> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/arctic.md).

# Arctic

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-887e7e4a1a9a7ad1bb80f47f57502dd4104de495%2Fimage.png?alt=media)

### ColdFusion

When we visit port 8500, we see this:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f13a7a25cafa3da0492e02804be48f2ca4f95fc7%2Fimage.png?alt=media)

Adobe ColdFusion 8 is vulnerable to a lot of exploits.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-74d6c40f972cdeaa632ac169ca247f39ba2e1635%2Fimage.png?alt=media)

We can use the Adobe ColdFusion 8 RCE exploit. When running the exploit, we would catch a shell on a listener port we set.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8580698d3b0138984a5db2ca7e1b3175c3f88a91%2Fimage.png?alt=media)

## Privilege Escalation

### Chimichurri

Checking the privileges we have, we can see that we have SeImpersonatePrivilege enabled.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3fba05a05939b7960b128b491092722cae315712%2Fimage.png?alt=media)

We can also use `wesng.py` to find possible vulnerabilities for this machine. This would reveal that the machine is vulnerable to MS10-059. We can use the Chimicurri exploit for this.

{% embed url="<https://github.com/egre55/windows-kernel-exploits/tree/master/MS10-059:%20Chimichurri/Compiled>" %}

We can execute it to gain a shell as the administrator.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-43fdd73991fb2a72e1c4b7c58d79d18412e5d95e%2Fimage.png?alt=media)