Steel Mountain TryHackMe Walkthrough

TL;DR: initial RCE on HttpFileServer 2.3 (port 8080) → netcat reverse shell as Bill → upgrade to Meterpreter → run PowerUp → exploit service with weak permissions (Advanced System Care) by overwriting ASCService.exe → get NT AUTHORITY\SYSTEM and grab user.txt / root.txt.

Why this room is useful

• Great demo of chaining a public RCE exploit into a practical Windows privilege escalation.

• Shows real-world patterns: vulnerable third-party services, weak file perms, and using certutil to transfer tools.

Key steps (short):

1. nmap -> ports 80, 8080, 445, 135, 3389 (Win Server 2008 R2).

2. Inspect web on port 80 → find username (Bill).

3. Exploit HttpFileServer 2.3 on 8080 (public RCE exploit) to force target to download and run nc.exe.

4. Catch reverse shell (nc -lvp 4545).

5. Host PowerUp.ps1 and other tools via Python webserver; download with certutil.exe.

6. Generate Meterpreter payload with msfvenom, run multi/handler, upgrade to Meterpreter.

7. Run Invoke-AllChecks (PowerUp) → find vulnerable ASCService.exe with writable perms.

8. Overwrite service executable with crafted Meterpreter exe, restart service → SYSTEM.

9. Read user.txt and root.txt.

Continue reading here