:
| Reporting Service V1.2
| This service allows users to run queries against databases using the legacy HQK format
| AVAILABLE COMMANDS ---
| LIST
| SETDIR <Directory_Name>
| RUNQUERY <Query_ID>
| DEBUG <Password>
|_ HELP <Command>
Host script results:
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled but not required
| smb2-time:
| date: 2025-07-29T08:15:01
|_ start_date: 2025-07-29T08:08:30
SMB Shares as TempUser
Share Permissions Remark
----- ----------- ------
ADMIN$ Remote Admin
C$ Default share
Data READ
IPC$ Remote IPC
Secure$ READ
Users READ
Web Services Enumeration
Web Technology
[+] Nikto
[+] Wfuzz
Other Notes
Privilege Escalation
Takeaway Concepts
Alot of debugging and decoding
Logs
SMB_spidering_2025-07-29_10-15-38.log