Introduction
In HackTheBox Rainbow, my initial analysis identified a custom Windows webserver executable. I’ll proceed by manually fuzzing its input vectors to find a memory corruption vulnerability. Once a repeatable crash is triggered, I’ll attach x32dbg to the process, analyze the exception, and weaponize the vulnerability to achieve remote code execution. The resulting shell operates within the context of a user in the local Administrators group, but the process token is filtered by UAC, running at a medium integrity level which prevents me from reading the root flag. To escalate, I will leverage the fodhelper UAC bypass to spawn a new process in a high-integrity context, granting me unrestricted system access.
Scanning and Enumeration
Begining with an Nmap scan, we find the open ports below. My initial port scan reveals a fingerprint consistent with a Windows client. I’ve noted the hostname and domain are both set to RAINBOW, which strongly suggests this is a standalone machine and not joined to an Active Directory domain. This OS assessment is corroborated by the packet TTL, which is consistently 127 on all responding ports, the exact value I’d expect from a Windows host one network hop away.
Full writeup can be found here
0 comments