J. Perez Duertojperezduerto.info
← all walkthroughs

Bastion

Windows· Easy· Credential Access· Privilege Escalation
owned
2026-07-03
time to own
4m36s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

I found an SMB share open to anonymous access containing a full Windows Server Backup image. By mounting the virtual disk over the network, they extracted the machine's local password database and cracked a user's weak password offline.

That credential granted an SSH shell on the server. Once inside, I discovered that a remote-connection manager had saved the Administrator's password in a file encrypted with the application's publicly known default key, which was decrypted in seconds to achieve full administrative control of the host.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export PASSWORD="<the-password-you-recovered>"
export PASSWORD2="<the-password-you-recovered>"
export KEY="<the-key-you-recovered>"

Attack path — how the box was taken

1EnumerationAnonymous SMB Share Enumeration
Listed all SMB shares without any credentials
I issued an anonymous (null-session) SMB query to the server and received the complete share list: ADMIN$, Backups, C$, and IPC$. No username or password was required. The share named 'Backups' immediately indicated a potentially rich target.
Smbclient -N -L //$TARGET returned ADMIN$, Backups, C$, IPC$ with no authentication.
Exact commands 2
shell

Null-session share listing; no credentials supplied.

$ smbclient -N -L //$TARGET
shell

Alternative confirmation of anonymous share access and read rights.

$ nxc smb $TARGET -u '' -p '' --shares
FixDisable anonymous (null-session) access to SMB sharesHigh
WeaknessThe SMB server allowed unauthenticated clients to connect anonymously and enumerate the full list of shares, requiring no username or password whatsoever. This let an unauthorised user immediately identify the high-value Backups share without any credentials.
FixSet RestrictAnonymous = 2 and RestrictAnonymousSAM = 1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Enable the Group Policy setting 'Network access: Do not allow anonymous enumeration of SAM accounts and shares'. Require SMB signing on all connections (RequireSecuritySignature). Audit current share permissions with Get-SmbShareAccess to confirm no share grants Everyone or Anonymous access.
2EnumerationSMB Null Session File Browse
Browsed the Backups share and located a full Windows disk image
Connecting to the Backups share anonymously, I recursively listed its contents and found a Windows Server Backup set containing a large VHD file — a snapshot of the server's entire operating-system disk, including its credential stores.
WindowsImageBackup\L4mpje-PC\Backup 2019-02-22 124351\9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd discovered via recursive listing.
Exact commands 1
shell

Enumerate the full share tree to identify the VHD path inside the backup set.

$ smbclient -N //$TARGET/Backups -c 'recurse ON; ls'
FixRemove OS backup images from network-accessible shares and encrypt backups at restCritical
WeaknessA complete Windows Server Backup — including a VHD containing the SAM and SYSTEM registry hives that hold every local account's password hash — was stored on an SMB share with no access controls. Any client that could reach the network could mount the image and extract credential material offline, entirely bypassing the live operating system's defences.
FixNever store VHD, VHDX, or bare registry hive files on general-purpose SMB shares. Move backup storage to an isolated, access-controlled repository (e.g., a dedicated backup server, tape, or an encrypted cloud backup service). Restrict share access to a dedicated backup service account only. Enforce AES-256 encryption at rest for all backup data, and validate that backup share ACLs are reviewed in every change-control cycle.
3Credential AccessVHD Mount / Offline Registry Hive Extraction (T1003.002)
Mounted the VHD over the network and copied the Windows password database
Rather than downloading the multi-gigabyte disk image, I mounted the SMB share via CIFS and then attached the VHD using a disk-imaging tool. This exposed the full Windows filesystem, from which the SAM and SYSTEM registry hives — which together store every local account's password hash — were copied to my machine.
SAM and SYSTEM hives extracted from Windows\System32\config\ inside the mounted VHD.
Exact commands 3
shell

Mount the anonymous share read-only.

$ mount -t cifs //$TARGET/Backups /mnt/smb -o ro,guest,vers=3.0
shell

Attach the VHD; -i auto-selects the OS partition.

$ guestmount -a '/mnt/smb/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351/9b9cfbc3-369e-11e9-a17c-806e6f6e6963.vhd' -i --ro /mnt/vhd
shell

Copy both hives to the local working directory for offline analysis.

$ cp /mnt/vhd/Windows/System32/config/SAM ./SAM && cp /mnt/vhd/Windows/System32/config/SYSTEM ./SYSTEM
4Credential AccessSAM Offline Hash Extraction (T1003.002)
Dumped local account password hashes from the offline registry hives
Using Impacket's secretsdump in LOCAL mode, I used the boot key stored in the SYSTEM hive to decrypt the SAM database and extract the NTLM password hash for local account L4mpje. This required no interaction with the live system and left no log entries on the target.
Impacket-secretsdump returned L4mpje's NTLM hash from the offline hives.
Exact commands 1
shell

Decrypts SAM offline using the SYSTEM boot key; outputs NTLM hashes for all local accounts.

