HTB: Jobs
A careers site that takes developer applications by email lets us phish the box with a macro-enabled document, landing a shell as jack.black. The hMailServer config leaks admin hashes, and since we can publish to the site as a developer we drop an aspx webshell and ride GodPotato from wwwroot to SYSTEM.
Looking at our nmap scan, the first thing that pops out to me is port 25 with an hMailServer running on it.
We have a domain job.local, so let's add that to our hosts file and start enumerating the web app on port 80.
It's a company looking for developers, and we've got an email: career@job.local. Let's write this down in our notes, we might need it later. We're going to create a macro-enabled .odt with a PowerShell payload and ship it over to them.
swaks --to career@job.local --from applicant@job.local --server 10.129.234.73 --header "Subject: Developer Application" --body "Hi, please find my CV attached. Thanks" --attach @cv.odt
This gets us a reverse shell as the jack.black user!
Heading over to the desktop, we find the user.txt flag.
Let's enumerate the account and check our privileges.
whoami /all
We have minimal permissions, so let's go straight for the hMailServer config ini file, which should have admin creds in it.
type "C:\Program Files (x86)\hMailServer\Bin\hMailServer.ini"
We get an unsalted md5 hash for the Administrator and the MSSQLCE account. Let's note those down and try to crack them.
Both hashes exhaust without cracking, so let's change things up. Enumerating the hMailServer directory we find the Data folder with all the incoming emails, but it's all just attempts at the box. Going back to the .ini file, we spot a VBScript that runs from Events/EventHandlers.vbs.
Checking the permissions, we can't write to that custom script, but look, we ARE a developer and can write and push to the site. So let's set up an .aspx payload and drop it into the target's inetpub wwwroot directory.
Let's confirm it hits with a curl.
curl "http://job.local/cmd.aspx?c=whoami"
It does! Now let's make a reverse shell and try to run GodPotato on the system.
We get an access denied, so let's shift things a bit. Downloading GodPotato into the inetpub wwwroot directory and running it from there hits!
Heading over to the Administrator's desktop, we then find the root.txt flag.
This box was a pretty good phishing experience, learning about macros and the effect they have on automated email systems. It felt realistic, as a lot of these systems are automated and might have macros exposed. Rooting the box felt like the easiest part of the whole thing. I enjoyed this one and would recommend it to a beginner.
