HTB | Access
This is a Windows box. You can find it here.
Skill Learned
Enumeration of Access Databases and Outlook Personal Archives
Identification of saved credentials
NMAP
IP: 10.10.10.98
FTP
anonymous logn was allowed
Got backup.mdb
before downloading the file set FTP to binary
unzip command fails,
let's try 7z Now it is asking for a password
We have a backup.mdb file, The file is a Microsoft Access Database:
Now to open the file I will use mdbtools 'apt install mdbtools'
We found alot of tables
We will use
to see the tables for the user, we found auth_user
we have admin: admin engineer:access4u@security
Now we can try unzipping the "Access Control".zip "access4u@security" works
Now we have an Outlook folder
Foothold/ shell
I am using this for viewing the file online.
Boom we have a password for the security account
Since the telnet was open
boom we are in
Found user.txt
Priv Esc
On runnng cmdkey /list
We found Administrator cred stored on the system
We can use this to copy the root.txt
and boom we have root.txt
We can also have an administrator shell by using nc.exe After transferring the nc.exe we have to
On our system nc -nlvp 1234
on box
Last updated