WEBVTT

00:00:02.180 --> 00:00:02.870
In this demo,

00:00:02.880 --> 00:00:06.990
we use WMIOps to run PowerShell scripts on remote hosts, enable

00:00:06.990 --> 00:00:09.750
services, and laterally move through the network.

00:00:10.640 --> 00:00:13.670
We'll use WMIOps to run PowerShell scripts remotely

00:00:13.950 --> 00:00:16.050
and enable access on other systems.

00:00:16.840 --> 00:00:20.850
We'll also use WMIOps commands to enable remote PowerShell access.

00:00:22.300 --> 00:00:24.810
Using these techniques allows you to laterally move through a

00:00:24.810 --> 00:00:27.450
network using the credentials you already obtained.

00:00:28.510 --> 00:00:32.189
Let's head over to the lab and get started. To start this demo,

00:00:32.189 --> 00:00:35.770
we'll send a script file over to the domain controller and use it

00:00:35.770 --> 00:00:37.850
to create an account in Active Directory.

00:00:38.340 --> 00:00:42.850
I called this script MakeUser, and it's included in your demo files.

00:00:43.240 --> 00:00:46.760
It creates a simple user called Hacked in Globomantics domain.

00:00:48.620 --> 00:00:52.450
We can copy this file to the domain controller using a simple copy command.

00:00:53.140 --> 00:00:54.380
Once the file is copied,

00:00:54.530 --> 00:00:58.740
we can execute the script using the Invoke‑ExecCommandWMI function

00:00:59.110 --> 00:01:01.150
to run the script using a PowerShell command.

00:01:03.910 --> 00:01:06.660
Once we get confirmation that this command ran successfully,

00:01:06.970 --> 00:01:09.090
we can check in Active Directory to see if our

00:01:09.090 --> 00:01:11.800
account was created. And there it is.

00:01:11.900 --> 00:01:15.150
The Hacked account is listed in our Active Directory Users container.

00:01:16.240 --> 00:01:18.730
Now that we know how to run scripts against remote servers,

00:01:18.890 --> 00:01:21.430
we have one other test to accomplish, and that is to

00:01:21.430 --> 00:01:23.850
leverage WMIOps for lateral movement.

00:01:25.240 --> 00:01:26.250
To accomplish this,

00:01:26.640 --> 00:01:31.510
we'll use the same Invoke‑ExecCommandWMI function to run a command to

00:01:31.510 --> 00:01:36.310
enable remote PowerShell sessions. The command we'll run is winrm

00:01:36.310 --> 00:01:38.850
quickconfig to enable remote PowerShell.

00:01:40.040 --> 00:01:44.480
Once that succeeds, we can establish a PowerShell session using a few commands.

00:01:45.570 --> 00:01:46.100
First,

00:01:46.110 --> 00:01:49.340
we need to capture the credentials for our session and store them in a

00:01:49.340 --> 00:01:55.230
variable. We can use Get‑Credential and store it in the value cred. And then we

00:01:55.230 --> 00:02:00.690
just enter their credentials for our administrator account, and then that saved

00:02:00.690 --> 00:02:02.750
those credentials under the cred variable.

00:02:03.340 --> 00:02:06.650
Now we need to create the session and store that as variable as well.

00:02:07.240 --> 00:02:10.970
We can use New‑PSSession with the credential we just captured and

00:02:10.970 --> 00:02:13.250
target the domain controller by computer name.

00:02:17.940 --> 00:02:21.040
Now we can enter the session using Enter‑PSSession

00:02:21.370 --> 00:02:22.850
followed by our session variable.

00:02:24.000 --> 00:02:27.810
And now we have a PowerShell session on our domain controller Let's

00:02:27.810 --> 00:02:30.050
do a quick recap of what we learned in this demo.

00:02:31.040 --> 00:02:34.520
We started out this demo by using the Invoke‑ExecCommandWMI

00:02:34.520 --> 00:02:38.030
function to run a script on the domain controller and create

00:02:38.030 --> 00:02:39.750
a user in Globomantics' domain.

00:02:40.640 --> 00:02:43.670
We then conducted a successful lateral movement by using

00:02:43.670 --> 00:02:46.840
the same function to enable remote PowerShell access and

00:02:46.840 --> 00:02:48.250
entering a PowerShell session.

00:02:48.840 --> 00:02:52.600
Throughout this course, you successfully downloaded and imported WMIOps,

00:02:52.720 --> 00:02:56.330
used it to gather system information, enabled services using both

00:02:56.330 --> 00:02:59.980
commands and the task scheduler, and successfully laterally moved

00:02:59.990 --> 00:03:01.550
to another server within the domain.