Since the web shell runs as the SYSTEM user, an attacker can fetch the NT LAN Manager (NTLM) hashes of the logged-in users, create or delete accounts, and perform extensive post-exploitation activities on the Exchange Server.      Figure - Executing Mimikatz as SYSTEM using CC      Fig - System Owner User Discovery     The above event was triggered when we ran whoami from within the Chopper web shell.