WEBVTT

00:00:02.200 --> 00:00:02.960
In this demo,

00:00:02.970 --> 00:00:06.320
we're going to start using WMIOps to execute commands and

00:00:06.320 --> 00:00:09.320
take other actions against Windows machines and Globomantics

00:00:09.320 --> 00:00:11.250
domain from our exploited host.

00:00:12.240 --> 00:00:17.780
We'll use the WMIOps Invoke ‑ExecCommandWMI function to

00:00:17.780 --> 00:00:20.250
execute commands against these remote hosts.

00:00:21.240 --> 00:00:24.850
We'll also use the job scheduling and service manipulation functions

00:00:25.130 --> 00:00:27.750
to manipulate services and schedule jobs remotely.

00:00:28.540 --> 00:00:31.450
Using these features will allow us to take actions against

00:00:31.450 --> 00:00:34.500
remote workstations using credentials we already obtained by

00:00:34.500 --> 00:00:36.190
exploiting one of the machines.

00:00:37.230 --> 00:00:39.880
Let's head over to the lab and get started.

00:00:39.880 --> 00:00:42.360
To run commands on our targets,

00:00:42.370 --> 00:00:46.050
we're going to use the Invoke ‑ExecCommandWMI function.

00:00:46.840 --> 00:00:47.460
In this example,

00:00:47.460 --> 00:00:50.050
we're going to try to use this command to make a change on the

00:00:50.050 --> 00:00:53.250
Window 7 device's registry and enable Remote Desktop.

00:00:54.500 --> 00:00:56.870
I'll start by going into the Window 7 machine and

00:00:56.870 --> 00:00:59.050
confirming that Remote Desktop is not allowed.

00:01:04.890 --> 00:01:07.590
And I've now set this to Don't allow connection to the computer.

00:01:10.340 --> 00:01:11.470
To double check that that worked,

00:01:11.470 --> 00:01:14.250
let's try to access Remote Desktop from the Windows 10 machine.

00:01:17.440 --> 00:01:18.250
As expected,

00:01:18.260 --> 00:01:20.800
we're no longer able to access the window 7 target from our

00:01:20.800 --> 00:01:22.890
Windows 10 machine using Remote Desktop.

00:01:23.610 --> 00:01:25.150
If we want to enable this function,

00:01:25.150 --> 00:01:27.690
one way to accomplish that is to modify the registry

00:01:27.690 --> 00:01:29.750
key that is disabling Remote Desktop.

00:01:30.610 --> 00:01:35.030
We can do this using the Invoke ‑ExecCommandWMI function and having

00:01:35.030 --> 00:01:37.650
it run a reg add command with the appropriate key.

00:01:38.100 --> 00:01:39.080
Let's see how that looks.

00:01:40.320 --> 00:01:43.780
We'll start by typing the command Invoke ‑ExecCommandWMI,

00:01:43.780 --> 00:01:48.290
then specifying a target, which in my case will be 10.0.0.30.

00:01:48.300 --> 00:01:54.450
Now use the ‑Command option and follow it with a reg add command.

00:01:55.190 --> 00:01:56.640
The key we need to change is in the

00:01:56.650 --> 00:02:03.490
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server

00:02:03.490 --> 00:02:03.990
Hive.

00:02:04.840 --> 00:02:08.009
The specific key is fDenyTSConntions.

00:02:08.009 --> 00:02:14.200
This key is a DWORD, and we need to enter zero to enable Remote Desktop.

00:02:15.590 --> 00:02:18.650
We'll then at a /f as well to force the change.

00:02:20.590 --> 00:02:21.450
And once we run that,

00:02:21.450 --> 00:02:24.280
we see a display confirming that the process was started

00:02:24.290 --> 00:02:26.920
with a ProcessId and a ReturnValue of 0,

00:02:26.980 --> 00:02:28.750
indicating that it ran successfully.

00:02:29.540 --> 00:02:32.550
Now when we try to access the Windows 7 machine through Remote Desktop,

00:02:33.010 --> 00:02:35.600
we get a prompt for credentials, and once we enter them,

00:02:35.660 --> 00:02:37.750
we're able to access the Windows 7 machine.

00:02:38.750 --> 00:02:40.650
Now that we confirm that we can make this change,

00:02:41.040 --> 00:02:44.190
let's go ahead and log off the Remote Desktop and explore using

00:02:44.190 --> 00:02:46.590
the Job Scheduler to make additional changes.

