WEBVTT 00:00:02.140 --> 00:00:05.440 Now that we understand how WMIOps can be used for lateral movement, 00:00:05.720 --> 00:00:08.630 it's time to start practicing in our own lab environment. 00:00:09.240 --> 00:00:13.850 In this demo, we're going to get started with WMIOps in a small Windows lab. 00:00:14.540 --> 00:00:17.570 We'll start with a quick overview of the lab environment I'm using for this 00:00:17.570 --> 00:00:21.690 course and then obtain WMIOps scripts on our exploited host. 00:00:22.140 --> 00:00:25.110 We'll load the script into the appropriate directory to call the 00:00:25.110 --> 00:00:26.950 commands from the PowerShell command line, 00:00:27.270 --> 00:00:30.750 and then we'll explore the available options in the WMIOps script. 00:00:31.440 --> 00:00:34.220 Once we have the script and confirm that we can call it on our 00:00:34.220 --> 00:00:37.340 exploited host, we'll be ready for the other demos in this course. 00:00:37.340 --> 00:00:40.350 Let's head over to the lab and get started. 00:00:41.470 --> 00:00:42.210 In this course, 00:00:42.220 --> 00:00:46.400 I have a small Windows domain with two Windows 2016 servers, two 00:00:46.400 --> 00:00:49.750 Windows 10 workstations, and one Windows 7 workstation. 00:00:50.610 --> 00:00:53.330 The first server is the domain controller and DNS 00:00:53.330 --> 00:00:56.180 server for the globomantics.test domain. 00:00:57.240 --> 00:00:59.880 The other server is running hMailServer to provide 00:00:59.890 --> 00:01:01.490 email services for the domain. 00:01:02.640 --> 00:01:05.760 I'll be running WMIOps from one of the Windows 10 machines, 00:01:05.770 --> 00:01:08.410 which is acting as the exploited host for this course. 00:01:09.440 --> 00:01:12.430 I'm running the commands directly from the Windows 10 machine to 00:01:12.430 --> 00:01:15.800 focus this course on how to use WMIOps for a lateral movement 00:01:16.150 --> 00:01:19.210 rather than on exploiting the host first and running commands 00:01:19.210 --> 00:01:20.350 remotely through a shell. 00:01:21.040 --> 00:01:22.390 To follow along in this course, 00:01:22.400 --> 00:01:26.050 you do not need to set up a domain or this many remote workstations. 00:01:26.480 --> 00:01:29.250 You can run all the functions against a single target either 00:01:29.250 --> 00:01:31.950 using two Windows virtual machines or a single virtual 00:01:31.950 --> 00:01:33.510 machine running on a Windows host. 00:01:34.280 --> 00:01:37.370 I set up a domain for this lab because it allows me to simulate 00:01:37.370 --> 00:01:40.570 lateral movement using an exploited host and domain credentials 00:01:40.580 --> 00:01:42.550 with permissions on the remote hosts. 00:01:43.540 --> 00:01:44.750 If you're not running a domain, 00:01:44.910 --> 00:01:49.010 I'll explain the necessary modifications you need to take. Now 00:01:49.010 --> 00:01:51.770 that we covered the lab overview, let's head over to the Windows 00:01:51.770 --> 00:01:54.450 10 machine and get started with WMIOps. 00:01:55.700 --> 00:02:00.080 We can download WMIOps from PowerShell using the Invoke‑WebRequest command, 00:02:00.270 --> 00:02:04.850 followed by the URL to the archive on GitHub. Once we obtain it, 00:02:04.850 --> 00:02:08.400 we can place it in this directory. In a penetration test, 00:02:08.650 --> 00:02:11.690 you might host the file from the machine you use to exploit the host 00:02:11.780 --> 00:02:14.460 and transfer it another way, but for this course, 00:02:14.520 --> 00:02:18.170 we're just focused on getting WMIOps and activating it, so we'll 00:02:18.170 --> 00:02:23.070 download it from the internet. Once it downloads, 00:02:23.080 --> 00:02:25.550 we'll extract the files using Expand‑Archive. 00:02:29.390 --> 00:02:31.970 Now we have a directory called WMIOps‑master. 00:02:32.310 --> 00:02:35.880 Let's go ahead and navigate into that directory, and we can check the contents. 00:02:37.110 --> 00:02:40.450 Our script is here, called WMIOps.ps1. 00:02:40.980 --> 00:02:42.840 Let's go ahead and import that into PowerShell. 00:02:45.040 --> 00:02:46.340 Once our script is imported, 00:02:46.350 --> 00:02:48.680 we can get a list of available commands by entering 00:02:48.680 --> 00:02:51.100 get‑command and then adding a few filters. 00:02:51.910 --> 00:02:54.460 If you're unfamiliar with PowerShell, what I'm doing is using 00:02:54.460 --> 00:02:57.440 get‑command to get a list of all the commands and then filtering it 00:02:57.450 --> 00:03:00.250 for what I know WMIOps has for certain variables. 00:03:00.810 --> 00:03:01.650 As an example, 00:03:02.090 --> 00:03:05.930 the Source field and all the WMIOps results is blank, so I'm 00:03:05.930 --> 00:03:09.580 using this to say Source contains nothing. Most, 00:03:09.590 --> 00:03:12.880 but not all of the WMI commands end in WMI. 00:03:13.340 --> 00:03:16.060 So I'm adding in this condition that the name ends in 00:03:16.060 --> 00:03:18.350 WMI and using the star as a wildcard. 00:03:18.890 --> 00:03:22.350 The remaining functions in this script begin with the word Invoke. 