HTB · Medium
Media — NTLM Hash Capture via Malicious ASX File and SeTcbPrivilege Escalation
A malicious Windows Media Player playlist triggers an outbound SMB connection, leaking an NTLMv2 hash. Once inside, a Windows Junction Point attack redirects file uploads to the web root, delivering a PHP webshell that runs as LOCAL SERVICE with SeTcbPrivilege — enough to become Administrator.
