root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat flight.md
// writeups

Flight

5 Nov 2022 · 23 min read · root access
writeupshacktheboxwindowsHardretiredvip
Flight - maquina de Hack The Box

Executive summary — Flight is a chain built on lateral movement via NTLM hash theft and password reuse, finished off with a privilege escalation through service token abuse. An LFI on a secondary vhost (school.flight.htb) turns into credential theft by forcing a UNC path to an attacker-controlled SMB server: Windows authenticates on its own, handing over the svc_apache hash. That password, reused by S.Moon, grants write access on a share that allows planting a malicious desktop.ini — another forced authentication, this time leaking C.Bum's hash. With C.Bum's credentials a PHP webshell goes up on Apache's docroot (RCE as svc_apache, user.txt), followed by an .aspx dropped into the docroot of a second, internal site running under the IIS AppPool identity — whose SeImpersonatePrivilege is exploited with GodPotato up to SYSTEM. The whole final stretch is a race against the box's own cleanup script, which deletes uploaded webshells and binaries within roughly a minute.

PlatformHack The Box
Operating systemWindows Server 2019 (Build 17763) — Domain Controller for flight.htb
DifficultyHard
StatusRetired
Target IP10.129.228.120

Attack map

[80/HTTP] school.flight.htb -- LFI (view=) -> forced UNC path
   |  Responder captures svc_apache NTLMv2 hash -> rockyou -> S@Ss!K@*t13
   v
[SMB] svc_apache -- share/user enumeration -> password spray
   |  reused password -> S.Moon (WRITE on \\Shared)
   v
[SMB] malicious desktop.ini on \\Shared -- forced authentication
   |  C.Bum NTLMv2 hash -> rockyou -> Tikkycoll_431012284
   v
[SMB] C.Bum -- WRITE on \\Web (C:\xampp\htdocs)
   |  PHP webshell -> RCE as svc_apache -> user.txt (via \\Users)
   v
[HTTP :8000] internal site C:\inetpub\development -- C.Bum WRITE
   |  .aspx (via RunasCs) -> RCE as iis apppool\defaultapppool
   v
[SeImpersonate] GodPotato -> SYSTEM -> root.txt

1. Reconnaissance

A ttl=127 on ICMP/TCP responses points to Windows. Full port scan followed by a targeted one with version detection and scripts:

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN nmap-allports.txt 10.129.228.120
sudo nmap -p53,80,88,135,139,389,445,464,593,636,3268,9389 -sCV -Pn -oN nmap-services.txt 10.129.228.120

The port set (53, 88, 389, 445, 464, 636, 3268, 9389) is the textbook fingerprint of an Active Directory Domain Controller (flight.htb). What stands out is 80/HTTP: it serves Apache/PHP 8.1.1 on XAMPP, out of place on a DC and, precisely for that reason, the real attack surface. There's no exposed 5985 (WinRM) and no 443. A +7h clock skew was noted but turned out irrelevant to the solve.

echo "10.129.228.120 flight.htb g0.flight.htb school.flight.htb G0" | sudo tee -a /etc/hosts

SMB rejects a null session (STATUS_ACCESS_DENIED) and the guest account is disabled — the DC requires real authentication, so the web app is the only unauthenticated way in. A response-length vhost fuzz reveals a second site:

ffuf -u http://10.129.228.120/ -H "Host: FUZZ.flight.htb" \
  -w subdomains-top1million-5000.txt -mc all -fs 7069
# school

Methodology note: filtering out the fuzzer's noise by response size (-fs 7069, flight.htb's default "not found" response) is what lets school stand out among hundreds of misses.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.