This is a Windows hard box. I liked it a lot, and I learned a lot of valuable techniques from it. Note: This is a very long writeup, but I hope you’d stick with me!

nmap

Starting off with an nmap scan, all the ports open are typical ports for a domain controller.

PORT      STATE SERVICE       VERSION                                                                                                                      
53/tcp    open  domain        Simple DNS Plus                                                                                                              
80/tcp    open  http          Microsoft IIS httpd 10.0                                                                                                     
|_http-title: IIS Windows Server                                                                                                                           
|_http-server-header: Microsoft-IIS/10.0                                                                                                                   
| http-methods:                                                                                                                                            
|_  Potentially risky methods: TRACE                                                                                                                       
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-07 05:14:42Z)                                                               
135/tcp   open  msrpc         Microsoft Windows RPC                                                                                                        
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn                                                                                                
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)                                  
| ssl-cert: Subject: commonName=DC01.pirate.htb                                                                                                            
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb                                                             
| Not valid before: 2025-06-09T14:05:15                                                                                                                    
|_Not valid after:  2026-06-09T14:05:15                                                                                                                    
|_ssl-date: 2026-03-07T05:16:12+00:00; +7h00m01s from scanner time.                                                                                        
445/tcp   open  microsoft-ds?                                                                                                                              
464/tcp   open  kpasswd5?                                                                                                                                  
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0                                                                                          
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)                                  
|_ssl-date: 2026-03-07T05:16:11+00:00; +7h00m00s from scanner time.                                                                                        
| ssl-cert: Subject: commonName=DC01.pirate.htb                                                                                                            
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb                                                             
| Not valid before: 2025-06-09T14:05:15                                                                                                                    
|_Not valid after:  2026-06-09T14:05:15
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-07T05:16:12+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-07T05:16:12+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49685/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49686/tcp open  msrpc         Microsoft Windows RPC
49688/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49915/tcp open  msrpc         Microsoft Windows RPC
56872/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Initial Recon - Bloodhound

We are given credentials for a low-privileged domain user, pentest. I then used the account and bloodhound-pythonto collect information about the domain. I found that there are 2 remote management users, and the domain computer MS01 can read the password of the account GMSA ADFS.

This was a pretty fun challenge. I’ve always known about prototype pollution, but this challenge taught me beyond the high level knowledge to actually find the gadget to exploit it.

Initial Inspection

This simple Express.js app allows creating, deleting, and updating notes. When first examining the source code, I noticed that it’s using Mongoose, a MongoDB object modeling tool. Instinctively, I checked the package.json and found that the mongoose version is 7.2.4. So I searched up for known vulnerabilities and identified CVE-2023-3696. Now, what’s our goal? There is a straight-forward endpoint /flag that checks if request “comes from the internal server” by validating req.connection.remoteAddress:

This is my third time being an author and organizer for UMassCTF. I decided to create a web challenge simulating a market where users can upload their building blocks (to avoid using lego branding) for sale. However, they need to first get the “admin” to approve their requests for before they can be listed. The attack chain I created was to perform a web cache deception via CRLF path delimiters to obtain the CSRF token of the admin bot, and then use CSRF to get the admin bot to approve a listing request to get the flag.

Overview

The initial set up of this challenge is that there is “no way” to obtain the initial password because the emailing feature has not been implemented. However, there is a flaw in the way the initial password is generated and hashed, resulting in an authentication bypass.

Approach

Source was given, and the first thing I looked into was how the initial password was generated in index.js. This is the code that is run when registering with an email:

This is my second time being an author and organizer for UMassCTF. Since this year’s theme was flash/io games, it was a great opportunity for me to incorporate web game elements. So I decided to create a web challenge using WebSockets themed on the “Falling Blocks” game where the player has to dodge the falling blocks and the longer you survive the higher score you’ll get. The vulnerability itself wasn’t hard to find and exploit, but I aimed to make it subtle and more real-life-like.

This is a medium box, but it felt hard to me. It was relatively fun to pwn.

nmap

Starting off with an nmap scan, all the ports open are typical ports for a domain controller.

Initial Recon

Anonymous ldap bind is successful.

Under user r.thompson, there is a field that looks like a base64 encoded password string. Decoding it gives a cleartext password.

However, running netexec shows that user r.thompson is not a member of the Remote Management Users group.

Overview

The initial set up of this challenge was allowing user to view different text files on the website. However, there existed a remote code execution vulnerability in the way that the web application was taking in the file path. Specifically, it used PHP’s assert() function, which would evaluate a string as PHP code.

Approach

When I first opened up the website and clicked on the different text files, I noticed that they were displayed using a url parameter file. I then looked at the source code and found that the PHP file was using $_GET to take in a url parameter.

Overview

This challenge has a parameter pollution vulnerability. In order to solve the challenge, I used Burp Suite to intercept the web request and started from there.

Approach

I first noticed that there is a login and a register page, so I made a new user and logged in as that user.

The message on the web page tells us that it wants us to get the most donations, but it seems like only Jeff Bezos is the only one you can donate to.

Overview

The second part of “Donations” also has a parameter pollution vulnerability, so the approach is to exploit this vulnerability in the request.

Approach

The first step was the same as part 1 of the challenge, where I registered a user and intercepted the request of making donations to “Jeff Bezos”. I tried sending a negative amount, which the response returned an error message.

This was the key to finding the solution - the message told me that “only Amazon can steal your money”. So I had the idea of adding a “from” paramter to indicate the sender as “amazon”. Like part 1 of the challenge, I overrode the destination with an additional “to” directed to a user I created. As the image below shows, I was able to send “currency” from one user to another.

Overview

Overall this was a pretty fun challenge, I enjoyed it a lot. It came off as easy at first, but tricked me in a few places. This challenge can be broken down into two major stages: figure out how to get the same secret key to sign a session cookie and how to get the file flag.txt from the filename url parameter.

Approach

When I first opened up the web page, I got a 403 error. So I inspected the source code provided and found that the server is checking for a key value pair{userid: 0} in the session cookie.