WEBVTT

00:00:01.240 --> 00:00:05.100
In this last demo, I want to show you one more cool feature of Seatbelt.

00:00:05.100 --> 00:00:09.560
So far, we're collecting information about the local machine that I was using,

00:00:10.140 --> 00:00:14.160
but we can actually collect information from remote machines with this tool.

00:00:14.940 --> 00:00:15.720
Yes, that's right.

00:00:15.730 --> 00:00:18.260
We don't even need to copy the executable to a machine.

00:00:18.740 --> 00:00:21.120
If we have the credentials to log into a computer,

00:00:21.130 --> 00:00:23.260
we can discover information remotely.

00:00:24.140 --> 00:00:27.650
And that's really good because we can leave zero footprint on the server,

00:00:28.040 --> 00:00:31.550
and the chance of getting caught by the antivirus is reduced because

00:00:31.550 --> 00:00:33.760
nothing is saved on the disk of the remote machine.

00:00:34.640 --> 00:00:38.400
It is important to note that not all modules can be executed remotely.

00:00:38.400 --> 00:00:40.140
If you run Seatbelt,

00:00:40.150 --> 00:00:43.690
we'll get the help page. And see those modules here with the plus

00:00:43.690 --> 00:00:47.540
sign beside it? Those are the modules that can be executed remotely.

00:00:47.540 --> 00:00:52.800
For example, we can remotely collect the local users of a server. And

00:00:52.800 --> 00:00:54.460
to do that, it's really simple.

00:00:55.140 --> 00:00:59.060
I'll use Seatbelt, then the module that I want to use,

00:00:59.730 --> 00:01:01.460
and then another few variables here.

00:01:02.440 --> 00:01:05.850
First, computername in which we define the IP of the

00:01:05.850 --> 00:01:07.260
computer that I want to enumerate.

00:01:08.240 --> 00:01:11.030
Then, I'll use the flag ‑username to define the user that I

00:01:11.030 --> 00:01:14.780
want to use to log into the machine. In here, it is important

00:01:14.780 --> 00:01:16.560
to specify the domain of the user.

00:01:17.740 --> 00:01:22.470
Then, I use the flag ‑password to input the password of this user. As we

00:01:22.470 --> 00:01:25.790
can see, we have a really secure password. And that's it.

00:01:25.800 --> 00:01:29.230
Once I run this, it will execute the LocalUsers module in the remote

00:01:29.230 --> 00:01:34.710
server. Take a look. We have here some interesting usernames, like this

00:01:34.720 --> 00:01:37.850
Oracle user and a few other Microsoft SQL users.

00:01:39.140 --> 00:01:42.530
And remember, we can remotely run any of the modules that have a

00:01:42.530 --> 00:01:46.630
plus sign beside their name, like we can enumerate all the RDP

00:01:46.630 --> 00:01:50.620
sessions to a server by just using the exact same module, but

00:01:50.620 --> 00:01:54.250
with the flags computername, username, and password.

00:01:56.140 --> 00:01:57.740
Easy, right? Also,

00:01:57.750 --> 00:02:01.160
if you want to run all the modules that support remote execution,

00:02:01.170 --> 00:02:02.160
it is really easy.

00:02:02.540 --> 00:02:09.639
We just have to use the command Seatbelt, then ‑group=remote, and this will

00:02:09.639 --> 00:02:14.650
tell the tool to run every module that supports remote access. And again, we

00:02:14.650 --> 00:02:21.080
have to use the computername, username, and password flags as those will

00:02:21.080 --> 00:02:23.090
collect a huge amount of information.

00:02:23.100 --> 00:02:26.960
I will save the output to a file called remote.txt.

00:02:28.740 --> 00:02:31.470
Once I press Enter, the Seatbelt tool will connect to the

00:02:31.470 --> 00:02:33.860
remote server and start to collect information.

00:02:34.540 --> 00:02:37.330
As in here, we are discovering information over a network.

00:02:37.340 --> 00:02:40.270
This might take a little while, but to save you some time,

00:02:40.280 --> 00:02:45.000
I'll speed up this video. Then, after a couple of

00:02:45.000 --> 00:02:46.670
minutes, the execution is completed.

00:02:46.750 --> 00:02:49.260
So, let's take a look at the output file.

00:02:50.940 --> 00:02:51.490
Perfect.

00:02:51.490 --> 00:02:52.950
We have a lot of information here.

00:02:53.540 --> 00:02:53.850
Again,

00:02:53.850 --> 00:02:56.640
this might be a little bit overwhelming, but we got some good

00:02:56.640 --> 00:03:00.340
information in here, like the fact that the remote server is missing

00:03:00.340 --> 00:03:04.140
some hotfixes, and this means that this server might have some

00:03:04.200 --> 00:03:05.960
vulnerabilities that we could try to exploit.

00:03:07.540 --> 00:03:12.080
Also, we have here the list of accounts in the Administrators group, and

00:03:12.080 --> 00:03:15.070
this could be interesting because we could try to hack into one of those

00:03:15.070 --> 00:03:17.750
Microsoft SQL accounts or Oracle accounts.

00:03:18.640 --> 00:03:21.850
Those are good candidates because if you get access to them,

00:03:21.860 --> 00:03:25.080
we have full access to the domain. Anyways,

00:03:25.090 --> 00:03:26.770
that is a lot of information here.

00:03:26.780 --> 00:03:28.360
There are over 3000 lines.

00:03:29.040 --> 00:03:30.710
So, in a red team engagement,

00:03:30.720 --> 00:03:33.760
take your time to review this output and I'm sure you'll find interesting

00:03:33.760 --> 00:03:36.360
information that will help you in your red team engagement.