WEBVTT 00:00:01.440 --> 00:00:03.150 Welcome back to our lab environment. 00:00:03.160 --> 00:00:06.960 Now that we have the Seatbelt ready, let's begin doing some discovery. 00:00:07.540 --> 00:00:10.090 Let's start by doing some basic information gathering. 00:00:10.100 --> 00:00:14.250 Let's use Seatbelt to get information about this local machine. 00:00:14.250 --> 00:00:20.730 For that, I'll type Seatbelt.exe, and then OSInfo. 00:00:20.730 --> 00:00:25.520 As you can see here, I have some information about this operating system, 00:00:25.520 --> 00:00:27.750 like what is the Windows version and even the 00:00:27.750 --> 00:00:29.560 specific release that is installed. 00:00:30.440 --> 00:00:33.210 And this can be really useful to exploit vulnerabilities in the 00:00:33.210 --> 00:00:35.750 operating system so we can try to escalate privileges. 00:00:36.740 --> 00:00:39.110 I also have here some other cool information, 00:00:39.320 --> 00:00:43.160 like the fact that this is a virtual machine in the time zone of my server. 00:00:44.340 --> 00:00:47.960 All right, now, let's get some information about the users in this machine. 00:00:48.640 --> 00:00:51.460 Let's use the Seatbelt module called LocalUsers. 00:00:53.740 --> 00:00:56.960 Then, take a look, we have here only three local users, 00:00:57.140 --> 00:01:00.460 the Administrator, the DefaultAccount, and a Guest account. 00:01:01.040 --> 00:01:04.069 We can even see the last time they changed their password and 00:01:04.080 --> 00:01:05.860 the last time they logged into the system. 00:01:06.940 --> 00:01:09.760 Now, let's say that I want to save that information in a file. 00:01:10.240 --> 00:01:10.770 No problem. 00:01:10.770 --> 00:01:11.630 That's really easy. 00:01:11.640 --> 00:01:13.440 I just have to run the same command, 00:01:13.660 --> 00:01:18.820 but with the flag ‑outputfile and then the name of the file that I want to save. 00:01:18.820 --> 00:01:22.610 In my case, I will call it local‑users.txt. 00:01:22.610 --> 00:01:27.260 Once I run this, all the output is saved into a file. 00:01:28.240 --> 00:01:30.860 So, let me open this file to show you the result. 00:01:30.860 --> 00:01:32.440 As you can see here, 00:01:32.440 --> 00:01:35.260 we have exactly the same information that we had in the terminal. 00:01:36.640 --> 00:01:40.060 All right, let's say that now I want to know what is installed on this machine, 00:01:40.640 --> 00:01:42.650 and again, with Seatbelt that's really easy. 00:01:43.040 --> 00:01:48.260 We use Seatbelt.exe and then the module InstalledProducts. 00:01:49.440 --> 00:01:50.390 And once I run this, 00:01:50.510 --> 00:01:53.850 Seatbelt will list all the installed software in this machine. 00:01:54.740 --> 00:01:56.860 As we can see, we have a lot of stuff in here, 00:01:57.240 --> 00:02:01.310 like the 7‑Zip software, Visual Studio, Google Chrome, 00:02:01.320 --> 00:02:02.060 and much more. 00:02:02.740 --> 00:02:04.800 And actually, talking about Google Chrome, 00:02:04.810 --> 00:02:06.660 since we have it installed on this machine, 00:02:06.670 --> 00:02:09.060 let's do some discovery related to this browser. 00:02:09.840 --> 00:02:13.560 Let's say I want to know all the websites that were accessed in the last days. 00:02:14.340 --> 00:02:15.330 That's really easy. 00:02:15.340 --> 00:02:19.460 We'll use Seatbelt with a module called ChromiumHistory. 00:02:22.240 --> 00:02:25.090 Then, as you can see here, I have all my history, 00:02:25.100 --> 00:02:29.110 like the GitHub page I accessed today and even the Google search I made. 00:02:29.110 --> 00:02:30.460 Pretty cool, right? 00:02:30.620 --> 00:02:32.360 Now you know why I love this tool. 00:02:33.040 --> 00:02:34.320 And this is just the beginning. 00:02:34.330 --> 00:02:36.800 There are literally dozens of modules in this tool, 00:02:36.800 --> 00:02:39.600 and the reality is it would take me hours to go through one by one. 00:02:40.740 --> 00:02:43.560 But, let me show you another cool thing you can do here. 00:02:43.560 --> 00:02:45.770 Instead of running module by module manually, 00:02:45.770 --> 00:02:48.750 we can use module groups to run several modules at once. 00:02:49.540 --> 00:02:52.280 For example, let's say you want to execute all the modules 00:02:52.280 --> 00:02:56.300 related to users, like enumerating users, enumerating groups, 00:02:56.310 --> 00:02:58.450 collecting browser history, etc. 00:02:59.040 --> 00:03:00.330 That's really easy to do that. 00:03:00.510 --> 00:03:07.000 I just have to use Seatbelt with the flag ‑group and then ‑user, and this 00:03:07.000 --> 00:03:09.760 will tell the tool to use other user‑related modules. 