I am practicing directory traversal attacks and found a vulnerability in a windows XP machine that is running a vulnerable HTTP server that is prone to directory traversal.

I can guess file names and read them successfully but can not execute commands. What are available options to execute code on the box?

I got a copy of /repair/sam however, it was not that much useful since I do not have access to system hives ! The most i could get is the user names of the system.

So any thoughts how to escalate this to get full access?

Hints: only ports 80 and 3389 are open.


I would look at the source of the web app to hopefully find additional vulnerabilities or credentials. For example, you might be able to find a SQL injection by reading the code, or you might be able to find a web.config file containing database credentials.


Do you have write access? If so, you can overwrite an existing executable and wait for it to be run. I used this approach in this advisory, which includes a PoC exploit. http://www.pentest.co.uk/documents/ptl-2013-01.html

If you only have read access your options are more limited. You may be able to extract a password from a config file, or extract a password hash and crack it.

  • Thanks for the response, however,I have read only access.! with respect to cracking SAM hashes, please review my post. – Ahmed Taher Oct 27 '13 at 21:28

If you have the SAM, then you have the password hashes, too? Have you tried Cain and Abel or John the Ripper to bruteforce the passwords?


It turns out that I should first extract hives from windows/repair/system and use the outputted key when importing hashes to Cain and Abel

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.