Control — HTB Writeup | The Hack Sparrow

Executive summary — Control combines a classic web exploitation chain with a Windows escalation technique less common than the usual "potato" attacks. An HTML comment leaks the IP of a supposedly trusted proxy, which turns out to be the exact value expected by an access control check based on the X-Forwarded-For header — once inside the admin panel, a UNION-based SQL injection against a MariaDB account with FILE privilege dumps credentials and writes a PHP webshell straight into the IIS webroot. From there, after ruling out the usual potato routes, the real escalation vector is abusing service registry ACLs: an unprivileged user can rewrite the ImagePath of a LocalSystem service and get code execution as SYSTEM.

Platform	Hack The Box
Operating system	Windows Server 2019 (Build 17763)
Difficulty	Hard
Status	Retired
Target IP	`10.129.59.220`

Attack map

[80] Fidelity (IIS 10 + PHP 7.3) — HTML comment leaks the "trusted proxy" IP
   │  X-Forwarded-For: 192.168.4.28 -> bypasses admin.php's access control
   ▼
[80] admin.php — UNION SQLi in search_products.php (productName, 6 columns)
   │  manager@warehouse has FILE privilege -> dump of mysql.user
   │  hector:l33th4x0rhector (mysql-sha1, cracked with rockyou)
   ▼
[RCE]  INTO DUMPFILE writes a PHP webshell into C:\inetpub\wwwroot
   │  RunasCs (-l 2 --force-profile) pivots using hector's credentials
   ▼
[hector]  (user.txt)
   │  SeImpersonate + GodPotato/PrintSpoofer fail
   │  Weak ACLs on HKLM\SYSTEM\CurrentControlSet\Services -> writable ImagePath
   ▼
[ROOT]  hijack a LocalSystem service's ImagePath (Appinfo) + sc start -> SYSTEM

1. Reconnaissance

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.59.220

PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
3306/tcp  open  mysql
49666/tcp open  unknown
49668/tcp open  unknown

sudo nmap -p80,135,3306,49666,49668 -sCV -oN scans/services.txt 10.129.59.220

80/tcp   open  http    Microsoft IIS httpd 10.0
|_http-title: Fidelity
| http-methods:
|_  Potentially risky methods: TRACE
3306/tcp open  mysql   MariaDB 10.3.24 or later (unauthorized)

The HTTP headers reveal the full stack: Server: Microsoft-IIS/10.0 and X-Powered-By: PHP/7.3.7. Two anomalies worth noting: MariaDB (3306) exposed externally on a Windows box — unusual, suggesting careless configuration — and PHP on IIS, a less common pairing than PHP/Apache or ASP.NET/IIS, pointing at a custom-built application.

mysql -h 10.129.59.220 -u root

ERROR 1130: Host '<ATTACKER_IP>' is not allowed to connect to this MariaDB server

The database will only be reachable from the inside, through the web app.

curl -s http://10.129.59.220/ | head -25

The front page's HTML holds a telling developer comment:

<!-- To Do:
    - Import Products
    - Link to new payment system
    - Enable SSL (Certificates location \\192.168.4.28\myfiles)
-->

"Import Products" hints at product search/management functionality (the future SQLi vector), and 192.168.4.28 is an internal IP the server treats as trusted — although it reads like a note about where some certificates live, it's the exact value that will resolve the admin panel's access control. HTML comments leaking infrastructure details are a textbook case of information disclosure.

ffuf -u http://10.129.59.220/FUZZ -w raft-medium-directories.txt -e .php -mc 200,301,302,403

admin.php            (200, "Access Denied: Header Missing")
about.php            (200)
database.php         (200, empty)
search_products.php  (200, "Access Denied")

The site's own JavaScript (assets/js/functions.js) confirms more product CRUD endpoints: update_product.php, view_product.php, delete_product.php.

