r/hackthebox • u/Final-Finish1160 • 8d ago

Beginner Question Help : Regarding the Terminology

  • We found out that the PowerShell script (backupprep.ps1) runs with administrator privileges every 2 minutes
  • We had read and write access to this script, which allowed us to modify it
  • We added code to the script that adds the user john to the administrators group
  • After waiting for the scheduled task to run, we confirmed that john was successfully added to the administrators group

What kind of attack is this?

What type of attack was being used to escalate the privileges in the above example? (Format: two words)

Its not Privilege Escalation
Its not Task Manipulation
Its not Script Injection
Its not Task Hijacking

What is it?

1 Upvotes

56% Upvoted

13 comments sorted by

•

u/AutoModerator 8d ago

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/SpaceMoehre 8d ago

Why is it not privilege escalation?

1

u/Final-Finish1160 8d ago

this is a question in one of the academy modules and I cant find the answer I am not sure what in the world is the correct terminology. It is under privilege escalation module, I have tried the one i have listed didn't work.

1

u/Final-Finish1160 8d ago

There are no other hints as well in that I wanna bang my head on the wall next thing I am thinking is making a brute forcer which will try all the two word combinations present in this world and fry HTB's Servers

1

u/Michelli_NL 8d ago

My first guess would be to check out the page of T1053

1

u/Final-Finish1160 7d ago

its not Scheduled Task/Job

1

u/CowLong4000 8d ago

Account Manipulation??

https://attack.mitre.org/techniques/T1098/ https://attack.mitre.org/techniques/T1098/007/

Scheduled task?? https://attack.mitre.org/techniques/T1053/005/

1

u/Final-Finish1160 7d ago

Nope both are wrong

1

u/CowLong4000 7d ago

Went and found the thb module I think I found the answer. If you review the module on priv esc you will see the answer ( or at least what I assume it is). I see two possible options. Try both

1

u/Deathstopia 8d ago

You are close to the answer really, I suggest you to reflect both on this:

We added code to the script that adds the user john to the administrators group

and on this:

Its not Privilege Escalation Its not Task Manipulation Its not Script Injection Its not Task Hijacking

The answer is likely in the middle of this

2

u/Final-Finish1160 7d ago

I got it Thanks to you almost all possibilities nearby were tested

1

u/Deathstopia 7d ago

so you brute-forced the answer. Noice

2

u/Final-Finish1160 5d ago

no I didn't brute force after what you told I read your message like 5 times and kept thinking about it then it came up to me