Bastion · Technical notes · Matías Bataglia

Bastion: from a backup to administrator access

An editorial account of my Bastion lab, focusing on the evidence behind each decision and the defensive lessons.

Context

Bastion is an Easy Windows machine on Hack The Box. My personal log records completion on 27 July 2026. This is a lab exercise, not a production engagement.

Reconnaissance

Service enumeration led me to SMB. An anonymous RPC request returned access denied, but the backup share was still accessible. A failure against one interface did not prove that its files were protected.

Initial access

The share contained Windows backup images. A read-only mount avoided copying the entire large image and provided access to registry hives. The authentication material supported offline password recovery and then SSH access as a standard user. Recovered credentials are omitted.

Privilege escalation

Local software enumeration identified mRemoteNG and its saved connection configuration. The default master-password protection allowed recovery of an administrative credential, enabling an SSH session as Administrator. The source records the resulting identity; no flag is reproduced.

Key decisions

The key decisions were to continue SMB enumeration after the RPC denial, mount the backup read-only, and inspect installed software after the first login. Each step followed evidence from the previous one.

Defensive lessons

The defensive lesson is to protect backups like the original host: restrict effective access, keep encryption keys separate, avoid predictable or reused local passwords, and review stored privileged credentials. After exposure, fixing access must include credential rotation.

Evidence limits

Evidence limits: this is reconstructed from my notes, which mix observed output, explanatory commands and expected checks. Commands were not rerun for this portfolio. Instance-specific port counts are not generalized. Exact commands and screenshots require a separate review.