ServMon — HTB Writeup | The Hack Sparrow

Executive summary — ServMon starts from an anonymous FTP login that exposes two internal notes from the administrator, chains an unauthenticated path traversal in the NVMS-1000 surveillance panel to steal a password file, gets in over SSH after a cross-matched password spray, and finishes by abusing NSClient++ — whose management API password sits in plaintext inside a world-readable configuration file — to register an external script that the service runs with the SYSTEM token. No single weakness here rises above medium severity; the full chain reaches complete compromise.

Platform	Hack The Box
Operating system	Windows (Server 2019, build 17763)
Difficulty	Easy
Status	Retired
Target IP	`10.129.227.77`

Attack map

[21/FTP] Anonymous login -> C:\Users (Nathan, Nadine) + two internal notes
   |  Nadine's note: left Passwords.txt on Nathan's desktop
   v
[80/HTTP] NVMS-1000 -- unauthenticated path traversal -> Passwords.txt (7 passwords)
   |  password spray: 7 passwords x 2 users over SMB
   v
[22/SSH] Nadine : L1k3B1gBut7s@W0rk -> user.txt
   |  world-readable nsclient.ini -> plaintext API password + CheckExternalScripts=enabled
   v
[8443/HTTPS] NSClient++ API restricted to 127.0.0.1
   |  local SSH port-forward 8443->127.0.0.1:8443 defeats the allowed-hosts check
   v
[ROOT] PUT /api/v1/scripts/ext -- external script runs as SYSTEM -> root.txt

1. Reconnaissance

sudo nmap -p- --min-rate 3000 -T4 -Pn -n --open -oN allports.nmap 10.129.227.77

PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5666/tcp  open  nrpe
6063/tcp  open  x11
6699/tcp  open  napster
8443/tcp  open  https-alt
49664-49670/tcp open  (dynamic RPC)

Two things stand out before a single service gets fingerprinted. SSH on a Windows box is unusual: if valid credentials turn up, it'll be the most comfortable way in, better than WinRM or SMB for working interactively. And 5666 sitting next to 8443 is a very telling combination — 5666 is the classic Nagios Remote Plugin Executor port, and on Windows it's almost always served by NSClient++, which also runs its web management interface on 8443. It's a monitoring agent that, by design, executes scripts on the host — a natural escalation candidate worth flagging from minute one.

sudo nmap -p21,22,80,135,139,445,5666,6063,6699,8443 -sCV -Pn -n \
  --script="banner,ftp-anon,http-title" -oN services.nmap 10.129.227.77

21/tcp   open  ftp      Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh      OpenSSH for_Windows_8.0
80/tcp   open  http     -> redirects to Pages/login.htm  (NVMS-1000)
445/tcp  open  microsoft-ds
8443/tcp open  ssl/http http-title: NSClient++

Confirmed on the first pass: anonymous FTP open and NSClient++ on 8443. Port 80 serves the login page of NVMS-1000, a TVT video surveillance product.

Resumen ejecutivo — ServMon parte de un FTP anónimo que expone dos notas internas del administrador, encadena un path traversal sin autenticar en el panel de videovigilancia NVMS-1000 para robar un fichero de contraseñas, entra por SSH tras un password spray cruzado y termina abusando de NSClient++ — cuya API de administración queda expuesta con la contraseña en claro dentro de un fichero de configuración legible por cualquiera — para registrar un script externo que el servicio ejecuta con el token de SYSTEM. Ninguna debilidad aislada pasa de severidad media; la cadena completa sí llega a compromiso total.

Plataforma	Hack The Box
Sistema operativo	Windows (Server 2019, build 17763)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.227.77`

Mapa del ataque

[21/FTP] Login anonimo -> C:\Users (Nathan, Nadine) + dos notas internas
   |  nota de Nadine: dejo Passwords.txt en el escritorio de Nathan
   v
[80/HTTP] NVMS-1000 -- path traversal sin autenticar -> Passwords.txt (7 claves)
   |  password spray: 7 claves x 2 usuarios via SMB
   v
[22/SSH] Nadine : L1k3B1gBut7s@W0rk -> user.txt
   |  nsclient.ini legible -> password de la API en claro + CheckExternalScripts=enabled
   v
[8443/HTTPS] API de NSClient++ restringida a 127.0.0.1
   |  tunel SSH local 8443->127.0.0.1:8443 sortea el allowed hosts
   v
[ROOT] PUT /api/v1/scripts/ext -- script externo se ejecuta como SYSTEM -> root.txt

1. Reconocimiento

sudo nmap -p- --min-rate 3000 -T4 -Pn -n --open -oN allports.nmap 10.129.227.77

PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5666/tcp  open  nrpe
6063/tcp  open  x11
6699/tcp  open  napster
8443/tcp  open  https-alt
49664-49670/tcp open  (RPC dinámicos)

Dos cosas llaman la atención antes de identificar ni un solo servicio. SSH sobre Windows no es lo habitual: si aparecen credenciales válidas, será la vía de entrada más cómoda, mejor que WinRM o SMB para trabajar de forma interactiva. Y el 5666 junto al 8443 es una combinación muy característica — el 5666 es el puerto clásico de Nagios Remote Plugin Executor, y en Windows quien lo atiende casi siempre es NSClient++, que además levanta su interfaz de administración web en el 8443. Es un agente de monitorización que, por diseño, ejecuta scripts en el host — candidato natural para la escalada, conviene tenerlo marcado desde ya.

sudo nmap -p21,22,80,135,139,445,5666,6063,6699,8443 -sCV -Pn -n \
  --script="banner,ftp-anon,http-title" -oN services.nmap 10.129.227.77

21/tcp   open  ftp      Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh      OpenSSH for_Windows_8.0
80/tcp   open  http     -> redirige a Pages/login.htm  (NVMS-1000)
445/tcp  open  microsoft-ds
8443/tcp open  ssl/http http-title: NSClient++

Confirmado en la primera pasada: FTP anónimo abierto y NSClient++ en el 8443. El puerto 80 sirve el panel de login de NVMS-1000, un software de videovigilancia de TVT.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.