https://chaelsoo.me/tags/ppid/Recent content in Ppid on kanyo's blogHugo -- gohugo.ioen-gbSun, 07 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-pov/Sun, 07 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-pov/<p>Windows box, only port 80. The main site drops a subdomain in the contact section, and that subdomain has a portfolio with a CV download feature that doesn&rsquo;t sanitize the file path. Reading <code>web.config</code> through that LFI leaks the ASP.NET machineKey. From there the attack is elegant: the machineKey signs and encrypts ViewState, so with it you can forge a malicious ViewState that the server deserializes as trusted, and deserialization in .NET gives you code execution. The second half is about SeDebugPrivilege and parent PID spoofing, a technique that lets you inherit a SYSTEM token without touching lsass.</p>