Hack The Box: SecNotes Walkthrough

Here’s a quick walkthrough of the SecNotes machine from Hack The Box.

Nmap Scan result:

Service Enumeration

8808/tcp

Found IIS default page running on port 8808.

80/tcp

When I navigated to the target IP, I was automatically redirected to /login.php, landing on this login page:

/register.php

Get pack3tsniper’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Clicking on Sign up now, we are presented with the registration page.

We create an account with the username 'OR 1 OR' and a password of our choice. After logging in, we’re redirected to /home.php, where we discover a note revealing credentials:

Registering an account with the username ‘OR 1 OR’ to test for SQL injection.

Logging in with the username ‘OR 1 OR’

Successfully logged in as ‘OR 1 OR’ user

Found credentials for tyler in the note: tyler / 92g!mA8BGjOirkL%OG*&

Initial Access

smbclient

Using smbclient and the found credentials, we enumerated shares and found thenew-sitesmb share.

We accessed the new-site SMB share and found iisstart.htm and iisstart.png.

Since we saw the IIS page on port 8808 earlier, finding iisstart.htm and iisstart.png in the new-site share suggests the web server is serving files from this share.

Shell as tyler

Let’s listen on port 8808 to catch the reverse shell.

We uploaded nc.exe and a PHP reverse shell (rev_shell.php) to the new-site SMB share. The reverse shell is configured to connect back to our IP 10.10.14.41 on listening port 8808. Once uploaded, we can trigger the PHP file via the web server to get a shell.

Despite the 500 error in the browser, we still got a reverse shell as secnotes\tyler.

Shell as nt authority\system

Privilege Escalation via WSL

Using where /R, we searched for wsl.exe and found its path inside the WinSxS folder.

Using the full path inside WinSxS, we executed wsl.exe, dropping us into a root shell inside WSL.

We upgraded the shell using python3 -c 'import pty;pty.spawn("/bin/bash")' for a better interactive experience. Then, by checking .bash_history, we found administrator credentials using smbclient to access the c$ share on 127.0.0.1.

psexec

Learn more about how impacket-psexec works here

Using impacket-psexec with the admin credentials, we successfully got a SYSTEM shell on the target.