# Arctic

## Gaining Access

Nmap scan:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/rJLowuoaMRyWDGSHHIRc/image.png" alt=""><figcaption></figcaption></figure>

### ColdFusion

When we visit port 8500, we see this:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/osm07y4y3ouej09w4IP0/image.png" alt=""><figcaption></figcaption></figure>

Adobe ColdFusion 8 is vulnerable to a lot of exploits.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/jjPXbzXr2lBHPeO9GCQm/image.png" alt=""><figcaption></figcaption></figure>

We can use the Adobe ColdFusion 8 RCE exploit. When running the exploit, we would catch a shell on a listener port we set.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/ggMVDUxSkzgTOTTr5Ik0/image.png" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

### Chimichurri

Checking the privileges we have, we can see that we have SeImpersonatePrivilege enabled.

&#x20;

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/SxriaWxWs0cFA4VbON30/image.png" alt=""><figcaption></figcaption></figure>

We can also use `wesng.py` to find possible vulnerabilities for this machine. This would reveal that the machine is vulnerable to MS10-059. We can use the Chimicurri exploit for this.

{% embed url="https://github.com/egre55/windows-kernel-exploits/tree/master/MS10-059:%20Chimichurri/Compiled" %}

We can execute it to gain a shell as the administrator.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/AxjgYF9fqQQr67dpSRCi/image.png" alt=""><figcaption></figcaption></figure>
