# Explosion (Tier 0)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 0
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Windows
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Programming / RDP / Reconnaissance / Weak Credentials

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fmi1eACY59aoPW7GDwzy8%2Fimage.png?alt=media&#x26;token=3b9b3ffd-4ea6-41be-be8e-800f7995296d" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=0">https://app.hackthebox.com/starting-point?tier=0</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With a little research, I started answering the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fw2yrHpfOrcNBXhnlQCWN%2Fimage.png?alt=media&#x26;token=038da666-fe2b-4b51-970c-94ab4f0d23ff" alt=""><figcaption></figcaption></figure>

> Answer: _**Remote Desktop Protocol**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCeb1AxHwxr3Fw6enC6T1%2Fimage.png?alt=media&#x26;token=f4981cd9-258d-4164-9f87-a08e6f293e71" alt=""><figcaption></figcaption></figure>

> Answer: _**cli**_

***



<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCwLY5k0xjeP9Qolc2Hd5%2Fimage.png?alt=media&#x26;token=ae264fa0-5966-475b-9646-ff9f1b208f02" alt=""><figcaption></figcaption></figure>

> Answer: _**gui**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FyadxJCmGIcfUeoWllhg9%2Fimage.png?alt=media&#x26;token=c74d9f1e-81a9-48df-8793-b552a0800072" alt=""><figcaption></figcaption></figure>

> Answer: _**telnet**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FaCuIujYLMcjsOpTO5Ozk%2Fimage.png?alt=media&#x26;token=d65a146d-cb0e-4733-88bb-d82e54ec8cf1" alt=""><figcaption></figcaption></figure>

> Answer: _**nmap**_

***

* Then I continued doing an initial port scan of the machine using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.1.13 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fc3V5NVwtgxuDvkohI8xM%2Fimage.png?alt=media&#x26;token=de01be85-68e0-434a-ad28-8bb33c56e17a" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FWGwu5r4qprnSYdsfmuEs%2Fimage.png?alt=media&#x26;token=82f67812-8df1-4bd1-aabf-acc4b8578a21" alt=""><figcaption></figcaption></figure>

> Answer: _**ms-wbt-server**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZjKCRt405jQQgTiMQQjo%2Fimage.png?alt=media&#x26;token=d721b691-ace4-4fe0-9e57-5e8fb681d438" alt=""><figcaption></figcaption></figure>

> Answer: _**/v:**_

***

* Then I did an exhaustive scan of the ports found to get information about the running services

{% code lineNumbers="true" %}
```bash
nmap 10.129.1.13 -p135,139,445,3389,5985,47001 -sVC -oN serv_scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FXkJdhnfYDfG64HhehlP6%2Fimage.png?alt=media&#x26;token=f533ef6c-c3ea-45ae-9ef3-d37bfa148ea3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FTFIL6OsJvY52SFDdcrzm%2Fimage.png?alt=media&#x26;token=6e0fb670-5f87-4be4-95a1-24ccf0771555" alt=""><figcaption></figcaption></figure>

***

* I observed the RDP protocol was running on port 3389, so I tried to access it using the [_xfreerdp_](../../../networks/tools-and-utilities#xfreerdp) tool. But as I was only able to provide the IP, it asked for a domain and password, which I didn't have. So I tried to log in using common credentials, and when using _administrator_ as username, I could log in providing a blank password, gaining remote access to the machine as a privileged user

{% code overflow="wrap" lineNumbers="true" %}
```bash
xfreerdp /v:10.129.1.13
xfreerdp /v:10.129.1.13 /u:administrator
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9itQp3fBDnd3dKmUceq8%2Fimage.png?alt=media&#x26;token=ad849d45-813c-4df0-9ec8-b15009d38818" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F950SCSpR5o25EmFmcy3F%2Fimage.png?alt=media&#x26;token=5ba98f8d-34f1-487c-b970-a98ec6f28aa2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCgu0I8d0ttfTfXMpdZiA%2Fimage.png?alt=media&#x26;token=634e25b5-2b3e-45b0-8712-677d946df37e" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the RDP protocol, you can go [here](../../networks/protocols/rdp)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F2E0ln7d2hh2lOR4chK4V%2Fimage.png?alt=media&#x26;token=b883fc66-668f-4517-b0a1-4095681f5362" alt=""><figcaption></figcaption></figure>

> Answer: _**administrator**_

***

* Once inside, I saw on the Desktop there was a file named _flag,_ which seemed to be a text file, so I opened it to look at its content, and with this, I retrieved the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FuHf3RxcZkO041kkkGaMF%2Fimage.png?alt=media&#x26;token=83593dac-f5f0-4cf0-b163-c46389ebe12e" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAJNJA9zQa10PurMdoG1I%2Fimage.png?alt=media&#x26;token=4807d32b-9f75-4295-9941-054c33325e9e" alt=""><figcaption></figcaption></figure>

> Answer: _**951fa96d7830c451b536be5a6be008a0**_
