WEBVTT 00:00:01.140 --> 00:00:03.350 Now that we have some background on PsExec, 00:00:03.740 --> 00:00:06.480 it's time to dive into the demos and get some practical 00:00:06.480 --> 00:00:09.090 experience using it for a lateral movement. 00:00:09.090 --> 00:00:10.490 In this demo, 00:00:10.500 --> 00:00:14.040 we'll be getting started with PsExec by copying it to a 00:00:14.040 --> 00:00:17.130 Windows host we exploited and then exploring the available 00:00:17.130 --> 00:00:18.850 options and command structure. 00:00:19.740 --> 00:00:21.650 Let's first head over to the lab and take a quick 00:00:21.650 --> 00:00:24.570 look at the environment I'm using, and then we'll get started. 00:00:24.570 --> 00:00:28.850 For this course, I've set up two hosts that are running VMware ESXi, 00:00:29.030 --> 00:00:30.850 each with three virtual machines on them. 00:00:31.790 --> 00:00:34.340 This first one is just running the domain controller for 00:00:34.340 --> 00:00:35.970 the small Windows domain I created, 00:00:36.150 --> 00:00:39.380 and a Windows 2016 server that we can use as one of the targets. 00:00:40.140 --> 00:00:42.550 I also have a Kali Linux workstation, which will be 00:00:42.550 --> 00:00:44.910 providing PsExec to our target host. 00:00:45.720 --> 00:00:48.620 On the other VMware host, I have three work stations, 00:00:48.630 --> 00:00:51.350 one running Windows 7 and two Windows 10 hosts. 00:00:52.040 --> 00:00:56.150 The Windows 7 workstation will serve as the exploited host for this environment. 00:00:57.440 --> 00:01:01.380 You can follow along in this course as long as you have one host to run PsExec 00:01:01.380 --> 00:01:05.630 commands from and a target host to run them against. For the ease of 00:01:05.630 --> 00:01:09.590 demonstration with this course, I've opened up a remote desktop on this Windows 00:01:09.590 --> 00:01:13.090 7 host to simulate that I've accessed it with the global admin credentials 00:01:13.100 --> 00:01:15.350 using some kind of exploit beforehand. 00:01:16.520 --> 00:01:17.110 In reality, 00:01:17.110 --> 00:01:20.250 you'd likely have a shell or some other form of access, but 00:01:20.250 --> 00:01:22.100 since this course is focused on PsExec, 00:01:22.170 --> 00:01:24.440 I'm trying to make the environment as ideal as 00:01:24.440 --> 00:01:26.850 possible to simulate PsExec for you. 00:01:27.840 --> 00:01:29.350 But before we can start using it, 00:01:29.740 --> 00:01:32.450 we first have to get it onto our target workstation. 00:01:32.970 --> 00:01:34.560 There are multiple ways which you could transfer a 00:01:34.560 --> 00:01:36.220 program to your target workstation. 00:01:36.840 --> 00:01:39.320 I chose to use my Kali workstation as a web server 00:01:39.420 --> 00:01:41.150 and host the file using Apache. 00:01:41.840 --> 00:01:45.050 So all I have to do is navigate to my Kali Linux machine, 00:01:45.050 --> 00:01:50.410 which is at this IP, and then type PsExec.exe, and I'll be able 00:01:50.410 --> 00:01:53.890 to download the file. So I'll save this as PsExec in my 00:01:53.890 --> 00:01:56.150 Downloads folder, and then I'm all set. 00:01:56.800 --> 00:02:01.440 Alright, so we'll just navigate to the folder where we stored that. In reality, 00:02:01.440 --> 00:02:02.930 you'd probably want to start somewhere other than 00:02:02.930 --> 00:02:04.530 the Downloads folder, but again, 00:02:04.530 --> 00:02:06.190 the focus of this course is on the operation of 00:02:06.190 --> 00:02:08.320 PsExec, not covering your tracks. 00:02:08.380 --> 00:02:10.430 So, with that in mind, 00:02:10.520 --> 00:02:14.630 to run PsExec all you have to do is type the command and 00:02:14.630 --> 00:02:16.290 that will pull up our list of options. 00:02:17.140 --> 00:02:20.630 So it didn't show up on this machine because I've run PsExec on here before, 00:02:20.730 --> 00:02:22.840 but in a normal situation, 00:02:22.840 --> 00:02:27.630 the first time you're running PsExec you'll see this option accepteula here. 00:02:27.880 --> 00:02:30.370 You're going to need to run that the first time, and if not, 00:02:30.380 --> 00:02:32.880 it will give you a warning letting you know that you have to 00:02:32.880 --> 00:02:35.820 do that, and what that is is just accepting the end user 00:02:35.820 --> 00:02:37.750 license agreement for this tool. 00:02:38.940 --> 00:02:41.710 Now that we got that out of the way, let's explore a few of the options. 