The wireless network is now becoming an important infrastructure for most enterprises, and many employees are even allowed to use mobile devices to work. However, the dependence on wireless network may lead to many security risks. In our recent research, we found a new way to exploit these Windows devices.In this talk, I will introduce a combined attack that using the feature of the captive portal on wireless network and a series of vulnerabilities of Windows to gain RCE. First, it will set up a hotspot with evil captive portal service. Once a victim connects to the hotspot actively or passively and detects the captive portal, the NTLM credentials of the victim will be relay to get access to Exchange Web Services. Then using the API of EWS and vulnerabilities of Outlook client, I can achieve RCE.Advantage: - No need to crack the credentials. - Can attack multiple targets at the same time. - With the feature of fake AP and captive portal, the exploitation is covertness.