HTB | Analysis
Machine - https://app.hackthebox.com/machines/Analysis
IP - 10.10.11.250
NMAP
└─$ nmap -sC -sV -p 53,80,88,135,139,389,445,464,593,636,3268,3269,3306,5985,9389,33060,47001,49664,49665,49666,49667,49672,49674,49675,49678,49679,49696,49709 10.10.11.250 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-09 16:29 IST
Nmap scan report for 10.10.11.250
Host is up (0.48s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-08-09 11:00:12Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3306/tcp open mysql MySQL (unauthorized)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
33060/tcp open mysqlx MySQL X protocol listener
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49672/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49675/tcp open msrpc Microsoft Windows RPC
49678/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49696/tcp open msrpc Microsoft Windows RPC
49709/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 5s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2025-08-09T11:01:19
|_ start_date: N/A
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 108.36 secondsLDAP
Port 80
Let’s do directory and subdomain enumeration
subdomin
Let’s add this subdomain to our /etc/hosts file
Since it is 403, meaning there must be something which might be accessible on this subdomain
There’s a bunch of potentially interesting paths in there, and I’ll specifically want to check out the ones that returned 200:
/users/list.php/dashboard/upload.php/dashboard/index.php/dashboard/form.php/dashboard/tickets.php/dashboard/details.php/dashboard/emergency.php/employees/login.php
All of the dashboard paths return an empty page.
/employees/login.php presents a login form:
/users/list.php returns a message:
Let’s fuzz for parameter
Foothold/shell
Shell as jdoe
LDAP Injection
When passing a name parameter with * it gives some output
When passing a* it gives
It looks like * is being used as a wildcard.
It’s also worth noting that the column headers in the table line up very nicely with standard LDAP fields.
it looks like LDAP injection
LDAP injection arises when user-controllable data is copied in an unsafe way into an LDAP query that is performed by the application. If an attacker can inject LDAP metacharacters into the query, then they can interfere with the query's logic. Depending on the function for which the query is used, the attacker may be able to retrieve sensitive data to which they are not authorized, or subvert the application's logic to perform some unauthorized action.
I will take the help of 0xBen’s script and modify it a little
Let’s start with technician
output
login via the technician via portal
I can login to the employee portal
PHP file upload and shell as svc_web
We can upload a report for the SOC team to analyse
When uploading an exe, it says file is safe, but we didn’t get any call back
On looking at Burp, we found that it is saving the file to uploads directory
I used revshells.com for shell.php
Upload this and load http://internal.analysis.htb/dashboard/uploads/shell.php and we get the call back on our listner
enum log files
We found 2 dir in LogFile
on looking for username and password, we fond multiple alerts for jdoe
we can winrm
and we found user.txt
Privilege Escalation
Shell as ?
found encoded text
Looks like we will need the password or passphrase to decrypt, for now i will leave it and use Bloodhound
Bloodhound
From this we got to know that WSMITH@ANALYSIS -> ForceChangePassword/ GenericWrite -> SOC_ANALYST@ANALYSIS.HTB
and SOC_ANALYST@ANALYSIS.HTB -> DCSync -> ANALYSIS.HTB
But we don’t have Wsmith credentials
DLL Hijacking
Let’s run winPEASx64.exe
In Interesting Services -non Microsoft- I found this
Which is the Snort service that is running
After checking the permissions on the lib directroy in C:\\Snort\\lib
The ACL output is showing us that the snort_dynamicpreprocessor folder is writable by BUILTIN\Utilisateurs (which means any standard user).
This means any standard user can add or overwrite files inside snort_dynamicpreprocessor.
(F) → Full control
(RX) → Read & execute
(AD) → Add file
(WD) → Write data
(I) → Inherited
(OI)/(CI) → Object inherit / Container inherit (permissions apply to files and folders within)
Given that I can write data to that directory, I should be able to generate a DLL, write it there, and get execution the next time Snort runs.
Let’s generate the dll and upload
The next time Snort runs (every even minute), there’s a shell as an administrator at nc:
and we got root.txt
Last updated