HTB Logging Complete Writeup - CVE-2025-59287, Shadow Credentials & WSUS MITM
Logging is a HackTheBox Season 10 Medium Windows machine centered around a Domain Controller running Windows Server Update Services (WSUS). The exploitation chain begins with CVE-2025-59287, an unauthenticated unsafe deserialization vulnerability in WSUS that grants remote code execution without any credentials. Credentials for svc_recovery are then discovered in an SMB log file, which after Kerberos-only authentication and clock synchronization are used to abuse GenericAll rights over the msa_health$ Managed Service Account via shadow credentials. A shell is obtained as msa_health$, from which a DLL hijack against a scheduled monitoring task yields lateral movement to jaylee.clifton. The privilege escalation pivots through a DNS spoofing attack that redirects the DC's WSUS client to a fake WSUS server, delivering a malicious executable that runs as SYSTEM.
Apr 19, 2026