HTB | Access
Last updated
Last updated
This is a Windows box. You can find it here.
Enumeration of Access Databases and Outlook Personal Archives
Identification of saved credentials
IP: 10.10.10.98
anonymous logn was allowed
Got backup.mdb
before downloading the file set FTP to binary
unzip command fails,
let's try 7z Now it is asking for a password
We have a backup.mdb file, The file is a Microsoft Access Database:
Now to open the file I will use mdbtools 'apt install mdbtools'
We found alot of tables
We will use
to see the tables for the user, we found auth_user
we have admin: admin engineer:access4u@security
Now we can try unzipping the "Access Control".zip "access4u@security" works
Now we have an Outlook folder
I am using this for viewing the file online.
Boom we have a password for the security account
Since the telnet was open
boom we are in
Found user.txt
On runnng cmdkey /list
We found Administrator cred stored on the system
We can use this to copy the root.txt
and boom we have root.txt
We can also have an administrator shell by using nc.exe After transferring the nc.exe we have to
On our system nc -nlvp 1234
on box
