Kevin Writeup - Proving Grounds
Created October 8, 2026 • Last updated October 8, 2026 • 3 min read
Kevin runs HP Power Manager 4.2 on port 80, reachable with the public default credentials admin:admin. Version 4.2 Build 7 has a pre-auth stack buffer overflow (CVE-2009-2685) that lands a shell directly as SYSTEM, no privilege escalation step needed.
Reconnaissance
Nmap
Scan all ports, then fingerprint the open ones.
PORT STATE SERVICE VERSION 80/tcp open http GoAhead WebServer |_http-title: HP Power Manager 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows 7 Ultimate N 7600 (workgroup: WORKGROUP) 3389/tcp open tcpwrapped 3573/tcp open tag-ups-1? Service Info: Host: KEVIN; OS: Windows
Port 80 serves HP Power Manager on a GoAhead WebServer, on a Windows 7 Ultimate host. Log in and check the version.
Enumeration
HP Power Manager login
The application accepts the publicly documented default credentials.
Logging in with admin:admin and checking the Help page shows HP Power Manager 4.2 (Build 7), a version with a known pre-auth remote buffer overflow.
Exploitation
Universal buffer overflow (CVE-2009-2685)
A public Python exploit (Exploit-DB 10099) targets the formLogin handler. Confirm it is listed, then build matching shellcode.
HP Power Manager - 'formExportDataLogs' Remote Buffer Overflow (Metasploit) | exploits/cgi/remote/18015.rb Hewlett-Packard (HP) Power Manager Administration - Remote Buffer Overflow | exploits/windows/remote/16785.rb Hewlett-Packard (HP) Power Manager Administration Power Manager - Buffer Overflow | exploits/windows/remote/10099.py
Generate alphanumeric shellcode that avoids the exploit's bad characters and the n00bn00b egg the public exploit searches for.
Found 1 compatible encoder x86/alpha_mixed succeeded with final size 710 Payload size: 710 bytes
Explain command
| -b | Bad characters the shellcode must avoid, taken from the app's known-bad byte list. |
Drop the generated shellcode into the public exploit's SHELL buffer alongside the n00bn00b egg, a JMP ESP return address in MSVCP60.dll, and a NOP sled, then send the crafted formLogin POST request.
[+] Sending evil buffer... HTTP/1.0 200 OK [+] Done!
The listener catches a shell directly as NT AUTHORITY\SYSTEM, since the HP Power Manager service itself runs with SYSTEM privileges.
nt authority\system
Related
References
-
HP Power Manager Administration universal buffer overflow exploit.
-
HP Power Manager Administration remote buffer overflow.