Optimum — HTB Writeup | The Hack Sparrow

Executive summary — Optimum is a classic-chain Easy Windows box: a Rejetto HTTP File Server (HFS) 2.3 vulnerable to RCE (CVE-2014-6287) gives a shell as user kostas; then an unpatched Windows falls to a local exploit, MS16-032 (Secondary Logon, CVE-2016-0099), up to SYSTEM. A HFS RCE → user → local exploit suggester → SYSTEM path.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.9.132`

Attack map

[80] Rejetto HFS 2.3 (HttpFileServer)
   │  CVE-2014-6287 — null byte in the macro parser → RCE
   ▼
[SHELL]  meterpreter as OPTIMUM\kostas  (user.txt.txt)
   │  local_exploit_suggester → MS16-032 (Secondary Logon, CVE-2016-0099)
   ▼
[SYSTEM]  NT AUTHORITY\SYSTEM  (root.txt)

1. Reconnaissance

We start with a targeted port scan: we only care about what's behind 80/tcp.

nmap -sC -sV -p80 10.129.9.132

80/tcp  open  http  HttpFileServer httpd 2.3

The key detail: the server identifies as HFS 2.3 (Rejetto HTTP File Server), a lightweight file-sharing application and, more importantly, a version with a well-known critical RCE dating back to 2014 — fingerprint the exact version (-sV) and half the box is solved.

Resumen ejecutivo — Optimum es una Windows Easy de cadena clásica: un Rejetto HTTP File Server (HFS) 2.3 vulnerable a RCE (CVE-2014-6287) da una shell como el usuario kostas; después, un Windows sin parchear cae con un exploit local, MS16-032 (Secondary Logon, CVE-2016-0099), hasta SYSTEM. Recorrido HFS RCE → user → local exploit suggester → SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.9.132`

Mapa del ataque

[80] Rejetto HFS 2.3 (HttpFileServer)
   │  CVE-2014-6287 — null byte en el parser de macros → RCE
   ▼
[SHELL]  meterpreter como OPTIMUM\kostas  (user.txt.txt)
   │  local_exploit_suggester → MS16-032 (Secondary Logon, CVE-2016-0099)
   ▼
[SYSTEM]  NT AUTHORITY\SYSTEM  (root.txt)

1. Reconocimiento

Empezamos con un escaneo de puertos dirigido: solo nos interesa qué hay detrás del 80/tcp.

nmap -sC -sV -p80 10.129.9.132

80/tcp  open  http  HttpFileServer httpd 2.3

El dato clave: el servidor se identifica como HFS 2.3 (Rejetto HTTP File Server). Es una aplicación de intercambio de ficheros muy ligera y, sobre todo, una versión con una RCE crítica conocida desde 2014 — con identificar la versión exacta (-sV), media máquina está resuelta.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.