> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-hospital.md). # HTB - Hospital ## Initial Enumeration ### NMAP ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0) 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-04 23:00:49Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name) 443/tcp open ssl/http Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? 1801/tcp open msmq? 2103/tcp open msrpc Microsoft Windows RPC 2105/tcp open msrpc Microsoft Windows RPC 2107/tcp open msrpc Microsoft Windows RPC 2179/tcp open vmrdp? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? 3389/tcp open ms-wbt-server Microsoft Terminal Services 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 6404/tcp open msrpc Microsoft Windows RPC 6406/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 6407/tcp open msrpc Microsoft Windows RPC 6409/tcp open msrpc Microsoft Windows RPC 6613/tcp open msrpc Microsoft Windows RPC 6642/tcp open msrpc Microsoft Windows RPC 8080/tcp open http Apache httpd 2.4.55 ((Ubuntu)) 9389/tcp open mc-nmf .NET Message Framing 20006/tcp open msrpc Microsoft Windows RPC ``` Domain: `hospital.htb` and DC : `DC.hospital.htb` : add to hosts #### SMB

No anonymous or Guest acces enabled on the machine. #### DNS

No DNS Zone transfer. #### HTTPS - 443

There is registration link too. we can make an account and enumerate further.

There is an upload form which allows uploading image files and in the mean time FFUF identified hidden directories among which is `/uploads` directory. ```bash ──(ajay㉿kali)-[~] └─$ ffuf -u http://10.129.229.189:8080/FUZZ \ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -fs 281 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://10.129.229.189:8080/FUZZ :: Wordlist : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 281 ________________________________________________ css [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 49ms] images [Status: 301, Size: 324, Words: 20, Lines: 10, Duration: 49ms] uploads [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 46ms] . [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 44ms] fonts [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 45ms] js [Status: 301, Size: 320, Words: 20, Lines: 10, Duration: 2668ms] vendor [Status: 301, Size: 324, Words: 20, Lines: 10, Duration: 43ms] ```

cant access uploads but i can directly access the file uploaded. So the directory listing is disabled but direct file access works also the uploaded file is getting deleted after some time. #### Abusing File Upload

uploading a `shell.php` redirects to `/failed.php.` So we need to find an extension that is not blocked and redirects to `/success.php` Fuzizng through intruder i got the extension `.phar` can be used to bypass.

Using the `.phar` extension to execute php code.

php code executed but `system()` or `shell_exec()` didnot executed. I will display the `phpinfo()` to see which functions are disabled.

`popen` and `mail` are not in the disabled list, we can utilize them to get command execution. #### Using php popen() to get Shell

popen works to execute the and give us command injection.

now i can use popen to give me shell access on my netcat listener. ## Shell as www-data

found no interesting directories to enumerate further.

The kernel `version 5.19.0-35-generic` is significantly outdated. A quick google search revealed the following vulnerabilities.

### Abusing Overlay FS Vulnerability Found this poc that helped me escalate to root {% embed url="" %}

## Shell as Root with root access i can read the `/etc/shadow` file.

i can crack the hash for `drwilliams` using hashcat or john.

`drwilliams:qwe123!@#` There is a login portal on port 443. i can use the creds to login there.

there is a mail in the inbox from `dbrown`.

There are several clues from the mail. * Email from * Asking for .eps file format * Will be opened with GhostScript ### Exploiting GhostScript via malicious .eps file What i can do here is generate a malicious `.eps` file and send it to dbrown and once it opened by ghostscript, it gives me shell. `GhostScript < 10.01.2` are vulnerable to RCE via .eps file. Found this git repo when searching online. {% embed url="" %}

Used the reverse shell generator to get a rev shell payload and used it with the POC to generate a malicious `.eps` file. Used powershell payload beacuse nmap revealed that on port 443 there is a windows machine running. ```bash 443/tcp open ssl/http Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28) ``` now send the mail using the malicious eps file and make sure your nc is running.

## Shell as drbrown

There is a script in the documents folder which opens the mail we have sent, upon reading the script, revealed password for drbrown user.

Nxc validated that the password is valid and confirms winrm access.

### DrBrown Winrm Access

`qwinsta` (Query Window Station) is a Windows command that shows active user sessions on the machine. ```bash Evil-WinRM* PS C:\Users\drbrown.HOSPITAL> qwinsta SESSIONNAME USERNAME ID STATE TYPE DEVICE >services 0 Disc console drbrown 1 Active rdp-tcp 65536 Listen *Evil-WinRM* PS C:\Users\drbrown.HOSPITAL> ``` drbrown is active on console (local session) and RDP is listening. i can either use the metasploit to capture the keystrokes drbrown is typing or connect to the rdp shell and view what is happening. logging through rdp gave this screen.

Drbrown is typing administrator password, used the explored feature to save the password for future use and enumerated the saved passwords and extracted the administrator password.

## Shell as Administrator

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-hospital.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.