WEBVTT 00:00:01.440 --> 00:00:04.280 Hello again, and welcome to the next demo for this course. We will be using 00:00:04.280 --> 00:00:07.780 PsExec to run programs against different Windows targets. 00:00:08.650 --> 00:00:09.250 In this demo, 00:00:09.250 --> 00:00:11.470 we're going to look at how to structure a PsExec command 00:00:11.480 --> 00:00:13.640 to execute programs on remote machines, 00:00:13.760 --> 00:00:16.550 even if those programs aren't already on that remote workstation. 00:00:17.640 --> 00:00:21.090 We're also going to use PsExec to attack our target and see if we can 00:00:21.090 --> 00:00:23.960 obtain a connection to a new target through that one. 00:00:24.940 --> 00:00:28.910 Using these techniques with PsExec allows you to run programs or scripts on 00:00:28.910 --> 00:00:32.290 remote workstations that can create additional vulnerabilities. 00:00:33.240 --> 00:00:34.710 Now that we understand what we're going to cover, 00:00:34.770 --> 00:00:37.320 let's head back over to our exploited workstation and 00:00:37.320 --> 00:00:38.980 start running some PsExec commands. 00:00:39.940 --> 00:00:42.840 What we're going to do is use PsExec to run programs on our 00:00:42.840 --> 00:00:45.570 remote machine and begin setting up our Windows 10 00:00:45.570 --> 00:00:47.950 workstation for use in the next technique. 00:00:48.870 --> 00:00:49.860 In order to do that, 00:00:49.870 --> 00:00:53.700 we're going to set up over these two demos a process of getting files 00:00:53.700 --> 00:00:57.820 onto our Windows 10 machine using the wget program to practice using 00:00:57.820 --> 00:01:02.480 PsExec to execute remote programs on our Windows 10 machine. We'll be 00:01:02.480 --> 00:01:07.450 using wget to copy over a PowerShell script and PsExec itself to the 00:01:07.450 --> 00:01:08.450 Windows 10 machine. 00:01:09.090 --> 00:01:12.170 And then in the next module, we'll use everything we set up to 00:01:12.170 --> 00:01:14.810 create an account on the Active Directory server through our 00:01:14.810 --> 00:01:17.660 Windows 10 machine. To get started, 00:01:17.670 --> 00:01:20.850 let's head over to our Kali Linux machine and create that PowerShell script. 00:01:22.010 --> 00:01:25.630 So to create the PowerShell script, what we're going to do is 00:01:25.630 --> 00:01:27.610 first just create a file for that script, 00:01:27.620 --> 00:01:32.750 which we'll call makeuser.ps1 and place it in our HTML directory. 00:01:33.740 --> 00:01:36.880 This first line simply imports the Active Directory module 00:01:36.880 --> 00:01:39.050 to our Windows 10 PowerShell session. 00:01:39.840 --> 00:01:42.650 This creates a user named hackedGlobo, 00:01:45.740 --> 00:01:48.870 and then I'm using this symbol to continue this command on the next line. 00:01:49.900 --> 00:01:51.910 This line creates a simple password for the user, 00:01:52.000 --> 00:01:52.460 and again, 00:01:52.460 --> 00:01:57.270 I'm using this character to continue on the next line. And this 00:01:57.270 --> 00:01:59.450 command makes sure that the account is enabled. 00:01:59.460 --> 00:02:02.850 If you don't add the password and tell it to be enabled, 00:02:02.850 --> 00:02:05.580 the account will be disabled with no password and not usable. 00:02:05.700 --> 00:02:08.570 So, we want to have some way to test this and make sure that our 00:02:08.570 --> 00:02:11.380 account is actually created. So now that we have this, we'll go 00:02:11.380 --> 00:02:15.150 ahead and save this file, and start Apache. 00:02:18.010 --> 00:02:22.000 Okay, now we can head back to our Windows 7 machine. Now, 00:02:22.000 --> 00:02:25.030 I have already downloaded wget to this machine so that I can run it. 00:02:25.350 --> 00:02:28.420 And it is a standalone executable like PsExec, so it doesn't 00:02:28.420 --> 00:02:30.950 require installation on your target machine. 00:02:32.140 --> 00:02:34.120 Running a program is slightly different, 00:02:34.130 --> 00:02:39.440 but has a similar beginning of PsExec with a target after a double backslash. 00:02:40.480 --> 00:02:45.570 And this time we used the ‑c to copy the program over to the remote workstation, 00:02:45.660 --> 00:02:47.500 followed by wget.exe, 00:02:48.690 --> 00:02:53.250 followed by the path to our Kali Linux VM and the file we want to download, 00:02:53.740 --> 00:02:56.490 which in this case, will be makeuser.ps1. 00:02:57.440 --> 00:03:01.020 Now we want to direct where wget saves this, so we use the 00:03:01.020 --> 00:03:04.950 wget option ‑O, and we'll just go ahead and save it on the 00:03:04.950 --> 00:03:07.810 C drive. And once that's hit, 00:03:07.810 --> 00:03:10.550 we just run that command, and we'll see what happens. 00:03:12.140 --> 00:03:15.200 And now we have confirmation that wget did, in fact, 00:03:15.210 --> 00:03:18.880 download that file from our Kali Linux VM, and here we 00:03:18.880 --> 00:03:21.890 can see it saved it as C:/makeuser.ps1. 00:03:23.140 --> 00:03:24.080 So to run this command, 00:03:24.080 --> 00:03:28.310 I also want to get PsExec downloaded onto our remote workstation. 00:03:28.490 --> 00:03:31.460 So we're going to go ahead and use the same command, but this 00:03:31.460 --> 00:03:37.110 time we're going to tell it to download PsExec, and we'll 00:03:37.110 --> 00:03:39.650 also place that on the C drive. 00:03:42.940 --> 00:03:44.130 Now that we downloaded that, 00:03:44.140 --> 00:03:46.410 let's verify that it's actually on a remote 00:03:46.410 --> 00:03:48.450 workstation using that same dir command. 00:03:49.540 --> 00:03:55.580 And there it is. So we've got PsExec and our makeuser.ps1 file both saved on 00:03:55.580 --> 00:03:58.950 our remote Windows 10 workstation ready for the next demo. 00:04:00.140 --> 00:04:02.350 But first, let's recap what we learned in this demo. 00:04:03.340 --> 00:04:08.330 We started out using PsExec to copy wget over to the remote workstation and 00:04:08.330 --> 00:04:11.050 run a command to download a file to our Windows 10 machine. 00:04:11.540 --> 00:04:14.640 We had created a makeuser.PowerShell file, 00:04:14.650 --> 00:04:17.380 which we'll use in a later module, and successfully 00:04:17.380 --> 00:04:19.550 copied it to the Windows 10 C directory. 00:04:20.540 --> 00:04:23.210 We then used the same wget command to download 00:04:23.210 --> 00:04:28.150 PsExec to the C directory as well, setting ourselves up for the next demo.