Arctic

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Arctic (Windows, attack surface: Microsoft Windows RPC (135), Microsoft Windows RPC (49154), fmtp? (8500)). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.11 --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Windows.
• Open services: fmtp? (8500), msrpc (135), msrpc (49154).
• Scan used: nmap -p- -sVC 10.10.10.11 --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.11 --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-27 21:26 PDT
Stats: 0:01:38 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 78.74% done; ETC: 21:29 (0:00:26 remaining)
Nmap scan report for 10.10.10.11
Host is up (0.030s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT      STATE SERVICE VERSION
135/tcp   open  msrpc   Microsoft Windows RPC
8500/tcp  open  fmtp?
49154/tcp open  msrpc   Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 256.03 seconds

1. Based from the nmap results, the machine runs Windows Remote Procedure Call (RPC) and an unknown service at port 8500.

2. Interesting! Accesing port 8500 shall resulting to this:

3. But noticed we got info there.

4. It seems prt 8500 is running Coldfusion webserver.

Privilege Escalation

User -> Root/Admin

Recovered the ColdFusion administrator password from password.properties, then used the admin session to deploy a ColdFusion task/CFML payload that ran as an elevated user.

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.