Resumen ejecutivo — Control combina una explotación web clásica con una técnica de escalada Windows menos habitual que las "potato". Un comentario HTML filtra la IP de un supuesto proxy de confianza, que resulta ser el valor exacto que espera un control de acceso basado en la cabecera X-Forwarded-For — una vez dentro del panel de administración, una inyección SQL UNION sobre una cuenta de MariaDB con privilegio FILE permite volcar credenciales y escribir una webshell PHP directamente en el webroot de IIS. Desde ahí, tras descartar las vías de potato habituales, el vector de escalada real es el abuso de las ACLs del registro de servicios: un usuario sin privilegios puede reescribir el ImagePath de un servicio LocalSystem y conseguir ejecución como SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2019 (Build 17763)
Dificultad	Hard
Estado	Retired
IP objetivo	`10.129.59.220`

Mapa del ataque

[80] Fidelity (IIS 10 + PHP 7.3) — comentario HTML filtra la IP del "proxy" de confianza
   │  X-Forwarded-For: 192.168.4.28 -> bypass del control de acceso de admin.php
   ▼
[80] admin.php — SQLi UNION en search_products.php (productName, 6 columnas)
   │  manager@warehouse tiene FILE privilege -> volcado de mysql.user
   │  hector:l33th4x0rhector (mysql-sha1, crackeado con rockyou)
   ▼
[RCE]  INTO DUMPFILE escribe una webshell PHP en C:\inetpub\wwwroot
   │  RunasCs (-l 2 --force-profile) pivota con las credenciales de hector
   ▼
[hector]  (user.txt)
   │  SeImpersonate + GodPotato/PrintSpoofer fallan
   │  ACLs débiles en HKLM\SYSTEM\CurrentControlSet\Services -> ImagePath escribible
   ▼
[ROOT]  hijack del ImagePath de un servicio LocalSystem (Appinfo) + sc start -> SYSTEM

1. Reconocimiento

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.59.220

PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
3306/tcp  open  mysql
49666/tcp open  unknown
49668/tcp open  unknown

sudo nmap -p80,135,3306,49666,49668 -sCV -oN scans/services.txt 10.129.59.220

80/tcp   open  http    Microsoft IIS httpd 10.0
|_http-title: Fidelity
| http-methods:
|_  Potentially risky methods: TRACE
3306/tcp open  mysql   MariaDB 10.3.24 or later (unauthorized)

Las cabeceras HTTP revelan el stack completo: Server: Microsoft-IIS/10.0 y X-Powered-By: PHP/7.3.7. Dos anomalías dignas de nota: MariaDB (3306) expuesta al exterior en un Windows — poco habitual, sugiere una configuración descuidada — y PHP sobre IIS, una combinación menos común que PHP/Apache o ASP.NET/IIS, que apunta a una aplicación a medida.

mysql -h 10.129.59.220 -u root

ERROR 1130: Host '<ATTACKER_IP>' is not allowed to connect to this MariaDB server

La base de datos solo será accesible desde dentro, vía la aplicación web.

curl -s http://10.129.59.220/ | head -25

El HTML de la portada contiene un comentario de desarrollador revelador:

<!-- To Do:
    - Import Products
    - Link to new payment system
    - Enable SSL (Certificates location \\192.168.4.28\myfiles)
-->

"Import Products" sugiere funcionalidad de búsqueda/gestión de productos (el futuro vector SQLi), y 192.168.4.28 es una IP interna que el servidor trata como de confianza — aunque parezca solo la ruta de unos certificados, es el dato que va a resolver el control de acceso del panel de administración. Los comentarios HTML filtrando detalles de infraestructura son un caso clásico de information disclosure.

ffuf -u http://10.129.59.220/FUZZ -w raft-medium-directories.txt -e .php -mc 200,301,302,403

admin.php            (200, "Access Denied: Header Missing")
about.php            (200)
database.php         (200, vacío)
search_products.php  (200, "Access Denied")

El JavaScript propio (assets/js/functions.js) confirma más endpoints del CRUD de productos: update_product.php, view_product.php, delete_product.php.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.