00:03:11.640 --> 00:03:14.610 As we can see here, we've got a lot of information, and if 00:03:14.610 --> 00:03:17.310 you're using this tool for the first time, all this information 00:03:17.310 --> 00:03:18.660 might be a little bit overwhelming. 00:03:19.040 --> 00:03:22.550 So, take your time to review all the data and try to understand what it's 00:03:22.550 --> 00:03:27.670 used for. In this case here, we got some interesting information. For 00:03:27.670 --> 00:03:32.020 example, we even got the password hash for this user that I'm using, and 00:03:32.020 --> 00:03:35.560 this can be useful in case I hacked into a computer and I don't know the 00:03:35.560 --> 00:03:36.960 password of the current user. 00:03:37.440 --> 00:03:41.340 I can simply use any password cracking tool to crack this hash and 00:03:41.340 --> 00:03:45.790 get a plaintext password. Now, similar to the user‑related modules, 00:03:45.790 --> 00:03:47.760 we have the system‑related modules. 00:03:48.440 --> 00:03:49.660 Let's take a quick look at them. 00:03:50.440 --> 00:03:53.970 I'll use the same command with the ‑group flag, but now with 00:03:53.970 --> 00:03:59.860 the system related modules. And after a few seconds, we got 00:03:59.870 --> 00:04:01.460 tons of information about the system. 00:04:01.940 --> 00:04:04.990 I will let you explore every single option on your own, but let me 00:04:04.990 --> 00:04:08.790 show you some interesting data here, like we can see that this 00:04:08.790 --> 00:04:12.710 machine has Windows Defender enabled, so you can plan your attacks 00:04:12.710 --> 00:04:14.260 to try to bypass this product. 00:04:14.840 --> 00:04:19.110 Also, we have here the DNS cache, which can be useful to understand what the 00:04:19.110 --> 00:04:21.950 machine does and how we relate it to the our machines. 00:04:23.740 --> 00:04:26.070 We also have here some interesting processes. 00:04:26.110 --> 00:04:29.620 Again, the Windows Defender process is running, so you need to be 00:04:29.620 --> 00:04:31.750 careful when executing any malicious payload. 00:04:33.140 --> 00:04:37.460 Also, we can see here some of the network shares of the server and 00:04:37.460 --> 00:04:42.180 even we can see who is connected to this machine using RDP. For 00:04:42.180 --> 00:04:45.460 example, we can see here that we have a Remote Desktop connection 00:04:45.470 --> 00:04:47.250 from my laptop to this machine. 00:04:48.140 --> 00:04:51.380 And this can be good to understand if there's anyone currently working at the 00:04:51.380 --> 00:04:56.590 machine. In a real red team engagement, it is a good idea to wait until no one 00:04:56.590 --> 00:05:01.130 is in the server to start to attack it. Anyway, that's a lot of information 00:05:01.130 --> 00:05:05.850 here, and I'll let you explore that on your own. But wait, if you think that's 00:05:05.850 --> 00:05:09.690 a lot of information, let me show you something. You can use Seatbelt with the 00:05:09.690 --> 00:05:16.750 option ‑group=all, and this will execute every single module of this tool. And 00:05:16.750 --> 00:05:20.980 for that, I will also use the flag ‑full so all the results are fully shown. 00:05:20.980 --> 00:05:25.030 And, as this will generate a lot of information, I will save the output into a 00:05:25.030 --> 00:05:32.340 file name discovery‑all.txt. Once I run this, Seatbelt will execute every 00:05:32.340 --> 00:05:35.060 single module and save the result into the file. 00:05:37.040 --> 00:05:42.370 Once this is done, we can check the output file. As we can see here, we have a 00:05:42.370 --> 00:05:45.550 lot of information and it would be impossible to review the whole file 00:05:45.550 --> 00:05:49.960 together. We have here over 13,000 lines of information. 00:05:50.740 --> 00:05:51.710 And as you can imagine, 00:05:51.710 --> 00:05:54.700 this tool was able to collect pretty much everything you could 00:05:54.700 --> 00:05:57.960 collect from environment variables to password hashes.