Heist

Verified writeups for the Heist machine of Hack The Box

Heist

$ tldr Cisco password7 → CrackMapExec + lookupsid → Procdump Firefox

·	·
Operating system	Windows
Difficulty	Easy
Vector	Windows privesc
IP	10.10.10.149
Retirement date	2019-11-30
Skills	Information Leakage Cisco Password Cracker (password7) SMB Enumeration - CrackMapExec Getting more valid system users - lookupsid.py Abusing WinRM - EvilWinRM Creating a dump file of the Firefox process - Procdump64.exe (Windows Sysinternals) Reading the password of the administrator user in the previously performed dump [Privilege Escalation]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Information Leakage	HackTricks	Open
SMB (139/445)	HackTricks	Open

Related skills worth mastering

EternalBlue (MS17-010) · MS08-067 (NetAPI)

If you liked this machine, try

• Resolute — Windows, Medium
• TimeLapse — Windows, Easy
• Jerry — Windows, Easy
• Admirer — Linux, Easy
• Haystack — Linux, Easy

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07