Hackthebox - Bounty

From nmap, there is http service. And from gobuster, there is a transfer.aspx page.

This is the web page, and we can upload files.

I tried to upload a php reverse shell, but failed.

I later found that we can upload .config file. After googling, I found the article https://poc-server.com/blog/2018/05/22/rce-by-uploading-a-web-config/ for RCE with a web.config on IIS.

I upload a web.config containing reverse shell. Access it in directory /uploadedfiles/web.config. I get the reverse shell.

With whoami /priv, I saw that SeImpersonatePrivilege is enabled. That is, Juicy Potato may work.

Prepare a run.bat to execute powershell reverse shell script.

Run Juicy Potato with process run.bat.

Finally, we get a reverse shell as administrator.