search

HTB | Analysis

Machine - https://app.hackthebox.com/machines/Analysisarrow-up-right

IP - 10.10.11.250

hashtag
NMAP

└─$ nmap -sC -sV -p 53,80,88,135,139,389,445,464,593,636,3268,3269,3306,5985,9389,33060,47001,49664,49665,49666,49667,49672,49674,49675,49678,49679,49696,49709 10.10.11.250 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-09 16:29 IST
Nmap scan report for 10.10.11.250
Host is up (0.48s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-09 11:00:12Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3306/tcp  open  mysql         MySQL (unauthorized)
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
33060/tcp open  mysqlx        MySQL X protocol listener
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49672/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         Microsoft Windows RPC
49678/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49696/tcp open  msrpc         Microsoft Windows RPC
49709/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 5s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-08-09T11:01:19
|_  start_date: N/A

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 108.36 seconds

hashtag
LDAP

hashtag
Port 80

Let’s do directory and subdomain enumeration

subdomin

Let’s add this subdomain to our /etc/hosts file

Since it is 403, meaning there must be something which might be accessible on this subdomain

There’s a bunch of potentially interesting paths in there, and I’ll specifically want to check out the ones that returned 200:

  • /users/list.php

  • /dashboard/upload.php

  • /dashboard/index.php

  • /dashboard/form.php

  • /dashboard/tickets.php

  • /dashboard/details.php

  • /dashboard/emergency.php

  • /employees/login.php

All of the dashboard paths return an empty page.

/employees/login.php presents a login form:

/users/list.php returns a message:

Let’s fuzz for parameter

hashtag
Foothold/shell

hashtag
Shell as jdoe

hashtag
LDAP Injection

When passing a name parameter with * it gives some output

When passing a* it gives

It looks like * is being used as a wildcard.

It’s also worth noting that the column headers in the table line up very nicely with standard LDAP fieldsarrow-up-right.

it looks like LDAP injection

LDAP injection arises when user-controllable data is copied in an unsafe way into an LDAP query that is performed by the application. If an attacker can inject LDAP metacharacters into the query, then they can interfere with the query's logic. Depending on the function for which the query is used, the attacker may be able to retrieve sensitive data to which they are not authorized, or subvert the application's logic to perform some unauthorized action.

I will take the help of 0xBen’sarrow-up-right script and modify it a little

Let’s start with technician

output

hashtag
login via the technician via portal

I can login to the employee portal

hashtag
PHP file upload and shell as svc_web

We can upload a report for the SOC team to analyse

When uploading an exe, it says file is safe, but we didn’t get any call back

On looking at Burp, we found that it is saving the file to uploads directory

I used revshells.comarrow-up-right for shell.php

Upload this and load http://internal.analysis.htb/dashboard/uploads/shell.php and we get the call back on our listner

hashtag
enum log files

We found 2 dir in LogFile

on looking for username and password, we fond multiple alerts for jdoe

we can winrm

and we found user.txt

hashtag
Privilege Escalation

hashtag
Shell as ?

found encoded text

Looks like we will need the password or passphrase to decrypt, for now i will leave it and use Bloodhound

hashtag
Bloodhound

From this we got to know that WSMITH@ANALYSIS -> ForceChangePassword/ GenericWrite -> SOC_ANALYST@ANALYSIS.HTB

and SOC_ANALYST@ANALYSIS.HTB -> DCSync -> ANALYSIS.HTB

But we don’t have Wsmith credentials

hashtag
DLL Hijacking

Let’s run winPEASx64.exe

In Interesting Services -non Microsoft- I found this

Which is the Snort service that is running

After checking the permissions on the lib directroy in C:\\Snort\\lib

The ACL output is showing us that the snort_dynamicpreprocessor folder is writable by BUILTIN\Utilisateurs (which means any standard user).

This means any standard user can add or overwrite files inside snort_dynamicpreprocessor.

  • (F) → Full control

  • (RX) → Read & execute

  • (AD) → Add file

  • (WD) → Write data

  • (I) → Inherited

  • (OI)/(CI) → Object inherit / Container inherit (permissions apply to files and folders within)

Given that I can write data to that directory, I should be able to generate a DLL, write it there, and get execution the next time Snort runs.

Let’s generate the dll and upload

The next time Snort runs (every even minute), there’s a shell as an administrator at nc:

and we got root.txt

PreviousHTB | ManagerNextHTB | Certified

Last updated