Coder — HackTheBox Writeup

Machine	Coder
OS	Windows
Difficulty	Insane
Rating	⭐⭐⭐⭐⭐
Author	d3vn0mi

---

🛠️ Walkthrough

Both flags confirmed live from the box (the first line is just the admin hash echoed by nxc).

🏁 Coder (HTB Insane, Windows AD) — Fully Pwned

Flags:

• user.txt: <redacted>
• root.txt: <redacted>

Attack chain executed

1. Recon — SMB Guest access to the Development share → Encrypter.exe + s.blade.enc (preserved mtime = epoch 1668205028).
2. Reverse engineering — Reimplemented the .NET Random-seeded AES; decrypted via real mono/mcs (avoiding a NextBytes byte quirk) → 7z archive → KeePass DB (keyfile-only) with s.blade creds + an encrypted TOTP backup.
3. Source review + brute — CryptoJS double-AES brute (skyblade) → TOTP secret PM2CG6RO73QT74WS.
4. Foothold — The hard part: scripted the entire TeamCity 2022.10 web auth headlessly — reverse-engineered its custom jsbn RSA padding (length in the last byte), the __test cookie requirement, /loginSubmit.html, and the 2FA login endpoint (POST /2fa.html with password=<TOTP>) using server-clock TOTP. Then patch-based RCE via /uploadDiffChanges.html + personal build → command output read straight from the build log as svc_teamcity (no reverse shell, no Defender fight).
5. Lateral — Read 101.changes.diff, rebuilt the ConvertTo-SecureString -Key object → e.black (ypOSJXPqlDOxxbQSfEERy300, PKI Admins). → user.txt.
6. Root — ADCS: as e.black created a template that is simultaneously `NO_SECURITY

---

🏁 Proof of Ownership

Flag	Value
User	<redacted>
Root	<redacted>