HTB - Remote
TL;DR - An exposed NFS share (/site_backups) mounts without authentication and contains an Umbraco CMS backup. The admin password hash lives in Umbraco.sdf; cracking it with rockyou gives CMS login. Umbraco 7.12.4 is vulnerable to authenticated RCE, which we use to stage nc.exe and pop a reverse shell. The service account holds SeImpersonatePrivilege, so PrintSpoofer escalates straight to nt authority\system. Recon Starting this machine with a full nmap scan. ...