WEBVTT

00:00:00.000 --> 00:00:02.630
When you are going to use CrackMapExec as part of your

00:00:02.630 --> 00:00:04.720
Windows network exploitation arsenal,

00:00:04.730 --> 00:00:07.350
make sure to check out the integration with BloodHound.

00:00:07.740 --> 00:00:10.820
BloodHound can help you find the fastest path to your target,

00:00:10.830 --> 00:00:14.180
be it a certain user, box, or global admin domain pwnage,

00:00:14.180 --> 00:00:17.060
it is able to map out all sessions, connections,

00:00:17.060 --> 00:00:20.440
and elevation steps it requires to successfully obtain your goal.

00:00:20.600 --> 00:00:21.600
Within CME,

00:00:21.600 --> 00:00:24.140
there is functionality that allows you to set the host

00:00:24.140 --> 00:00:26.230
you already own as such in BloodHound.

00:00:26.230 --> 00:00:29.460
So it can plan a route with that information in its data pool.

00:00:30.040 --> 00:00:34.750
CME also has the ability to inject payloads in the memory of a target system or

00:00:34.750 --> 00:00:38.060
just execute a program remotely through these four methods.

00:00:38.130 --> 00:00:40.660
CME will try them in this exact order.

00:00:41.140 --> 00:00:41.630
Of course,

00:00:41.630 --> 00:00:44.990
you can also specify the exact methods you would like to use by adding the

00:00:44.990 --> 00:00:47.950
switch mentioned above and the method of choice behind it.

00:00:48.540 --> 00:00:49.960
With the integration of BloodHound,

00:00:50.130 --> 00:00:53.460
there should also be a possibility to spawn shells from CME.

00:00:53.940 --> 00:00:56.620
Luckily, there are some nice integrations with Empire,

00:00:56.630 --> 00:01:00.180
as well as Metasploit so you can connect through the API to launch

00:01:00.190 --> 00:01:03.200
implants to your preferred post‑exploitation framework.

00:01:03.210 --> 00:01:06.120
If you are not familiar with any of these integrated tools,

00:01:06.120 --> 00:01:09.310
do check out their courses here, on Pluralsight as well,

00:01:09.320 --> 00:01:11.250
and add those to your toolbelt too.

00:01:11.250 --> 00:01:11.600
Lastly,

00:01:11.600 --> 00:01:14.060
I would like to give you some technical information on

00:01:14.060 --> 00:01:15.620
the technique used in this course.

00:01:15.630 --> 00:01:17.550
Our industry colleague, harmj0y,

00:01:17.550 --> 00:01:20.240
wrote a great article with everything you need to know about this

00:01:20.240 --> 00:01:23.430
technique and even some pointers on how to defend against it.

00:01:23.430 --> 00:01:24.100
With this,

00:01:24.110 --> 00:01:28.190
I am sure that you will crack a box to map an AD network and exec

00:01:28.190 --> 00:01:30.750
your payloads to achieve your goal like a boss.

00:01:31.340 --> 00:01:34.550
Thank you for watching Lateral Movement with CrackMapExec on Pluralsight,

00:01:34.550 --> 00:01:38.640
and I hope you join me and other authors to learn about more tools

00:01:38.640 --> 00:01:41.090
to add to your red team arsenal in the future.