00:02:41.840 --> 00:02:45.050 So up here we have the command structure for a typical PsExec command, 00:02:45.440 --> 00:02:49.280 which is going to be psexec followed by a double backslash and either the 00:02:49.280 --> 00:02:52.250 computer name or the IP address of your target host. 00:02:52.940 --> 00:02:55.670 You can also list your targets in a file, and reference that file 00:02:55.670 --> 00:02:58.250 using the @ symbol followed by the file name. 00:02:58.900 --> 00:03:02.660 We can then specify other account credentials if we have them followed 00:03:02.660 --> 00:03:05.200 by another series of options that we can select, 00:03:05.790 --> 00:03:09.320 such as ‑c, which, if we're going to run a program on the remote system, 00:03:09.320 --> 00:03:13.520 we can tell PsExec to first copy that file to the system 00:03:13.530 --> 00:03:16.720 and then run it locally. We have ‑d, 00:03:16.730 --> 00:03:20.030 which won't wait for the process to terminate before moving on. A 00:03:20.030 --> 00:03:23.780 scenario in which you would use this is if you wanted to spawn some sort 00:03:23.780 --> 00:03:28.800 of process or maybe a shell on the remote system or start a program, but 00:03:28.800 --> 00:03:32.580 you don't want PsExec to hang up waiting for that program to finish. 00:03:32.580 --> 00:03:36.710 Using ‑d will tell PsExec to actually start that process, but then 00:03:36.710 --> 00:03:40.550 PsExec will just let you know it started along with the process ID, and 00:03:40.550 --> 00:03:41.050 move on. 00:03:42.240 --> 00:03:44.860 We have ‑f, which operates the same way as ‑d, 00:03:44.860 --> 00:03:48.360 except that it ignores any errors that might be caused if the file 00:03:48.360 --> 00:03:53.290 already exists on the other program. We have ‑i as well, that actually 00:03:53.290 --> 00:03:55.750 causes it to interact with the remote desktop. 00:03:56.240 --> 00:04:00.120 While this is not ideal in a hacking scenario, I've used this 00:04:00.120 --> 00:04:03.050 option in a system administrator role before. So you know 00:04:03.050 --> 00:04:05.140 PsExec runs silently in the background, 00:04:05.140 --> 00:04:08.140 transparent to the user's activity, under whatever credentials 00:04:08.140 --> 00:04:10.990 you're using to run the command. What dash I will do is 00:04:10.990 --> 00:04:13.210 actually show them what you're running. 00:04:13.350 --> 00:04:17.450 So if you wanted to spawn a program that you want a user to interact with, 00:04:17.839 --> 00:04:21.050 this is a good option to use, but for our purposes this is 00:04:21.050 --> 00:04:22.550 not something we're going to mess with. 00:04:23.740 --> 00:04:29.250 We have ‑h to try to use an account's elevated permissions if they're available, 00:04:29.890 --> 00:04:36.780 ‑l to do the opposite and run the commands only in a limited user instead of 00:04:36.930 --> 00:04:42.310 running them from the Administrators group, and further down we can specify a 00:04:42.310 --> 00:04:45.150 certain timeout for a connection to our remote system. 00:04:45.940 --> 00:04:50.150 We also have ‑s here to try to run the process under the system account. 00:04:50.900 --> 00:04:53.890 We also have options to set working directories, another 00:04:53.890 --> 00:04:58.490 copy option using ‑v, and other options to try to mess with 00:04:58.490 --> 00:05:00.050 the user interface down here. 00:05:00.540 --> 00:05:04.240 So a quick recap of what we learned so far in this demo. We went over the lab 00:05:04.240 --> 00:05:08.570 environment that we're using for this course, we copied PsExec to our target 00:05:08.570 --> 00:05:12.700 machine and navigated to that directory so that we could run it, we also 00:05:12.700 --> 00:05:16.200 looked at PsExec's command structure and some of the available options that 00:05:16.200 --> 00:05:17.350 we'll explore in this course.