Mice: Proving Grounds Windows Walkthrough

Nmap output

Nmap scan report for 192.168.181.199
Host is up (0.061s latency).
Not shown: 65531 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE        VERSION
1978/tcp open  remotemouse    Emote Remote Mouse
1980/tcp open  pearldoc-xact?
3389/tcp open  ms-wbt-server  Microsoft Terminal Services
|_ssl-date: 2025-10-23T10:00:10+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=Remote-PC
| Issuer: commonName=Remote-PC
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-10-22T09:55:27
| Not valid after:  2026-04-23T09:55:27
| MD5:   fe7b:8fc8:3358:20e5:098a:8426:990e:6664
|_SHA-1: 1ef7:375d:18ce:ecbe:db4c:1843:19c6:7122:cf81:4686
| rdp-ntlm-info: 
|   Target_Name: REMOTE-PC
|   NetBIOS_Domain_Name: REMOTE-PC
|   NetBIOS_Computer_Name: REMOTE-PC
|   DNS_Domain_Name: Remote-PC
|   DNS_Computer_Name: Remote-PC
|   Product_Version: 10.0.19041
|_  System_Time: 2025-10-23T09:59:56+00:00
7680/tcp open  pando-pub?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

We have remote mouse running on port 1978. Using https://github.com/p0dalirius/RemoteMouse-3.008-Exploit this exploit to download nc on remote machine

Mice walkthrough, Got reverse shell, screenshot 1 — Mice, step 1

Running the nc command to get reverse shell

Got reverse shell

Got local.txt (d1c13c0821ed56d35d8b3df4a96fbfac)

Mice walkthrough, Got reverse shell, screenshot 4 — Mice, step 4

Got encoded password for divine user in recentservers.xml file

Mice walkthrough, Got reverse shell, screenshot 5 — Mice, step 5

Used creds to RDP into machine

Mice walkthrough, Got reverse shell, screenshot 6 — Mice, step 6

Following https://www.exploit-db.com/exploits/50047 LPE. Click preferences

Mice walkthrough, Got reverse shell, screenshot 7 — Mice, step 7

Then click Setting > Change

Mice walkthrough, Got reverse shell, screenshot 8 — Mice, step 8

Then enter cmd in address bar

Mice walkthrough, Got reverse shell, screenshot 9 — Mice, step 9

We got cmd spawned as administrator

Mice walkthrough, Got reverse shell, screenshot 10 — Mice, step 10

Got proof.txt (e3b407950643d29e9646a9a7587bd409 )

Mice walkthrough, Got reverse shell, screenshot 11 — Mice, step 11

More walkthroughs

AlgernonWindows

Full walkthrough of the Algernon box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.

AuthbyWindows

Full walkthrough of the Authby box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 242/http, 3145/zftp-admin, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.

CraftWindows

Full walkthrough of the Craft box on Offensive Security Proving Grounds (Windows). Enumeration across 80/http. Foothold to root using evil-winrm, kerberoasting, winpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.