HTB | Job

Machine - https://app.hackthebox.com/machines/Job

IP - 10.129.234.73

NMAP

└─$ nmap -sC -sV -p 25,80,445,3389,5985 10.129.234.73 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-10-10 19:23 IST
Nmap scan report for 10.129.234.73
Host is up (1.4s latency).

PORT     STATE SERVICE       VERSION
25/tcp   open  smtp          hMailServer smtpd
| smtp-commands: JOB, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Job.local
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-10-10T13:56:08+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=job
| Not valid before: 2025-09-04T13:43:05
|_Not valid after:  2026-03-06T13:43:05
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: JOB; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-10-10T13:55:37
|_  start_date: N/A

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 158.61 seconds

Port 80

There is only a single webpage with an email career@job.local asking to send resume for hiring.

whatweb

dirsearch

Nothing interesting was there

Port 25

We can try sending mail using sendmail

On the webpage it was mentioned that please send your cv as a libre office document So we will send the mail with malicious .odt file and try to get the ntlm hash

Let’s use this GitHub repo for creating .odt file

now it’s time for testing, it did not worked for some reason

Now I will try msfconsole for creating the .odt file

and I will start my smb listener and send the mail

on listner, I got the hash

let’s try to crack the hash, but not able to crack it

foothold/ shell

Shell as ?

Getting shell via ODT file

I will use msfconsole for the exploit

Let’s download WyHDPdQBH and rename Invoke-PowerShellTcpEx.ps1 to WyHDPdQBH

Now let’s send the mail

found user.txt

Privilege Escalation

Shell as ?

file upload on wwwroot

The user job\jack.black, who is a member of the JOB\developers group. This group is explicitly granted FullControl permissions on C:\\inetpub\\wwwroot

Let’s upload the shell.aspx on wwwroot and load the page http://10.129.146.164/shell.aspx and on the listener

SeImpersonatePrivilege

It’s time to use the potato attack

and we are nt authority\\system

and we got the root.txt

PreviousHTB | BreachNextHTB | JAB

Last updated