WEBVTT

00:00:01.540 --> 00:00:02.080
Hello,

00:00:02.090 --> 00:00:06.460
I'm Matt Glass, and welcome to this course on lateral movement with WMIOps.

00:00:06.840 --> 00:00:10.680
In this course, I'll show you how to use WMIOps to execute commands,

00:00:10.910 --> 00:00:13.560
PowerShell scripts, and remotely access Windows

00:00:13.560 --> 00:00:16.650
workstations using a host you already exploited.

00:00:17.240 --> 00:00:21.170
But first, let's look at what WMIOps is and how it's used.

00:00:21.740 --> 00:00:26.400
WMIOps is a PowerShell script that was created by Chris Truncer. This

00:00:26.400 --> 00:00:29.930
script leverages the capabilities of Windows Management Instrumentation,

00:00:29.940 --> 00:00:33.170
or WMI, to perform actions on Windows hosts.

00:00:33.840 --> 00:00:38.240
WMIOps is specifically designed to perform information gathering and remote

00:00:38.250 --> 00:00:43.500
execution actions on remote Windows hosts as part of a penetration test. You can

00:00:43.500 --> 00:00:46.270
download the script and associated files from GitHub.

00:00:46.940 --> 00:00:50.780
Once loaded into PowerShell, WMIOps will enable you to execute

00:00:50.780 --> 00:00:54.070
PowerShell commands on other Windows hosts using the permissions you

00:00:54.070 --> 00:00:57.570
obtained on the host you exploited. On the kill chain,

00:00:57.940 --> 00:01:03.580
WMIOps falls under lateral movement only. It is not used for exploitation,

00:01:03.770 --> 00:01:06.750
escalation, or any functions beyond lateral movement.

00:01:07.640 --> 00:01:11.450
This is due to its requirement for permissions to execute against the system.

00:01:12.640 --> 00:01:15.360
The attack knowledge base developed by MITRE categorizes

00:01:15.360 --> 00:01:18.530
adversary tactics and techniques into multiple categories to

00:01:18.530 --> 00:01:20.170
describe the adversary's behavior.

00:01:20.840 --> 00:01:24.630
The tactics are categories that cover different phases of an attack

00:01:24.840 --> 00:01:28.190
and allow defensive teams to model and adversary's actions and

00:01:28.190 --> 00:01:29.870
improve the defense of their networks.

00:01:31.640 --> 00:01:34.790
We will cover two techniques that WMIOps can be used

00:01:34.790 --> 00:01:37.770
for. The first is remote services,

00:01:37.930 --> 00:01:40.940
in particular, the sub‑technique for Windows admin shares.

00:01:41.740 --> 00:01:45.760
The second technique is Windows Management Instrumentation, or WMI.

00:01:47.540 --> 00:01:50.860
WMIOps can accomplish this by enabling adversaries who have

00:01:50.860 --> 00:01:53.910
already exploited a Windows machine and gained sufficient

00:01:53.910 --> 00:01:56.660
privileges to move laterally through the network.

00:01:57.440 --> 00:02:00.820
They could use WMIOps to run PowerShell commands on other Windows

00:02:00.820 --> 00:02:03.470
workstations and obtain information about them.

00:02:04.240 --> 00:02:07.270
Or, if they had sufficient privileges from the exploited user,

00:02:07.640 --> 00:02:11.360
they could use WMIOps to access Windows servers within that data center.

00:02:12.140 --> 00:02:14.710
WMIOps allows hackers to gather information,

00:02:14.940 --> 00:02:15.910
transfer files,

00:02:16.090 --> 00:02:19.200
execute PowerShell commands, and remotely access other Windows

00:02:19.200 --> 00:02:21.560
machines to laterally move through a network.