WEBVTT

00:00:00.840 --> 00:00:04.200
It's time for a demo where we use PsExec to execute some

00:00:04.200 --> 00:00:06.210
commands on other Windows machines.

00:00:06.980 --> 00:00:07.650
In this demo,

00:00:07.650 --> 00:00:09.710
we're going to be running a command to obtain some

00:00:09.710 --> 00:00:12.150
information about a Windows 10 target we have,

00:00:12.640 --> 00:00:15.210
and we're going to see if we can run a few commands on that Windows

00:00:15.210 --> 00:00:18.050
10 target to find some new targets on our network.

00:00:18.620 --> 00:00:20.830
Using these features will allow you to run other

00:00:20.830 --> 00:00:22.420
commands on remote workstations.

00:00:22.760 --> 00:00:25.890
And this last scenario is used in a situation where you have exploited a

00:00:25.890 --> 00:00:29.290
host, and you want to use it to try to find some new targets on the

00:00:29.300 --> 00:00:33.060
internal network that it might have access to but which you can't reach

00:00:33.070 --> 00:00:34.750
from your original hacking machine.

00:00:35.540 --> 00:00:37.950
Let's head over to our exploited Windows 7 machine

00:00:38.340 --> 00:00:40.050
and run a few PsExec commands.

00:00:40.720 --> 00:00:43.450
All we need to run PsExec is to type the command,

00:00:44.040 --> 00:00:44.830
and if you remember,

00:00:44.830 --> 00:00:48.510
it's followed by a double backslash and then the IP address of our target,

00:00:48.570 --> 00:00:54.210
which in my case is 192.168.178.60, and then we follow

00:00:54.210 --> 00:00:57.420
that with the command we want to run. In this example,

00:00:57.430 --> 00:00:59.040
I'll just run a basic ipconfig.

00:01:00.340 --> 00:01:02.270
And once it goes through on that remote machine,

00:01:02.280 --> 00:01:05.519
we can see the ipconfig results proving that it

00:01:05.519 --> 00:01:07.350
actually ran on that remote workstation.

00:01:08.070 --> 00:01:10.250
Now that we know how to use PsExec to run a command,

00:01:10.840 --> 00:01:13.330
let's run something that gives us a little bit more information.

00:01:13.380 --> 00:01:16.530
So let's try using PsExec to have our target host ping some

00:01:16.530 --> 00:01:18.250
of the other workstations in its domain.

00:01:18.940 --> 00:01:22.470
We'll start with having it ping the domain itself. To do that, we'll, again,

00:01:22.470 --> 00:01:27.650
use PsExec, followed by the double backslash and the IP address of our target.

00:01:28.910 --> 00:01:31.840
Then we'll follow that with a ping and our target host.

00:01:32.040 --> 00:01:35.320
Let's start out trying to just ping the domain and see what happens.

00:01:35.940 --> 00:01:38.720
Feel free to replace this if you actually set up a domain with a

00:01:38.720 --> 00:01:40.950
domain or another workstation if you prefer.

00:01:41.540 --> 00:01:42.360
And once it starts,

00:01:42.360 --> 00:01:47.490
we can see that it resolved that IP address to 192.168.178.54,

00:01:47.490 --> 00:01:51.330
which is the IP of the domain controller for this domain, and it

00:01:51.330 --> 00:01:52.850
successfully received our pings.

00:01:53.640 --> 00:01:56.630
So now that we've seen how to use PsExec to run commands on remote

00:01:56.630 --> 00:02:00.090
workstations, let's do a quick recap of what we learned so far in this

00:02:00.090 --> 00:02:04.800
demo. The first thing we did was use PsExec to run a simple ipconfig on a

00:02:04.800 --> 00:02:08.400
remote workstation and verified that we can use PsExec to connect to that

00:02:08.400 --> 00:02:11.800
remote workstation and were able to run commands on it with the current

00:02:11.800 --> 00:02:12.950
permissions that we have.

00:02:13.780 --> 00:02:17.440
We then used PsExec to run a ping against the domain and found the IP

00:02:17.440 --> 00:02:20.110
address of the domain controller from that remote workstation.