WEBVTT 00:00:02.220 --> 00:00:06.450 In this demo, we use WMIOps to gather information from remote Windows hosts. 00:00:07.120 --> 00:00:09.540 We're going to use some of the functions to gather system 00:00:09.540 --> 00:00:12.900 information from Globomantics hosts and other functions to 00:00:12.900 --> 00:00:14.350 move files between systems. 00:00:15.240 --> 00:00:19.610 Using these functions allows you to leverage WMIOps to gather more information 00:00:19.620 --> 00:00:22.490 about potential targets and move files between machines. 00:00:23.340 --> 00:00:25.250 Let's head over to the lab and get started. 00:00:26.340 --> 00:00:27.360 For these examples, 00:00:27.370 --> 00:00:29.550 I'm going to start gathering more information about one of 00:00:29.560 --> 00:00:33.810 Globomantics' servers with the IP 10.0.0.19. 00:00:34.640 --> 00:00:37.300 Let's start by listing the active processes to try to 00:00:37.300 --> 00:00:38.950 determine what's running on the machine. 00:00:40.340 --> 00:00:40.960 Immediately, 00:00:40.960 --> 00:00:44.010 we gather some information about what this server likely is 00:00:44.200 --> 00:00:45.850 from some of these running processes. 00:00:46.700 --> 00:00:51.110 The presence of Microsoft.ActiveDirectory.WebServices.exe lets us 00:00:51.110 --> 00:00:53.310 know the Active Directory is running on a server. 00:00:53.840 --> 00:00:56.840 The WebServices.exe actually enables us to run Active 00:00:56.840 --> 00:00:58.730 Directory PowerShell commands against it. 00:00:59.110 --> 00:01:00.070 But more importantly, 00:01:00.080 --> 00:01:03.600 this tells us that the server is the domain controller for Globomantics. 00:01:04.440 --> 00:01:07.770 Similarly, the presence of DNS reinforces this conclusion. 00:01:08.640 --> 00:01:12.650 We can also see vmtoolsd.exe at the bottom. 00:01:13.240 --> 00:01:16.050 This indicates that this is likely a VMware virtual machine. 00:01:16.940 --> 00:01:18.650 Now that we know the function of the system, 00:01:18.850 --> 00:01:21.740 let's start exploring different directories that might give us the names 00:01:21.750 --> 00:01:23.840 of some of the administrator accounts for the domain. 00:01:24.940 --> 00:01:29.890 We can start by running Get‑SystemDrivesWMI to return the system drives. 00:01:29.890 --> 00:01:32.980 In this case, the server's only running on the C: drive. 00:01:33.740 --> 00:01:36.430 Since Microsoft creates a user profile for all the 00:01:36.430 --> 00:01:38.050 users that log onto the system, 00:01:38.440 --> 00:01:41.850 we can explore the user folder within the C: drive to see what other 00:01:41.850 --> 00:01:44.350 administrator accounts might exist in the domain. 00:01:47.240 --> 00:01:47.950 From this command, 00:01:47.950 --> 00:01:50.610 we can see the globoadmin account and the built‑in 00:01:50.610 --> 00:01:52.230 administrator account for the domain, 00:01:52.400 --> 00:01:55.610 which is the account I'm using to access all the devices. 00:01:55.610 --> 00:01:56.940 Just for fun, 00:01:56.950 --> 00:01:58.980 I created a text file on the administrator's 00:01:58.980 --> 00:02:00.890 desktop to try out the next command. 00:02:01.800 --> 00:02:05.750 This simple text document just tells us that we are able to access the file. 00:02:06.840 --> 00:02:08.900 We can start looking for this file using the 00:02:08.900 --> 00:02:13.150 Find‑UserSpecifiedFileWMI command followed by our target, 00:02:13.740 --> 00:02:15.750 the drive, and the final name. 00:02:18.340 --> 00:02:21.550 Once that completes, we can see the path where the file is stored. 00:02:22.140 --> 00:02:25.210 This function also supports searching for files by file extension, 00:02:25.540 --> 00:02:27.830 which could be valuable in finding scripts or batch 00:02:27.830 --> 00:02:29.760 files that may contain credentials. 00:02:29.760 --> 00:02:35.010 To test if we can access the file, we use the Get‑FileContentsWMI command, 00:02:35.050 --> 00:02:37.250 followed by the directory of that text document. 00:02:37.740 --> 00:02:41.650 If the command is successful, we should return the file contents to the console. 00:02:45.790 --> 00:02:46.640 Once that runs, 00:02:46.640 --> 00:02:49.650 we see the content of that text file displayed here in the console. 00:02:50.200 --> 00:02:51.460 While reading the file is great, 00:02:51.740 --> 00:02:53.830 let's try one more command to actually download the 00:02:53.830 --> 00:02:55.580 file to our exploited workstation. 00:02:56.140 --> 00:02:59.560 For that, we use Invoke‑FileTransferOverWMI. 00:03:00.740 --> 00:03:01.530 For this function. 00:03:01.540 --> 00:03:04.450 We need to enter the credentials for the remote and local user. 00:03:05.140 --> 00:03:08.050 For that, I'm going to use the administrator's account credentials. 00:03:08.790 --> 00:03:11.680 I'll target the domain controller's IP address and specify 00:03:11.680 --> 00:03:17.990 the file at C:\users\administrator\desktop\test.txt, and then 00:03:17.990 --> 00:03:19.450 we need to set a download path. 00:03:19.850 --> 00:03:22.550 In my case, I'm going to place this on the C: drive. 00:03:27.840 --> 00:03:28.960 Once that completes, 00:03:29.170 --> 00:03:34.250 we can check our C: drive for the file, and there it is. Let's open it 00:03:34.250 --> 00:03:38.680 to confirm we got the right file, and we see the same message we saw in 00:03:38.680 --> 00:03:43.110 our console. Before we move on to the next demo, let's do a quick recap 00:03:43.110 --> 00:03:44.150 of what we've learned so far. 00:03:44.740 --> 00:03:48.070 We started this demo by gathering process information using 00:03:48.070 --> 00:03:52.880 Get‑RunningProcessesWMI and discovered the processes that indicated our 00:03:52.880 --> 00:03:56.950 target server was likely a domain controller for Globomantics.test. 00:03:58.140 --> 00:04:02.510 We then used Get‑SystemDrivesWMI to find all the system drives on 00:04:02.510 --> 00:04:07.920 the server and Invoke‑DirectoryListing to find the user profiles. We 00:04:07.920 --> 00:04:12.680 used Get‑FileContentsWMI to pull the file contents of a text file on 00:04:12.680 --> 00:04:14.050 our administrator's desktop. 00:04:14.540 --> 00:04:17.910 And then we downloaded that file to our exploited host using 00:04:17.920 --> 00:04:22.790 Invoke‑FileTransferOverWMI. In the next demo, we'll complete 00:04:22.790 --> 00:04:26.620 this course by using WMIOps to run PowerShell scripts and 00:04:26.620 --> 00:04:28.450 laterally move through the network.