Analysis¶
Machine Profile
OS: Windows Server (Active Directory)
Difficulty: Hard
IP: 10.129.230.179
Domains: analysis.htb, internal.analysis.htb
Pwned: 8 Nov 2025 (user + system)
Key techniques: Subdomain enumeration · LDAP injection · MSDT (Follina) abuse
Reconnaissance¶
Standard AD profile + MySQL on 3306:
53 DNS
80 HTTP API
88 Kerberos
135 MSRPC
139 NetBIOS
389 LDAP
445 SMB
3268/9 LDAP GC
3306 MySQL (unauthorized)
Web Recon¶
analysis.htb is a static mock-data site — no value. But a gobuster VHOST sweep finds internal.analysis.htb returning 403 instead of the default 400:
403 with content size > 0 is a strong signal — there's a real app behind it, the front-end is just blocking us.
Dirsearch against internal.analysis.htb finds:
/dashboard/employees/users/employees/login.php
A POST endpoint on the employee login form is the next target.
Initial Foothold — LDAP Injection on Employee Login¶
The login form authenticates against AD via LDAP. Trying classic SQLi gives "Wrong Data" — but LDAP injection payloads bypass it:
Why this works: the back-end is concatenating user input into an LDAP filter without escaping, so we close the filter early and inject our own. Authentication bypassed.
Inside the dashboard, an employee export endpoint returns LDAP attributes for arbitrary users. By iterating through the directory we pull back descriptions, group memberships, and at least one account with a password in the description field — a classic AD anti-pattern where admins write passwords into the description attribute "temporarily".
That account is Bbrandon.keywarp (or similar) with sufficient WinRM rights:
user.txt on the desktop.
Privilege Escalation — MSDT Follina-Style Abuse¶
The box has a scheduled task that pulls an .eml file from a directory the low-priv user can write to, and the email gets opened by an Administrator-context process. Crafting a malicious .eml that triggers CVE-2022-30190 (MSDT / Follina) is the path:
malicious.html references ms-msdt: with the standard Follina payload that runs PowerShell as the user that opens the mail (Administrator).
PowerShell payload: a reverse shell back to our listener.
When the scheduled task opens the email, Follina fires → reverse shell as Administrator.
cat C:\Users\Administrator\Desktop\root.txt.
Key Takeaways¶
- 403 responses are not the same as 404. A 403 with response-body bytes > 0 means there's a real app behind a permission boundary, worth digging into.
- LDAP injection is alive in AD-backed web apps that don't escape
(,),*,\,\0. Always probe login forms with both SQLi and LDAPi payloads. - AD
descriptionfield is a credential leak source. Always dump descriptions when you can read the directory. - Follina (CVE-2022-30190) still works on unpatched Office installs. It's a one-shot privesc if you can plant a file that gets opened by a higher-priv user.
Tools Used¶
nmap · gobuster · dirsearch · ffuf · ldapsearch · curl · Burp Suite · Manual LDAP injection · MSDT/Follina payload generators · evil-winrm