Bounty — HTB Writeup | The Hack Sparrow

Executive summary — Bounty is an Easy Windows box with a very elegant trick: an IIS 7.5 upload form filters .aspx, but allows uploading a web.config that reconfigures the server itself to treat .config as an executable script — and the same file embeds classic ASP code that downloads and launches a reverse shell, giving RCE as merlin. That service account holds SeImpersonatePrivilege, so we escalate to SYSTEM by abusing a privileged COM service with JuicyPotato. Path: web.config → RCE → SeImpersonate → JuicyPotato → SYSTEM.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.26.226`

Attack map

[80] IIS 7.5 → /transfer.aspx (file upload)
   │  filters .aspx, but allows uploading web.config → embedded ASP → RCE
   ▼
[SHELL]  bounty\merlin  (user.txt)
   │  whoami /priv → SeImpersonatePrivilege
   ▼
[SYSTEM]  JuicyPotato (SeImpersonate abuse)

1. Reconnaissance

Full port scan first, service enumeration second: on HTB Easy boxes the attack surface is usually small, and it pays off to rule out the rest quickly.

nmap -p- --min-rate 5000 -T4 10.129.26.226
nmap -p 80 -sC -sV 10.129.26.226

80/tcp  open  http  Microsoft IIS httpd 7.5

A single open port: 80/HTTP, served by IIS 7.5 with an ASP.NET backend. Confirms Windows, and that the entry point has to be the web application.

Resumen ejecutivo — Bounty es una Windows Easy con un truco muy elegante: un formulario de subida en IIS 7.5 filtra .aspx, pero permite subir un web.config que reconfigura el propio servidor para tratar .config como script ejecutable — y dentro del mismo fichero se embebe código ASP clásico que descarga y lanza una reverse shell, dando RCE como merlin. Esa cuenta de servicio tiene SeImpersonatePrivilege, así que se escala a SYSTEM abusando de un servicio COM privilegiado con JuicyPotato. Recorrido: web.config → RCE → SeImpersonate → JuicyPotato → SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.26.226`

Mapa del ataque

[80] IIS 7.5 → /transfer.aspx (subida de ficheros)
   │  filtra .aspx, pero permite subir web.config → ASP embebido → RCE
   ▼
[SHELL]  bounty\merlin  (user.txt)
   │  whoami /priv → SeImpersonatePrivilege
   ▼
[SYSTEM]  JuicyPotato (abuso de SeImpersonate)

1. Reconocimiento

Escaneo completo de puertos primero, servicios después: en máquinas Easy de HTB casi siempre la superficie de ataque es pequeña y conviene descartar rápido lo que no hay.

nmap -p- --min-rate 5000 -T4 10.129.26.226
nmap -p 80 -sC -sV 10.129.26.226

80/tcp  open  http  Microsoft IIS httpd 7.5

Un único puerto abierto: 80/HTTP, servido por IIS 7.5 con backend ASP.NET. Confirma que es Windows y que el punto de entrada tiene que ser, necesariamente, la aplicación web.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.