00:03:24.340 --> 00:03:27.950 And once we enter that, we have our list of available WMI commands. 00:03:29.510 --> 00:03:31.940 If you can't remember all of the filters for this, 00:03:31.950 --> 00:03:35.480 if you at least remember the Name ‑like *WMI, 00:03:35.790 --> 00:03:38.550 you'll get most of the functions out of the WMI app script. 00:03:38.940 --> 00:03:42.690 It'll only leave out these few that don't have WMI on the end of them. 00:03:44.040 --> 00:03:45.610 Now that we have our list of commands, 00:03:45.800 --> 00:03:49.000 let's explore some of the help options. Help for each of these 00:03:49.000 --> 00:03:51.700 functions is available using the get‑help command, 00:03:51.980 --> 00:03:53.450 followed by the name of the function. 00:03:54.250 --> 00:03:57.250 Let's look at the help for Get‑ActiveNICSWMI. 00:03:58.040 --> 00:03:59.060 In order to get this, 00:03:59.070 --> 00:04:01.820 you may have to run the Update‑Help. Let's go ahead and 00:04:01.820 --> 00:04:05.520 do that now. I'm going to go ahead and let this run and 00:04:05.520 --> 00:04:06.550 come back when it's finished. 00:04:07.340 --> 00:04:10.490 And once that finishes, we'll see the information we were looking for. 00:04:10.490 --> 00:04:15.030 Listed under the help entry for all of the WMIOps commands is a 00:04:15.030 --> 00:04:17.240 synopsis and brief description of what it is. 00:04:17.250 --> 00:04:19.950 In this case, they're identical. But in some, 00:04:19.959 --> 00:04:22.650 the description is a little different and contains more information. 00:04:23.640 --> 00:04:26.110 You'll also get the syntax for the command and have 00:04:26.110 --> 00:04:27.620 some access to additional information. 00:04:28.240 --> 00:04:28.680 Down here, 00:04:28.680 --> 00:04:31.340 we can see that we can add a ‑examples to our command 00:04:31.720 --> 00:04:33.680 and get a few command line examples. 00:04:33.890 --> 00:04:38.850 Let's have a look at those. And for this function, we have two example commands. 00:04:39.340 --> 00:04:42.130 These two examples show you how to run the command with current 00:04:42.130 --> 00:04:45.860 permissions or with credentials you know. The second example is 00:04:45.860 --> 00:04:48.500 what you need to run if you do not have permissions on your target 00:04:48.510 --> 00:04:49.750 with your current credentials. 00:04:50.640 --> 00:04:54.250 Since I'm simulating an exploited host with the necessary domain privileges, 00:04:54.640 --> 00:04:58.970 I'll be using the first example. All the WMIOps scripts have the 00:04:58.970 --> 00:05:02.250 same user and pass options to specify credentials. 00:05:02.510 --> 00:05:03.620 So in future demos, 00:05:03.780 --> 00:05:08.020 you just need to add these if you're not running a domain in your lab. Let's 00:05:08.020 --> 00:05:10.610 try running this command against the Windows 7 machine. 00:05:11.040 --> 00:05:16.150 For me, this target is at the IP address 10.0.0.30. 00:05:17.240 --> 00:05:19.950 If you aren't familiar with command line environments or PowerShell, 00:05:20.440 --> 00:05:23.130 the Tab key can usually help you complete a command once you 00:05:23.130 --> 00:05:26.350 enter a little bit of it. You'll notice that mine had changed 00:05:26.350 --> 00:05:28.770 about halfway through me typing the word Active, and that's 00:05:28.770 --> 00:05:30.180 because I hit that Tab command. 00:05:30.530 --> 00:05:34.750 It can come in handy if you're not sure exactly how the command is formatted. 00:05:35.840 --> 00:05:38.510 Once we run the Get‑ActiveNICS command against our target, 00:05:39.040 --> 00:05:43.400 it returns the IP configuration of the active interface on my Window 7 machine. 00:05:44.140 --> 00:05:47.480 Now that we ran a successful WMIOps command, we're ready for the 00:05:47.480 --> 00:05:50.240 rest of the course where we'll explore more of the functions and 00:05:50.240 --> 00:05:51.710 their uses for lateral movement. 00:05:52.640 --> 00:05:54.300 But before we get into the next demo, 00:05:54.570 --> 00:05:56.750 let's do a quick recap of what we learned so far. 00:05:57.840 --> 00:06:00.980 We started this demo with a quick overview of the lab environment, 00:06:01.240 --> 00:06:05.050 and then we downloaded WMIOps from GitHub onto our exploited host. 00:06:05.840 --> 00:06:07.210 Once we extracted the script, 00:06:07.400 --> 00:06:11.450 we imported it into PowerShell so we could run the WMIOps functions. 00:06:12.340 --> 00:06:15.160 We obtained a list of imported functions and then explored the 00:06:15.160 --> 00:06:18.750 options available in the Get‑ActiveNICSWMI function. 00:06:19.840 --> 00:06:20.450 Finally, 00:06:20.500 --> 00:06:24.470 we ran the Get‑ActiveNICSWMI function against a remote host and 00:06:24.470 --> 00:06:28.610 obtained the IP configuration of the active interface. Coming up, 00:06:28.610 --> 00:06:31.160 we'll use WMIOps to execute more commands, 00:06:31.290 --> 00:06:35.050 manipulate services, and schedule jobs on remote workstations.