Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
In this lab, we will employ macros in ODT files uploaded to a resume web form to gain a foothold. We will then migrate to the apache user and abuse the SeImpersonatePrivilege permission to elevate our privileges. This lab focuses on exploiting document vulnerabilities and privilege escalation techniques.
Scenario
This lab demonstrates using a VBA macro in an ODT file to gain initial access to a Windows system via a vulnerable resume upload form. Learners will escalate privileges by uploading a PHP web shell to compromise the apache user. The final escalation leverages the SeImpersonatePrivilege permission with the PrintSpoofer tool to execute commands as SYSTEM. This lab highlights code execution via macros, PHP shell deployment, and privilege escalation using impersonation privileges.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services and identify a web application with a vulnerable file upload form.
- Exploit the resume upload form by embedding a VBA macro in an ODT file for remote code execution.
- Use the obtained shell to upload and execute a PHP web shell for further access as the apache user.
- Identify the enabled SeImpersonatePrivilege permission for privilege escalation.
- Use the PrintSpoofer tool to escalate privileges and obtain SYSTEM access.
Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.