OffSec

We abuse a guest-writable SMB share to plant a malicious `.url` icon file that coerces a NetNTLMv2 hash from user `anirudh`, crack it offline, then weaponize `SeRestorePrivilege` with the Utilman.exe logon-screen hijack to execute as SYSTEM on the domain controller.

We bypass an upload blacklist with a malicious `.htaccess` extension mapping for RCE, Kerberoast the `svc_mssql` service account and crack its TGS offline, pivot via `RunasCs`, then abuse `SeManageVolumePrivilege` to rewrite `C:\Windows` ACLs and DLL-hijack the print spooler for `NT AUTHORITY\SYSTEM`.

We exploit SQL injection on the login portal to harvest administrative credentials, leverage Server-Side Template Injection (SSTI) in an internal administration panel to obtain a root shell inside a Docker container, and escalate to full host root by abusing a shared volume mount to inject an SUID bash binary.

We discover an exposed Exhibitor for ZooKeeper management interface and exploit an unauthenticated remote command injection vulnerability (CVE-2019-5029) to gain initial access, then abuse NOPASSWD sudo rights on gcore to dump the memory of a background password-store process and extract the root password.

This writeup details the compromise of a target via a Flask API directory traversal vulnerability to gain SSH access, followed by privilege escalation to root through cron job PATH hijacking.