dreadnaught- Machine
- Access
- OS
- Windows
- Difficulty
- Easy
- Steps
- 3
- Added
- 23 Mar 2023
A database from anonymous FTP unlocks an archived Outlook mailbox holding Telnet creds; saved admin creds then give the box.
How it went
- 0nmap
An nmap scan shows FTP, Telnet, and a web server.
- 1backup.mdb
Anonymous FTP exports backup.mdb, which reveals credentials and confirms an engineer account.
- 2Outlook mail
The .mdb password unlocks the Access Control archive, whose Outlook folder holds security's credentials; Telnet in for the user flag.
- 3runas
Saved Administrator credentials in the Credential Manager feed runas /savecred for a shell as Administrator.