WEBVTT

00:00:01.540 --> 00:00:02.090
Hello.

00:00:02.100 --> 00:00:05.760
I'm Matt Glass, and welcome to this course on Lateral Movement with PsExec.

00:00:06.740 --> 00:00:10.430
In this course, I'll show you how to use PsExec to execute commands,

00:00:10.520 --> 00:00:11.320
programs,

00:00:11.500 --> 00:00:14.810
and open up command shells on remote Windows workstations

00:00:14.970 --> 00:00:17.150
using a host you already exploited.

00:00:18.040 --> 00:00:21.970
But first, let's look at what PsExec is and how it's used.

00:00:22.440 --> 00:00:26.230
PsExec is a tool that was created by Mark Russinovich as

00:00:26.230 --> 00:00:29.070
part of the suite of tools called PsTools.

00:00:29.440 --> 00:00:33.560
This tool suite contains multiple remote administration tools executed from

00:00:33.560 --> 00:00:36.550
the command prompt on Windows servers and workstations.

00:00:37.040 --> 00:00:39.160
Although hackers can misuse these tools,

00:00:39.280 --> 00:00:43.160
they're very valuable as remote administration tools in a Windows environment.

00:00:43.540 --> 00:00:46.420
I use them frequently throughout my career to patch systems,

00:00:46.430 --> 00:00:50.350
run commands, and gather information from devices that I administered.

00:00:51.040 --> 00:00:55.660
PsExec is specifically designed to execute processes on remote machines.

00:00:56.340 --> 00:00:58.550
The only prerequisite is that you have sufficient

00:00:58.550 --> 00:01:00.750
permissions to execute those processes,

00:01:01.140 --> 00:01:04.590
which is why PsExec is used for lateral movement and not

00:01:04.590 --> 00:01:07.170
initial access or privilege escalation.

00:01:07.640 --> 00:01:11.750
You can obtain PsExec by downloading the PsTools suite from Microsoft.

00:01:12.340 --> 00:01:15.670
PsExec's main advantage as a remote administration tool,

00:01:15.770 --> 00:01:19.520
and for lateral movement, is that you can execute these processes,

00:01:19.530 --> 00:01:20.530
run programs,

00:01:20.680 --> 00:01:23.590
or open command prompts in remote workstations without

00:01:23.590 --> 00:01:25.360
installing any additional software.

00:01:25.940 --> 00:01:29.310
You only have to run the command from the exploited workstation

00:01:29.320 --> 00:01:32.570
against other Windows machines that you want to access.

00:01:33.440 --> 00:01:37.130
On the kill chain, PsExec falls under lateral movement only.

00:01:37.130 --> 00:01:40.380
It's not used for exploitation, escalation,

00:01:40.390 --> 00:01:44.210
or any functions beyond the lateral movement. This is due to that

00:01:44.210 --> 00:01:47.260
requirement for their permissions to execute against the system.

00:01:47.740 --> 00:01:49.900
The ATT&CK knowledge base, developed by MITRE,

00:01:49.910 --> 00:01:53.370
categorizes adversary tactics and techniques into multiple

00:01:53.370 --> 00:01:55.870
categories to describe the adversary's behavior.

00:01:56.440 --> 00:01:59.420
The tactics are categories that cover different phases of an

00:01:59.420 --> 00:02:03.260
attack and allow defensive teams to model an adversary's actions

00:02:03.270 --> 00:02:05.550
and improve the defense of their networks.

00:02:06.040 --> 00:02:07.570
We will cover two techniques,

00:02:08.039 --> 00:02:12.450
one under the lateral movement tactic and one under the execution tactic.

00:02:13.340 --> 00:02:17.750
The first technique that PsExec can be used for is remote services. In

00:02:17.750 --> 00:02:21.320
particular, the sub‑technique for Windows admin shares.

00:02:21.320 --> 00:02:23.950
The other technique is system services,

00:02:24.640 --> 00:02:27.760
in particular the sub‑technique for service execution.

00:02:29.140 --> 00:02:32.980
PsExec can accomplish this by enabling adversaries who have already

00:02:32.980 --> 00:02:36.590
exploited a Windows machine and gained sufficient privileges to

00:02:36.590 --> 00:02:38.450
move laterally throughout the network.

00:02:39.340 --> 00:02:43.520
They could use PsExec to open command prompts on other Windows workstations,

00:02:43.650 --> 00:02:45.370
and obtain information from them.

00:02:46.240 --> 00:02:49.870
Or, if they had sufficient privileges from the exploited user,

00:02:50.340 --> 00:02:54.360
they could use PsExec to access Windows servers in the datacenter.

00:02:54.940 --> 00:02:57.780
PsExec allows hackers to start processes,

00:02:58.010 --> 00:02:59.120
run programs,

00:02:59.260 --> 00:03:02.600
or open command prompts on any system they can access with the

00:03:02.600 --> 00:03:06.550
credentials they obtained through exploit and privilege escalation

00:03:06.560 --> 00:03:09.550
without installing any additional software.