WEBVTT

00:00:01.040 --> 00:00:01.630
Hey there.

00:00:01.640 --> 00:00:06.930
Welcome to our lab environment. I have here a Windows 2016 machine, which is

00:00:06.930 --> 00:00:12.090
part of the Globomantics domain. As you can see, I'm logged in as Kenny, which

00:00:12.090 --> 00:00:16.890
is a domain user. In here, we're simulating that you got access to machine in

00:00:16.890 --> 00:00:20.830
a company and you're trying to discover information about the machine and the

00:00:20.830 --> 00:00:24.610
environment so that you can move laterally and execute any actions that you

00:00:24.610 --> 00:00:25.460
might have in mind.

00:00:26.340 --> 00:00:32.680
So, let's get started. Let's go to the Seatbelt GitHub. In here, we can

00:00:32.680 --> 00:00:37.470
download the whole repository by going to the button Code and then going to the

00:00:37.470 --> 00:00:43.590
option Download ZIP. Once the download is completed, we can open the file and

00:00:43.590 --> 00:00:46.060
then extract the folder to whatever you want.

00:00:46.740 --> 00:00:49.850
I've already downloaded and extracted the files to my desktop, so

00:00:49.860 --> 00:00:53.490
let's take a look at them. As you might have noted,

00:00:53.530 --> 00:00:59.030
we have here the source code of this tool, which is written in C#, so we need

00:00:59.030 --> 00:01:03.500
to compile the source code to be able to execute this. And for that, I already

00:01:03.500 --> 00:01:07.750
have on this machine the Visual Studio software. It is free to use, so you can

00:01:07.750 --> 00:01:09.360
download and install it in your system.

00:01:10.240 --> 00:01:17.110
So, let's open the Visual Studio project file. Done. As you can see,

00:01:17.120 --> 00:01:19.560
I have here all the source code for this tool.

00:01:20.140 --> 00:01:23.560
I could even customize it if I wanted, but let's just compile

00:01:23.560 --> 00:01:27.780
the code as it is. For that, I'll go to the menu Build and then

00:01:27.790 --> 00:01:32.510
Build Solution. Amazing. Now, we just have to wait a couple of

00:01:32.510 --> 00:01:35.160
seconds, and there we go.

00:01:35.170 --> 00:01:39.370
We have success here in the Output screen. As you can see, the

00:01:39.370 --> 00:01:43.690
executable is saved under the folder bin and then Debug, so let's

00:01:43.690 --> 00:01:49.560
go to that folder. Seatbelt\bin\Debug.

00:01:51.140 --> 00:01:51.830
Here you go.

00:01:51.840 --> 00:01:55.510
The Seatbelt executable is here. To make things easier, I will move this

00:01:55.510 --> 00:01:58.360
file to our desktop so we can easily find the tool.

00:01:59.740 --> 00:02:03.640
Also, quick pause here. In this demo, I'm using my victim machine to

00:02:03.640 --> 00:02:07.550
compile the code just to make things easier. In a red team

00:02:07.550 --> 00:02:10.570
engagement, I would recommend you using another Windows machine to

00:02:10.570 --> 00:02:14.570
download and compile the code and then only transfer the executable

00:02:14.570 --> 00:02:15.750
to your victim computer.

00:02:16.740 --> 00:02:19.350
In this way, you don't need to download a lot of files and

00:02:19.350 --> 00:02:22.530
install Visual Studio in your victim, you only need to

00:02:22.530 --> 00:02:24.160
transfer one executable file.

00:02:24.740 --> 00:02:27.440
Okay, now that I have the executable file on my desktop,

00:02:27.450 --> 00:02:34.420
I can open the terminal, go to my desktop, and then run Seatbelt.exe.

00:02:36.140 --> 00:02:41.300
And this will ensure that executable is working fine. Awesome, we got to help

00:02:41.300 --> 00:02:45.290
page for the tool, and this means that executable is working and ready to be

00:02:45.290 --> 00:02:48.400
used. As you can see here in this help page,

00:02:48.410 --> 00:02:51.790
the tool has several modules to collect any kind information you can

00:02:51.790 --> 00:02:56.020
imagine. So in the next demos, we'll use some of those modules to

00:02:56.020 --> 00:02:58.550
discover sensitive information about this server.