HTB: Media

Mon, 08 Jun 2026 00:00:00 +0000

A Windows box with a media company theme that tells you exactly what the vulnerability is the moment you read the upload form. The site asks you to submit a video file “compatible with Windows Media Player.” That phrasing is the hint. WMP processes playlist formats like .m3u and when a UNC path appears in one, Windows automatically tries to authenticate to the remote share using the current user’s credentials. The server processes the upload with WMP, the auth request hits your Responder listener, and you get an NTLMv2 hash. Getting from user to admin is a junction symlink abuse: the upload path is derived from a predictable MD5 of the form inputs, so you can pre-create a junction at that exact path pointing to the webroot before the upload lands, which drops your webshell directly into XAMPP’s htdocs. The shell runs as Local Service, Local Service has SeTcbPrivilege, and that closes it.

Symlink on kanyo's blog

HTB: Media