00:02:47.900 --> 00:02:52.680
The Invoke‑SchedJobManipulation function in WMIOps allows us to make

00:02:52.680 --> 00:02:55.110
changes to a remote workstation's Task Scheduler.

00:02:55.840 --> 00:02:58.230
We can list, create, or delete jobs,

00:02:58.360 --> 00:03:00.650
enabling us to schedule configuration changes.

00:03:01.640 --> 00:03:02.530
For this example,

00:03:02.540 --> 00:03:06.250
let's go back into our Windows 7 target and deactivate Remote Desktop.

00:03:10.540 --> 00:03:14.850
Now that we deactivated it, this time we'll re‑enable it using a scheduled task,

00:03:15.340 --> 00:03:18.310
which we'll create using the job scheduling manipulator function.

00:03:19.740 --> 00:03:22.840
We'll verify again that we can no longer connect to the Window 7 machine,

00:03:26.840 --> 00:03:27.950
and now we are set.

00:03:28.840 --> 00:03:30.070
To create a scheduled task,

00:03:30.070 --> 00:03:34.080
we start with the Invoke‑SchedJobManipulation function, and

00:03:34.080 --> 00:03:36.550
then specify our target with ‑Targets.

00:03:36.930 --> 00:03:40.700
In my case, it is 10.0.0.30 again.

00:03:41.640 --> 00:03:45.510
Then we used to create option with ‑create, and will use the

00:03:45.510 --> 00:03:47.650
reg add command from the previous example.

00:03:59.240 --> 00:04:00.920
Now we just need to add a time,

00:04:01.040 --> 00:04:03.750
which I'm going to set for about 5 minutes from now.

00:04:05.840 --> 00:04:08.450
Once we run it, we should get a confirmation that it was successful.

00:04:08.940 --> 00:04:11.820
We can check this using another feature of Invoke‑SchedJobManipulation

00:04:11.820 --> 00:04:15.790
by using the ‑list option to see our created task.

00:04:16.220 --> 00:04:18.500
Let's go ahead and run that to see what it returns.

00:04:20.019 --> 00:04:23.150
If we saw an error on this task that we wanted to fix before it ran,

00:04:23.540 --> 00:04:27.470
we could use the ‑delete and the JobId, 1 in this case, to

00:04:27.470 --> 00:04:29.150
remove the task from the remote machine.

00:04:29.840 --> 00:04:31.950
Based on this output, our task looks fine.

00:04:32.640 --> 00:04:34.160
Since we have access to our target,

00:04:34.450 --> 00:04:38.520
we can also check the task scheduler to see that it was created, and

00:04:38.520 --> 00:04:40.700
we see that it populated in our task scheduler.

00:04:41.550 --> 00:04:44.650
We can confirm that it runs by waiting for the execution time.

00:04:45.530 --> 00:04:48.950
I'll pause the video here and come back after the time target passes,

00:04:49.840 --> 00:04:51.290
and once the time target passes,

00:04:51.290 --> 00:04:55.320
we just need to refresh the task scheduler, and we can see that the operation

00:04:55.320 --> 00:05:00.320
completed successfully. For true verification, let's see if we can access a

00:05:00.320 --> 00:05:09.570
remote workstation using Remote Desktop again. And we can establish a Remote

00:05:09.570 --> 00:05:14.070
Desktop session again showing that we successfully scheduled the task to modify

00:05:14.070 --> 00:05:19.040
the registry. Before we move on to the next demo, let's do a quick recap of

00:05:19.040 --> 00:05:20.050
what we learned so far.

00:05:21.300 --> 00:05:25.620
We started this module using the Invoke‑ExecCommandWMI to run commands

00:05:25.620 --> 00:05:28.250
on remote workstations using our domain credentials.

00:05:29.140 --> 00:05:32.450
We used this function to modify a register key and enable Remote

00:05:32.450 --> 00:05:34.650
Desktop connections on our Windows 7 target.

00:05:35.740 --> 00:05:37.050
Once that was successful,

00:05:37.130 --> 00:05:40.110
we accomplished the same task through another method using

00:05:40.110 --> 00:05:43.840
theInvoke‑SchedJobManipulation function to create a scheduled

00:05:43.840 --> 00:05:45.950
task to modify the same registry key.

00:05:47.240 --> 00:05:50.950
Using these functions enables you to take immediate actions or

00:05:50.950 --> 00:05:53.450
schedule future actions on remote Windows machines.

00:05:54.200 --> 00:05:55.050
In the next demo,

00:05:55.060 --> 00:05:59.150
we use other WMIOps commands to gather information from a remote host.