HackTheBox | Bastion [OSCP Style] (TWITCH LIVE)

Storyline / Mission

This livestream is structured like an OSCP-style walkthrough on Hack The Box (HTB). The host guides viewers through compromising a target machine named Bastion, moving through:

• Initial discovery
• Exploitation
• Persistence/credential use
• Privilege escalation to obtain the root flag

Gameplay / Walkthrough Highlights (Bastion)

Environment setup & automation

• Uses an HTB-style workflow with a bash/Zsh helper approach to deploy and manage lab machines.
• Mentions a bash-based community tool to quickly deploy and handle the lab environment.
• Includes scripts/functions to accelerate reconnaissance output parsing.

Initial reconnaissance

Machine detection / recognition

• Uses a TTL-based check (instead of Nmap) to infer OS:
  • TTL ~128 ⇒ Windows
  • TTL ~64 ⇒ Linux
• Chooses fast scanning behavior to quickly identify open ports.

Port scanning

• Runs Nmap TCP port scanning with performance-focused options (tuned rate/verbosity).
• Exports Nmap “grepable” output so ports can be parsed later without manually sorting.

Service enumeration & targeting

• Once services are discovered, focuses on key targets—especially:
  • SMB
  • WinRM
• Uses tools like crackmapexec to identify Windows version/context.

SMB enumeration → backup files

• Uses SMB techniques similar to null-session behavior to list shares and assess read/write access.
• Finds and exports note.txt, indicating:
  • Backups are involved
  • A VPN path for transferring the backup is slow
• Mounts/accesses backup storage and discovers VHD files (Virtual Hard Disks).

VHD extraction via Windows-image-in-a-filesystem

• Sets up an NBD-based mount workflow:
  • Loads NBD module
  • Uses qemu-nbd / kemu-utils style tooling
• Mounts the VHD so the filesystem can be browsed locally like normal files.
• Looks for privilege escalation opportunities using offline filesystem access.

Credential harvesting → user access

• Extracts offline Windows artifacts, notably SAM + SYSTEM.
• Mentions tooling such as secretsdump (Impacket) to obtain hashes.
• Then:
  • Validates candidate credentials (e.g., admin credential checks)
  • Cracks hashes using John the Ripper with a dictionary/wordlist (includes mention of rockyou-style matches)
• Gains interactive access as a non-admin user via SSH, after confirming working credentials.

Privilege escalation to Administrator

• Searches for escalation paths through Windows inspection:
  • task/process checks
  • group/privilege checks
  • system inspection for misconfigurations
• Exploits a misconfiguration/opportunity in M/RemoteNG (MRemoteNG-like remote management software):
  • Locates an XML containing a stored password
  • Uses a decoding pipeline (Base64/transform steps) via a GitHub utility to recover the real plaintext/admin password
• Validates the admin password with crackmapexec.
• Uses WinRM + Evil-WinRM to log in as Administrator.

Finalization

• With Administrator access, navigates to the target location and submits/validates the root flag (HTB style).
• Continues with wrap-up activity including community setup reviews and Q&A.

Key Strategies / Tips Emphasized

• Prefer fast signal, then export evidence

  • Scan quickly, but export results (“grepable” output) and parse systematically to reduce errors.

• Use TTL/OS detection early

  • Infer OS type quickly (TTL) to avoid wasting time with the wrong toolchain.

• Exploit chain = “offline browsing”

  • Once SMB yields backup artifacts (VHD), pivot to:
    • mount VHD → extract secrets → crack credentials → escalate

• Priv-esc often hides in “admin tools/software configs”

  • Instead of only classic local priv-esc, the walkthrough leans on discovering stored credentials in remote-management software configs.

• Validate credentials at each step

  • Repeated checks before assuming privileges:
    • hash validity / crackmapexec checks
    • group membership / WinRM feasibility
    • SSH vs WinRM based on what’s reachable

Step-by-Step Flow (condensed)

• Create workspace directories for the machine name
• Determine OS quickly (TTL recognition)
• Run fast Nmap TCP scan and export results
• Parse Nmap output via an automated parsing helper
• Enumerate services (SMB/WinRM) and fingerprint OS/version
• Use SMB (null session-style) to list shares; download note.txt and backup artifacts
• Mount backup VHD(s) using NBD/kemu utilities for offline browsing
• Extract SAM/SYSTEM → crack hashes → find valid user credentials
• SSH into the machine using the cracked user password
• Investigate privilege escalation path:
  • inspect EVTX/log-related artifacts
  • check installed software/configs
• Find MRemoteNG XML credentials → decode → recover admin password
• Use WinRM (Evil-WinRM) as Administrator → capture root flag
• After completion: continue with community setup reviews and Q&A

Notable Tools / Concepts Mentioned

• Nmap (fast scan, grepable export, TCP/UDP logic)
• TTL-based OS detection
• SMB tooling:
  • crackmapexec
  • smbclient
  • smbmap
• VHD mounting:
  • NBD
  • kemu-utils / qemu-nbd style workflow
• Impacket (e.g., secretsdump idea)
• Credential cracking:
  • John the Ripper
• WinRM exploitation:
  • Evil-WinRM
• MRemoteNG credential storage/decoding:
  • Base64 + utility transform/decoding
• OSCP-style methodology (brief mentions include AMSI/WinRM bypass earlier in the stream)

Gamers / Sources Featured (from the subtitles)

Named community members / gamers in chat and shoutouts

• Egocif (called out multiple times)
• Tito Sabitar
• Cornfield
• Destiny Moon 19
• Sigenchi / Sigen Gaps (spelling varies)
• Uchia / Uchija (spelling varies)
• Seba / Neco Jones / Alejandro Sianuro / Zer9 / Arabae Deep / HSK (multiple spellings)
• Kevin Abalos
• Kainet
• Emilio
• Jorge MHD
• Paco Pérez
• José Pozoca
• Hector (moderator; frequently referenced)
• Cosmonaut
• Squid 22
• Gucifer (Gucifer / Guçifer)
• Rijaba / Sabitar’s supporters (general references)
• Compuser / composure
• Reaper 3000
• Jesus (appears as “Jesus TM”)
• VG
• Abraham Burat
• Anitaus / Anonyus (spelling varies; donor name)
• Chema Alonso
• Luis Bizu (questioner; name appears in subtitles)

Other sources / brands referenced

• Hack The Box (HTB)
• TryHackMe / TryHagni (mentioned as a platform)
• Impacket
• Evil-WinRM
• John the Ripper
• Nmap
• Siri (joke)
• Mercadona (supermarket referenced)
• Windows Server 2006/2008-era mention (Windows version discussed; exact wording is noisy)