Writeup by wook413

ReconNmapFootprintingSMB 139 445FTP 30021HTTP 8000 45332 45443HTTP 8000HTTP 45332Shell as jerrenPrivilege EscalationShell as system

Recon

Nmap

As always, I initiated the machine engagement with a comprehensive scan of all 65,535 TCP ports, followed by a targeted service scan of the identified ports. Finally, I performed a UDP scan of the top 10 ports.

Footprinting

SMB 139 445

SMB Null Authentication was denied. I confirmed with both smbclient and smbmap

FTP 30021

The FTP service on port 30021 allowed Anonymous Login.

To facilitate easier enumeration, I downloaded all available FTP data; unfortunately, no sensitive information was found, leading me to shift my focus to the HTTP services.

HTTP 8000 45332 45443

HTTP 8000

The web page on port 8000 prompted me to create an administrator account, stating that the BarracudaDriver server would be inaccessible otherwise.

image-20260209213446859

image-20260209213452212

image-20260209213456402

After successfully creating the administrator account, I explored the server and discovered a “Web-File Server” tab. This section detailed the WebDAV server and identified /fs as the direct link to the file server.

image-20260209213502871

I attempted to access /fs using the cadaver utility. When prompted for credentials, I successfully authenticated using the administrator account I had previously created. The WebDAV server appeared to provide access to both the C: and D: drives.

Recognizing a XAMPP environment, I navigated to C:/xamp/htdocs (the default web root for XAMPP) and confirmed the presence of index.html and other core web service files.

HTTP 45332

I observed that the web service running on port 45332 successfully loaded /phpinfo.php file that’s stored in the htdocs directory. Based on this, I theorized that I could upload a PHP reverse shell via WebDAV and trigger it by requesting the file through the web service on port 45332.

image-20260209213512593

Shell as jerren

As anticipated, the reverse shell was successfully triggered. Upon establishing the session, I confirmed that I was logged in as the user jerren .

Found local.txt

Privilege Escalation

To identify escalation vectors, I transferred PrivescCheck.ps1 from my local machine to the target host.

The script identified the password for the user jerren

image-20260209213520556

It also identified a high severity “Image File Permission” vulnerability. The C:\\bd\\bd.exe service executes with LocalSystem privileges. However, all Authenticated Users possess WriteData , Delete , and GenericWrite permissions, meaning any user can modify, delete, or overwrite the service binary.

I generated a reverse shell payload using msfvenom and named it bd.exe to match the target service.

Before transferring the payload, I renamed the original service binary to bd_original.exe to avoid any file conflicts.

To trigger the payload, a service restart was required. Checking whoami /priv revealed that the jerren account possessed SeShutdownPrivilege . I executed a system reboot using the shutdown /r command.

Shell as system

Shortly after the system restarted, I received a reverse shell with SYSTEM privileges on my listener.

Found proof.txt