Writeup by wook413

ReconNmapInitial AccessSMB 139 445RPC 135LDAP 389 636 3268 3269HTTP 80 443Lateral MovementShell as svc_apacheShell as svc_mssqlPrivilege EscalationShell as nt authority\\network service

Recon

Nmap

I kicked things off with a comprehensive Nmap scan covering all 65,535 TCP ports, followed by a targeted scan of the open ports and a UDP scan of the top 10 ports.

Initial Access

SMB 139 445

SMB null authentication was denied, and the SMB Nmap scripts didn’t turn up anything useful.

RPC 135

I also tried an rpcclient null session, but that was denied as well.

LDAP 389 636 3268 3269

An LDAP Anonymous Bind attempt was also rejected.

HTTP 80 443

Whenever I find an HTTP service, I usually run the Nmap http-enum script; it sometimes catches valuable info that standard directory brute-forcing misses.

image-20260203193650991

image-20260203193657829

Clicking the “Buy Now” buttons revealed a file upload feature. I tested it with an image first, which went through, but the server rejected the file when I switched the extension to .php . I tried several variations like .phtml , .phar and etc. but they were all denied.

image-20260203193704729

image-20260203193709605

image-20260203193714078

I confirmed that my uploaded image was successfully stored in the /upload directory.

image-20260203193719876

To bypass the filter, I uploaded a .htaccess file configured to let the server treat image files as PHP scripts.

image-20260203193725407

I renamed my PHP reverse shell (Ivan-Sincek.php ) to Ivan-Sincek.jpg and the server accepted the upload. I navigated to /uploads and verified the file was there. As soon as I clicked it, the server triggered the script, and I got a reverse shell call back on my Kali machine.

image-20260203193733058

image-20260203193739420

Lateral Movement

I identified the current session user as svc_apache . I proceeded with user enumeration and saved the list of discovered users into a users.txt file.

Shell as svc_apache

I then performed AS-REP Roasting using that user list, but none of the accounts had UF_DONT_REQUIRE_PREAUTH flag set.

Next, I moved on to Kerberoasting with Rubeus. I usually use impacket-GetUserSPNs for this, but since that requires a known username and password — which I didn’t have yet — I first used built-in setspn.exe binary to check for any available SPNs.

After confirming an SPN existed, I transferred Rubeus to the target and proceeded with the Kerberoasting attack. This successfully pulled the hash for the svc_mssql user.

Then I took the captured hash and cracked it using Hashcat.

Once I had the password, I transferred RunAsCs.exe to the machine and spawned a new shell as svc_mssql .

Shell as svc_mssql

Found local.txt

Privilege Escalation

For privilege escalation part, I ran whoami /priv and found that the user hold SeManageVolumePrivilege . After some research, I found a exploit that leverages this specific privilege.

Reference: https://github.com/CsEnox/SeManageVolumeExploit/releases/tag/public

The exploit works by granting all users on the machine full permissions over the C:\\ drive.

After running the exploit, I used icacls to confirm that BUILTIN\\Users now had Full Control over the C:\\ drive, including the C:\\Windows\\System32\\wbem directory where tzres.dll is located. tzres.dll stands for Time Zone Resource; it’s a library containing time zone names and related messaging resources. The systeminfo.exe binary loads this file to display OS time settings while gathering system information.

With these permissions in place, I was able to perform a DLL Hijacking attack. I generated a malicious file named tzres.dll using msfvenom and swapped it with the original file in the \\wbem directory. Upon executing systeminfo , my fake tzres.dll was loaded, triggering the reverse shell and granting me an elevated shell.

Shell as nt authority\\network service

found proof.txt