root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat aero.md
// writeups

Aero

28 Sep 2023 · 17 min read · root access
writeupshacktheboxwindowsMediumretiredvip
Aero - maquina de Hack The Box

Executive summary — Aero chains two 2023 CVEs without ever touching a password: a Windows 11 theme portal that automatically processes any file uploaded by an anonymous user is vulnerable to CVE-2023-38146 ("ThemeBleed"), a TOCTOU race condition in the Windows theme engine that executes an arbitrary DLL while bypassing Authenticode signature verification, loaded from an attacker-controlled SMB share. The resulting domain-user access is escalated to NT AUTHORITY\SYSTEM with CVE-2023-28252, a privilege-escalation 0-day in the CLFS (Common Log File System) driver that was exploited in the wild by the Nokoyawa ransomware before being patched.

PlatformHack The Box
Operating systemWindows 11 Pro (Build 22000 / 21H2)
DifficultyMedium
StatusRetired
Target IP10.129.229.128
Hostname / web domainaero / aerohub.htb
Starting pointanonymous (unauthenticated upload form)

Attack map

Anonymous : theme-upload form on "Aero Theme Hub" (80/HTTP)
   │  POST /upload  (.theme / .themepack) -> internal bot "tests" each theme
   ▼
CVE-2023-38146 "ThemeBleed"
   │  .theme -> UNC path to .msstyles on attacker SMB
   │  PACKTHEM_VERSION=999 -> Windows loads <name>_vrf.dll
   │  TOCTOU (ShareAccess 1/7 signature check vs. 5 LoadLibrary) -> Authenticode bypass
   ▼
aero\sam.emerson  (reverse shell)                      <- user.txt
   │  CVE-2023-28252 (CLFS driver, Nokoyawa 0-day)
   │  exploit.exe <token offset> <flag> <program>  (offset 1208, Build 22000)
   │  kernel memory corruption in CLFS -> SYSTEM token theft
   ▼
[ROOT] NT AUTHORITY\SYSTEM                              <- root.txt

1. Reconnaissance

sudo nmap -p- --min-rate 2000 -T4 -Pn 10.129.229.128 -oN nmap/allports.txt
PORT   STATE SERVICE
80/tcp open  http

A minimal attack surface: a single open port. The response's TTL=127 already points to a Windows host before the version scan even runs.

sudo nmap -p 80 -sCV -Pn 10.129.229.128 -oN nmap/http.txt
80/tcp open  http    Microsoft IIS httpd 10.0
|_http-title: Aero Theme Hub
|_http-server-header: Microsoft-IIS/10.0

1.1 Web enumeration

The site is "Aero Theme Hub", described as "a free, community driven, Windows 11 theme repository". The interesting part is a theme upload form:

<form class="form-upload" id="uploadForm" method="post" enctype="multipart/form-data" action="/upload">
    <input type="file" id="fileInput" accept=".theme, .themepack" name="files" required>
</form>

Two key details: the POST /upload endpoint accepts .theme / .themepack files in the files field, and any upload gets the exact same response:

echo 'test' > /tmp/t.theme
curl -s -F "files=@/tmp/t.theme" http://10.129.229.128/upload
{"success":true,"message":"Once we test your theme it will be added to the site!"}

The phrase "we test your theme" is the critical hint: there's a server-side process (a real Windows account) that opens or applies uploaded themes with no human involved and no prior authentication. Automatic processing of untrusted content submitted by an anonymous user is, almost always, a direct path to code execution — and on a freshly released Windows 11 host in 2023, the theme engine points straight at CVE-2023-38146 (ThemeBleed).

🔒 Clearance required

Root Access unlocks the content you can't see — everything else on the site is already open.

See Root Access plans

No account? Create one free then upgrade from your console.