POV¶

Machine Profile

OS: Windows IP: 10.10.11.251 Status: Active engagement — reconnaissance and initial LFI confirmed Key techniques: Subdomain enumeration · LFI via web.config disclosure

Reconnaissance¶

Dirsearch against the main site finds the standard ASP.NET layout. The interesting subdomain is dev.pov.htb — discovered via vhost fuzzing.

gobuster vhost -u http://pov.htb -w subdomains-top1m.txt

dev.pov.htb hosts a different application (the marketing/contact form):

POV — public contact form

Initial Foothold — LFI to web.config¶

The dev subdomain has a ?file= parameter on the portfolio download page that filters extensions but is bypassed with NUL or double-encoding tricks:

http://dev.pov.htb/portfolio?file=..%2f..%2f..%2fweb.config

The Burp response shows the web.config contents in full, including hidden ASP.NET machine keys:

POV — web.config exfiltrated via LFI

Those machine keys enable viewstate deserialization → RCE via ysoserial.net.

Engagement Status¶

✅ Recon
✅ LFI confirmed
✅ Machine keys extracted from web.config
⏳ Viewstate payload + RCE not yet fired

Writeup to be expanded once the chain is completed.

Key Takeaways So Far¶

web.config is the .NET equivalent of /etc/shadow for an attacker — it contains machine keys, connection strings, and authentication configuration. Any LFI that returns it should be treated as critical.
ASP.NET viewstate deserialization is the standard follow-on: once you have the machine keys, ysoserial.net builds a payload that gives you SYSTEM on the IIS app pool.

Tools Used¶

nmap · gobuster · dirsearch · Burp Suite · ysoserial.net (planned)