> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/edge.md).
# Edge
{% embed url="" %}
The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)
***
## Scenario
Vantara is a private company formed in 2024 by Billionaire Blairo Maggi's nephew, Ênio Rezende, under the Hut 8 / private equity umbrella. It operates as a hyperscale data center and AI infrastructure company.
Vantara is positioning itself as a vertically integrated AI infrastructure provider owning the physical layer (land, power, buildings) through to the compute layer competing in the same space as CoreWeave, DataBank, and similar operators.
You have been asked to conduct a Penetration Test against the organization.
#### Initial Access
The client wants you to do an "assumed breach" pentest, so they have provided you with starting credentials.
{% code overflow="wrap" expandable="true" %}
```
jmorris:Fabricat!on2024
```
{% endcode %}
## Summary
Summary
In Edge, we begin with assumed-breach credentials `jmorris:Fabricat!on2024` against the Windows host `VantaraOps` at `10.1.21.36`. Initial enumeration via `rustscan` piped into Nmap reveals SMB on `445`, RDP on `3389`, WinRM on `5985`, and MSRPC endpoints on `135` and `49670`. Authenticating through `evil-winrm` as `jmorris` yields an interactive session but no special privileges, so we pivot to a process inspection that confirms Microsoft Edge is running and recall the recently discovered behavior on Edge about that it loads all saved passwords into memory in cleartext.
We cross-compile Dkob's `edgeSnapper.cpp` against a locally staged `processsnapshot.h` header, upload the resulting `edgeSnapper.exe` to the host, and execute it to dump the in-memory credential store. Validation with NetExec confirms a working set for `svc_vdi`, and while WinRM is denied, RDP succeeds. This brings us into a kiosk-mode control center rather than a standard desktop. On the support tab we identify a hyperlink advertised as browser-handled; clicking it spawns a browser window, where entering `C:\windows\system32\cmd.exe` into the address bar triggers a download of the binary that we then launch, escaping the kiosk into a full `cmd` shell as `svc_vdi`.
Inspecting `svc_vdi`'s Documents folder surfaces a `putty.conf` containing plaintext credentials for `svc_vdi_mgmt`. NetExec flags the account as `(Pwn3d!)` against SMB, and we authenticate through `evil-winrm` to read `C:\Users\Administrator\Desktop\root.txt`.
## Recon
We use `rustscan -b 500 -a 10.1.21.36 --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`.
A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability.
{% code overflow="wrap" expandable="true" %}
```
rustscan -b 500 -a 10.1.21.36 --top -- -sC -sV -Pn
```
{% endcode %}
The target `10.1.21.36` is a Windows host `VantaraOps`. SMB is exposed via port `445` with message signing enabled but not required. Remote management and access are available through RDP on port `3389` and WinRM on port `5985`. The host also exposes MSRPC endpoints on ports `135` and `49670`
## Access as svc\_vdi
We test to get access to the target with the provided credentials and are able to successfully authenticate and get an interactive session with evil-winrm. As that user we do not have any special permissions.
{% code overflow="wrap" expandable="true" %}
```
evil-winrm -i 10.1.21.36 -u jmorris -p 'Fabricat!on2024'
```
{% endcode %}
The scenario is called Edge and with the recent behavior discovered by Tom Jøran Sønstebyseter Rønning we want to check for that. Tom Jøran Sønstebyseter Rønning discovered that Microsoft Edge loads all saved passwords into memory in cleartext at startup and keeps them there for the entire session, even for sites the user never visits.
We check for running processes and find Edge running.
{% code overflow="wrap" expandable="true" %}
```
Get-Process
```
{% endcode %}
To take advantage of this behavior, we use **EdgeSnapper**, a tool developed by community member Dkob, which abuses the issue to extract the in-memory credentials.
{% embed url="" %}
We compile it as shown in the repository. In my case it failed because my cross-compiler did not have the `processsnapshot.h` header available.
{% code overflow="wrap" expandable="true" %}
```
x86_64-w64-mingw32-g++ edgeSnapper.cpp -o edgeSnapper.exe -static -static-libgcc -static-libstdc++ -ldbghelp -lpsapi
```
{% endcode %}
This is not a big issue, a quick workarround can be to download that header and place it in the same directory as the source file.
{% embed url="" %}
We try to compile it again and are successful.
{% code overflow="wrap" expandable="true" %}
```
x86_64-w64-mingw32-g++ edgeSnapper.cpp -I. -o edgeSnapper.exe \
-static -static-libgcc -static-libstdc++ -ldbghelp -lpsapi
```
{% endcode %}
We'll upload the executable and run it. We are able to retrieve several credentials.
{% code overflow="wrap" expandable="true" %}
```
upload /workspace/hacksmarter/edge/EdgeSnapper/PathBeta/edgeSnapper.exe
```
{% endcode %}
{% code overflow="wrap" expandable="true" %}
```
./edgeSnapper.exe
```
{% endcode %}
We test the credentials using NetExec. We successfully authenticated as `svc_vdi`.
{% code overflow="wrap" expandable="true" %}
```
nxc smb 10.1.182.219 -u svc_vdi -p 'REDACTED'
```
{% endcode %}
We are also trying to connect via evil-winrm and RDP and are successful with RDP.
Here we are greeted with a custom login after getting a session. Seems like we are in a kiosk mode.
## Access as svc\_vdi\_mgmt
We re-enter the credentials of `svc_vdi`...
... and are inside a control center.
On the support tab we find something interesting. There is a link and the description says it will be opened by a browser.
We click on the link and might be asked to enter the credentials again. After some tries we get browser window opened.
Now we can enter something like `file:///C:\windows\system32\cmd.exe` or `C:\windows\system32\cmd.exe` in the address bar...
...we see the executable being download. From there we can actually access it.
We click on it and get a terminal as `svc_vdi`.
In the Documents folder of that user we find a `putty.conf`...
This contains the credentials of the user `svc_vdi_mgmt`.
{% code overflow="wrap" expandable="true" %}
```
type putty.conf
```
{% endcode %}
We test the credentials using NetExec and see that we are admin.
{% code overflow="wrap" expandable="true" %}
```
nxc smb 10.1.21.36 -u svc_vdi_mgmt -p 'REDACTED'
```
{% endcode %}
Next, we try to get a session using evil-winrm, and reach out the the Administrators folder to fetch the final flag at `C:\Users\Administrator\Desktop\root.txt`.
{% code overflow="wrap" expandable="true" %}
```
evil-winrm -i 10.1.21.36 -u svc_vdi_mgmt -p 'REDACTED'
```
{% endcode %}
](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)
***
## Scenario
Vantara is a private company formed in 2024 by Billionaire Blairo Maggi's nephew, Ênio Rezende, under the Hut 8 / private equity umbrella. It operates as a hyperscale data center and AI infrastructure company.
Vantara is positioning itself as a vertically integrated AI infrastructure provider owning the physical layer (land, power, buildings) through to the compute layer competing in the same space as CoreWeave, DataBank, and similar operators.
You have been asked to conduct a Penetration Test against the organization.
#### Initial Access
The client wants you to do an "assumed breach" pentest, so they have provided you with starting credentials.
{% code overflow="wrap" expandable="true" %}
```
jmorris:Fabricat!on2024
```
{% endcode %}
## Summary