Flight | HTB
Machine - https://app.hackthebox.com/machines/Flight
IP - 10.10.11.187
NMAP
└─$ nmap -sC -sV -p 53,80,88,135,139,389,445,464,593,636,3268,3269,9389,49667,49673,49674,49694,49719 10.10.11.187 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-19 14:12 IST
Nmap scan report for 10.10.11.187
Host is up (0.31s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-08-19 15:42:59Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap
3269/tcp open tcpwrapped
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49694/tcp open msrpc Microsoft Windows RPC
49719/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-08-19T15:44:03
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 7h00m02s
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 137.69 seconds
Port 53
Port 80
For some reason i am unable to do directory enumeration
Let’s try to do subdomain enum
let’s add this to our hosts file and visit
Let’s do a directory enum
on visiting http://school.flight.htb/cgi-bin/printenv.pl we found
on looking at blogs, the URL was interesting
When trying to access files, we get this
Looks like some filtering
Foothold/shell
Shell as ?
Auth as svc_apache
LFI
When trying / instead of \\ We get the result
This confirms that LFI is there
RFI test
Let’s see whether allow_url_include is enabled or not
Unfortunately, it was executed as a text file
NTLM hash over SMB
We already know that we have a Windows host with SMB running on it. What if we tell the web server to connect to a share on our machine? Well, if everything goes fine, it should normally try to authenticate to our SMB server, and we must be able to capture its Net-NTLMv2 hash and then crack it.
Let’s start our responder
and force it to connect to our share
we can see the hash on our responder
let’s try to crack it
LDAP and smb both were able to authenticate
Let’s enum shares since LDAP was not possible
Users and Web looks interesting, let’s connect and see
USers Looks like C directory
nothing was there looks like empty directories
Password spray
we found the username
let’s copy them and perform a password spray
Auth as S.Moon
LDAP was not possible, let’s enum shares
We have Read and Write permission
NTLM Theft File upload
We cannot upload a text file (maybe some filtering?)
But we can upload file
Let’s try to perform NTLM thef via file upload
Now start the responder and upload
On responder, we get the hash
Auth as C.Bum
Let’s crack the hash
We can use LDAP and SMB via C.BUM
Looks like we can read and write on Web
And it is the share for the website
Let’s try to upload a text file
Shell as svc_apache
And we can upload php file, and it can execute
We can upload a PHP RevShell and get a shell
Shell as C.Bum
Let’s upload RunasC and get the shell
And we get user.txt
Privilege Escalation
Shell as ?
internal port 8000
we found that there is something running on internal port 8000
Let’s use chisel
Nice I can access port 8000 via localhost:8001
port 8000
website was not functioning
uploading Revshell (Auth as defaultapppool)
User C.Bum has Write access (not full control).
Let’s try to upload a test PHP file
Looks like we need to upload the ASP.NET file
Let’s upload a revshell
I will use this revshell
and load http://127.0.0.1:8001/revshell.aspx
SeImpersonatePrivilege
Since we have SeImpersonatePrivilege we can perform a Potato attack
I will use this
we can get shell or simply view root.txt
Last updated