$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
5Credential AccessOffline NTLM Password Cracking (T1110.002)
Cracked L4mpje's NTLM hash to recover the plaintext password
The extracted hash was submitted to an offline password cracker against the rockyou.txt wordlist. The password was recovered rapidly, confirming it was a simple dictionary-based passphrase that no complexity policy had blocked.
Exact commands 1
shell

Mode 1000 = NTLM. Substitute the hash from step 4. Recovers plaintext <withheld>.

$ hashcat -m 1000 <L4mpje-ntlm-hash> /usr/share/wordlists/rockyou.txt
FixEnforce a strong, non-dictionary password policy for all local accountsHigh
WeaknessL4mpje's password was a recognisable Dutch compound word present in the rockyou.txt wordlist. Once the NTLM hash was extracted from the offline backup, the plaintext was recovered in seconds with a standard wordlist attack — making the hashing algorithm irrelevant.
FixRequire a minimum password length of 15 characters with mixed case, digits, and symbols. Use Windows Fine-Grained Password Policy or a Group Policy Object to enforce these rules on local accounts. Deploy Microsoft Entra Password Protection (or an equivalent banned-password list) to block dictionary and keyboard-walk patterns even when they technically meet complexity rules. Consider enabling Windows Defender Credential Guard to prevent NTLM hash extraction even if an unauthorised user gains physical or backup access.
6Initial AccessValid Accounts — Local Account (T1078.003)
Logged in as L4mpje via SSH using the cracked password
With the recovered plaintext password, I authenticated over SSH (port 22) as L4mpje. This produced an interactive shell on the Windows host and access to the user's desktop, where the first proof-of-ownership flag was read.
Sshpass -p <withheld> ssh L4mpje@$TARGET returned a working shell.
Exact commands 2
shell

Open an interactive SSH session as L4mpje.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null L4mpje@$TARGET
shell

Read user flag — value is <user.txt>.

$ type C:\Users\L4mpje\Desktop\user.txt
7DiscoveryCredentials in Files (T1552.001)
Found mRemoteNG's saved-connections file containing an encrypted Administrator password
While enumerating the user's application data, I found that mRemoteNG — a widely used Windows remote-connection manager — was installed and had a saved connection entry for the Administrator account. The file confCons.xml stores credentials AES-encrypted with a key derived from a master password that defaults to a fixed, publicly known value when never customised.
Exact commands 1
shell

Read the mRemoteNG connection config to obtain the base64-encrypted password blob for the Administrator entry.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no L4mpje@$TARGET "type C:\\Users\\L4mpje\\AppData\\Roaming\\mRemoteNG\\confCons.xml"
FixRemove stored privileged credentials from mRemoteNG and set a strong master passwordCritical
WeaknessmRemoteNG stored the Administrator account's password in a local XML file (confCons.xml) encrypted with the application's hard-coded default key, which is publicly documented. Anyone who can read the file — including a low-privileged local user — can decrypt every saved password instantly without brute force.
FixImmediately delete any saved Administrator or privileged-account credentials from mRemoteNG on all workstations. If mRemoteNG must store credentials, configure a strong, unique master password in Options → Security so saved credentials are encrypted with a user-controlled key rather than the vendor default. Prefer short-lived, just-in-time privileged access (e.g., Microsoft Entra Privileged Identity Management) over persistently stored admin passwords in desktop tools. Audit %APPDATA%\mRemoteNG\confCons.xml across the environment for any entries that hold privileged account credentials.
8Privilege EscalationCredentials from Password Stores (T1555)
Decrypted the mRemoteNG config using the vendor's default key and recovered the Administrator password
Because no custom master password had ever been set in mRemoteNG, the credential ciphertext in confCons.xml was encrypted with the application's hard-coded default key. Running a publicly available decryption script against the extracted ciphertext immediately returned the Administrator's plaintext password.
MRemoteNG-Decrypt.py with key returned Administrator password.
Exact commands 1
shell

Substitute the base64 Password= attribute value from confCons.xml. Default key. Returns <withheld>.

$ python3 mRemoteNG-Decrypt.py -s '<Password-value-from-confCons.xml>' -p $KEY
9Full ControlValid Accounts — Local Account (T1078.003)
Logged in as Administrator via SSH and captured the root flag
Using the decrypted Administrator password, I opened an SSH session as the built-in Windows Administrator account, achieving unrestricted control of the host. The root flag was read directly from the Administrator's desktop, completing full compromise.
Sshpass -p <withheld> ssh Administrator@$TARGET returned an Administrator shell and root.txt.
Exact commands 2
shell

Open an interactive SSH session as the built-in Administrator.

$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null Administrator@$TARGET
shell

Read root flag — value is <root.txt>.

$ type C:\Users\Administrator\Desktop\root.txt

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.