Explosion

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Explosion Released: 30/09/2021

MACHINE SYNOPSIS

Explosion is a very easy Windows machine that showcases the Remote Desktop Protocol (RDP), how to interact with it using the xfreerdp client and how improper configurations can allow unauthenticated access.

Preparations

We can connect to the target machine in several ways. Throughout this walkthrough, we will use the provided pwnbox.

Once we establish our connection, we spawn the target machine.

Additionally – though not required – we can set a local variable (available only in the current shell) to store the target host’s IP address. After setting this variable, we can reference it by prepending $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can remove this variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: What does the 3-letter acronym RDP stand for?

remote desktop protocol

Look up RDP on the internet.

Task-2

Question: What is a 3-letter acronym that refers to interaction with the host through a command line interface?

cli

Use the hint feature to get a better understanding of the question.

Task-3

Question: What about graphical user interface interactions?

gui

The answer should be quite straightforward after the previous task.

Task-4

Question: What is the name of an old remote access tool that came without encryption by default and listens on TCP port 23?

telnet

Use the internet to look up port 23.

Task-5

Question: What is the name of the service running on port 3389 TCP?

ms-wbt-server

Run the default Nmap scan against the target machine.

user@kali:~$ nmap $rhost 
...
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server
...
user@kali:~$

Task-6

Question: What is the switch used to specify the target host’s IP address when using xfreerdp?

/v:

List the xfreerdp command options and their usage with the --help option.

user@kali:~$ xfreerdp --help
...
  /v:<server>[:port]                Server hostname
...

Task-7

Question: What username successfully returns a desktop projection to us with a blank password?

Administrator

Similar to the default privileged user on Linux – root – Windows has a similarly privileged default user: the local Administrator.

Since the final task requires elevated privileges, we must use the local Administrator account as the Windows equivalent.

Given the improper configuration, no password is required to access the remote target machine. Therefore, we simply press Enter when prompted for a password.

user@kali:~$ xfreerdp /u:Administrator /v:$rhost
...

Submit The Flag

Question: Submit root flag

<redacted-flag>

Once logged in to the remote Windows machine, we find the file containing the flag on the Desktop.

Make sure to terminate the target box before you continue with the next machine!