WEBVTT

00:00:02.340 --> 00:00:02.620
Alright,

00:00:02.620 --> 00:00:06.400
on to our last demo where we'll be doing some lateral movement with PsExec.

00:00:07.140 --> 00:00:09.760
To start that, we're going to laterally move to our Windows 10

00:00:09.760 --> 00:00:12.950
machine and interact with it using a command prompt.

00:00:13.340 --> 00:00:13.940
From there,

00:00:13.940 --> 00:00:15.860
we're going to finish what we started in the last demo by

00:00:15.860 --> 00:00:19.410
using PsExec to run commands from this Windows 10 machine

00:00:19.430 --> 00:00:20.750
on our domain controller.

00:00:21.340 --> 00:00:22.580
By using these techniques,

00:00:22.590 --> 00:00:25.190
you'll learn how to effectively use PsExec to

00:00:25.190 --> 00:00:26.620
laterally move throughout a network,

00:00:26.620 --> 00:00:28.900
as long as you have permissions on your target.

00:00:29.440 --> 00:00:32.450
Let's head back over to that Windows 7 machine and get started.

00:00:33.240 --> 00:00:35.910
Alright, it's finally time to do some lateral movement.

00:00:36.540 --> 00:00:39.010
So in order to do that what we're going to do is use our

00:00:39.010 --> 00:00:40.990
same psexec command we've been using,

00:00:40.990 --> 00:00:43.610
and this time the command we're going to run is

00:00:43.610 --> 00:00:46.570
cmd​.exe with no further arguments.

00:00:46.770 --> 00:00:50.040
So what this is going to do is start a command prompt on the remote workstation,

00:00:50.050 --> 00:00:53.980
but allow us to interact directly with it in this same session.

00:00:54.640 --> 00:00:55.650
So we'll go ahead and run that.

00:00:58.240 --> 00:00:59.260
And once it starts up,

00:00:59.260 --> 00:01:03.970
we see the familiar command prompt start in our Windows\system32 directory.

00:01:04.440 --> 00:01:08.550
The difference is this time we're on the Windows 10 machine.

00:01:08.940 --> 00:01:12.960
So, we have now successfully laterally moved to our Windows 10 machine,

00:01:12.960 --> 00:01:15.800
but let's finish up what we started in the last module and run a

00:01:15.800 --> 00:01:18.000
PsExec command against our domain controller.

00:01:18.830 --> 00:01:21.350
We put everything that we downloaded to this machine in the C

00:01:21.350 --> 00:01:25.450
drive, so let's change directory over there. We'll do a quick dir

00:01:25.560 --> 00:01:26.970
to make sure that we still have everything,

00:01:26.970 --> 00:01:27.690
which we do.

00:01:28.730 --> 00:01:32.140
To speed things up, you can just use a copy command like this one to copy

00:01:32.140 --> 00:01:35.300
that makeuser.ps1 file over to the domain controller.

00:01:36.240 --> 00:01:37.820
And now we're all set to run it.

00:01:37.980 --> 00:01:42.060
So, to do that, we're going to use the same PsExec command we've been using,

00:01:42.060 --> 00:01:43.390
double backslash,

00:01:43.570 --> 00:01:45.920
the IP address of the domain controller at this

00:01:45.920 --> 00:01:48.750
time, and now we'll run PowerShell,

00:01:49.740 --> 00:01:53.120
followed by the path to our makeuser.ps1 file.

00:01:54.640 --> 00:01:58.250
Alright, and it looks like it succeeded, but we'll verify that in a minute.

00:01:58.680 --> 00:02:03.210
Now, I will say if you get a handle is invalid error or a permission error,

00:02:03.640 --> 00:02:07.330
Windows 10 and Server 2016 have a few security mechanisms built in,

00:02:07.340 --> 00:02:09.850
which from time to time can trip you up with PsExec.

