What this lab taught me
Key takeaway: A reliable assessment depends on manual enumeration, validating assumptions with evidence, and translating the resulting attack path into a concrete detection or prevention opportunity. The technical detail below is documented only for the authorized lab environment.
Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
In this lab, we will employ macros in ODT files uploaded to a resume web form to gain a foothold. We will then migrate to the apache user and abuse the SeImpersonatePrivilege permission to elevate our privileges. This lab focuses on exploiting document vulnerabilities and privilege escalation techniques.
Scenario
This lab demonstrates using a VBA macro in an ODT file to gain initial access to a Windows system via a vulnerable resume upload form. Learners will escalate privileges by uploading a PHP web shell to compromise the apache user. The final escalation leverages the SeImpersonatePrivilege permission with the PrintSpoofer tool to execute commands as SYSTEM. This lab highlights code execution via macros, PHP shell deployment, and privilege escalation using impersonation privileges.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services and identify a web application with a vulnerable file upload form.
- Exploit the resume upload form by embedding a VBA macro in an ODT file for remote code execution.
- Use the obtained shell to upload and execute a PHP web shell for further access as the apache user.
- Identify the enabled SeImpersonatePrivilege permission for privilege escalation.
- Use the PrintSpoofer tool to escalate privileges and obtain SYSTEM access.
Key takeaway
Common real-world consideration: The weakness explored here becomes more consequential when it is combined with weak identity controls, excessive permissions, missing patches, or insufficient monitoring. Defense-in-depth is what breaks that chain.
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.