00:02:10.440 --> 00:02:11.610
So if this happened to you,

00:02:11.620 --> 00:02:15.430
go back and recreate the session with Windows 10, but manually

00:02:15.430 --> 00:02:17.900
type in the credentials with a ‑u and a ‑p,

00:02:18.940 --> 00:02:20.490
and that should help resolve it.

00:02:20.640 --> 00:02:24.120
You can try the same thing manually using a ‑u and ‑p

00:02:24.120 --> 00:02:26.450
against the Server 2016 server.

00:02:27.540 --> 00:02:31.180
One way that we can check this is to actually log in to our Active

00:02:31.180 --> 00:02:35.310
Directory server and see if the user was created, or if you notice,

00:02:35.310 --> 00:02:36.980
we were able to run a PowerShell command.

00:02:37.520 --> 00:02:39.940
Let's see if we can laterally move over and establish a

00:02:39.940 --> 00:02:42.560
PowerShell session with our domain controller.

00:02:43.740 --> 00:02:47.750
And this time we'll try to directly access the domain controller.

00:02:50.380 --> 00:02:52.900
And this time we can see that we're able to jump directly into a

00:02:52.900 --> 00:02:55.090
PowerShell session on the domain controller.

00:02:55.380 --> 00:02:57.140
And now since we are in the domain controller,

00:02:57.260 --> 00:03:00.220
we can run Active Directory PowerShell commands and we

00:03:00.220 --> 00:03:01.770
can see if that user was created.

00:03:02.620 --> 00:03:05.530
And for that, we type a get‑aduser and a name,

00:03:05.530 --> 00:03:08.330
in my case I created an account called hackedGlobo.

00:03:10.090 --> 00:03:13.070
And there's your verification that the script successfully created a

00:03:13.070 --> 00:03:16.050
user called hackedGlobo on the Globomantics domain.

00:03:17.120 --> 00:03:20.730
So now that we confirm that and we've laterally moved to two different machines,

00:03:20.890 --> 00:03:23.350
let's do a quick recap of what we covered in this demo.

00:03:24.340 --> 00:03:27.710
We started out this demo using PsExec to establish a command

00:03:27.710 --> 00:03:29.700
prompt session with our Windows 10 machine.

00:03:31.040 --> 00:03:31.560
From there,

00:03:31.570 --> 00:03:34.570
we copied that PowerShell script over to our domain controller

00:03:35.240 --> 00:03:39.110
and then used PsExec to run it and successfully create a new

00:03:39.110 --> 00:03:40.750
user in the Globomantics domain.

00:03:41.740 --> 00:03:46.420
We then verified that by first using PsExec to do a successful lateral move and

00:03:46.420 --> 00:03:49.230
establish a PowerShell session with our domain controller.

00:03:49.590 --> 00:03:52.670
We then used get‑aduser to verify that our script had

00:03:52.670 --> 00:03:55.080
successfully run and created the user hackedGlobo.

00:03:56.540 --> 00:03:59.950
So, I know that there are more efficient ways of accomplishing these same tasks.

00:04:00.530 --> 00:04:03.460
As you can see, we could have gone straight from our Windows 7 machine,

00:04:03.470 --> 00:04:05.150
established a PowerShell session,

00:04:05.540 --> 00:04:09.320
and just created the user using a new aduser command instead of

00:04:09.320 --> 00:04:11.310
writing a script and downloading it to Windows 10.

00:04:12.140 --> 00:04:12.580
But again,

00:04:12.590 --> 00:04:15.080
the goal of this course was to demonstrate lateral movement

00:04:15.080 --> 00:04:18.560
with PsExec. So by going through this process,

00:04:18.880 --> 00:04:22.440
you've learned how to successfully use PsExec to run different programs,

00:04:22.660 --> 00:04:23.570
to run scripts,

00:04:23.830 --> 00:04:26.090
and to laterally move into different machines

00:04:26.090 --> 00:04:27.790
throughout a domain that you've exploited.